Initial commit

kirby/config/api/authentication.php

@@ -0,0 +1,27 @@
+<?php
+
+use Kirby\Exception\PermissionException;
+
+return function () {
+	$auth               = $this->kirby()->auth();
+	$allowImpersonation = $this->kirby()->option('api.allowImpersonation') ?? false;
+
+	// csrf token check
+	if (
+		$auth->type($allowImpersonation) === 'session' &&
+		$auth->csrf() === false
+	) {
+		throw new PermissionException('Unauthenticated');
+	}
+
+	// get user from session or basic auth
+	if ($user = $auth->user(null, $allowImpersonation)) {
+		if ($user->role()->permissions()->for('access', 'panel') === false) {
+			throw new PermissionException(['key' => 'access.panel']);
+		}
+
+		return $user;
+	}
+
+	throw new PermissionException('Unauthenticated');
+};