Throw exception if request has parameters that are not allowed

Author: isaac-souza

src/Exceptions/ForbidenRequestParamException.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace Givebutter\LaravelKeyable\Exceptions;
+
+class ForbidenRequestParamException extends \Exception
+{
+    //
+}

src/Http/Middleware/AuthenticateApiKey.php

@@ -3,7 +3,9 @@
 namespace Givebutter\LaravelKeyable\Http\Middleware;
 
 use Closure;
+use Givebutter\LaravelKeyable\Exceptions\ForbidenRequestParamException;
 use Givebutter\LaravelKeyable\Models\ApiKey;
+use Illuminate\Http\Request;
 
 class AuthenticateApiKey
 {
@@ -18,6 +20,8 @@ class AuthenticateApiKey
      */
     public function handle($request, Closure $next, $guard = null)
     {
+        $this->checkForbidenRequestParams($request);
+
         //Get API token from request
         $token = $this->getKeyFromRequest($request);
 
@@ -86,4 +90,17 @@ protected function unauthorizedResponse()
             ],
         ], 401);
     }
+
+    private function checkForbidenRequestParams(Request $request): void
+    {
+        $forbidenParams = ['apiKey', 'keyable'];
+
+        foreach ($forbidenParams as $forbidenParam) {
+            if ($request->missing($forbidenParam)) {
+                continue;
+            }
+
+            throw new ForbidenRequestParamException("Request param '{$forbidenParam}' is not allowed.");
+        }
+    }
 }

tests/Feature/AuthenticateApiKey.php

@@ -2,6 +2,7 @@
 
 namespace Givebutter\Tests\Feature;
 
+use Givebutter\LaravelKeyable\Exceptions\ForbidenRequestParamException;
 use Givebutter\Tests\TestCase;
 use Givebutter\Tests\Support\Account;
 use Illuminate\Support\Facades\Route;
@@ -81,4 +82,38 @@ public function request_without_api_key_responds_unauthorized()
 
         $this->get("/api/posts")->assertUnauthorized();
     }
+
+    /**
+     * @test
+     * @dataProvider forbiddenRequestParams
+     */
+    public function throw_exception_if_unauthorized_get_request_has_forbidden_request_query_params(string $queryParam): void
+    {
+        Route::get('/api/posts', function () {
+            return response('All good', 200);
+        })->middleware(['api', 'auth.apikey']);
+
+        $this->get("/api/posts?{$queryParam}=value")->assertInternalServerError();
+    }
+
+    /**
+     * @test
+     * @dataProvider forbiddenRequestParams
+     */
+    public function throw_exception_if_unauthorized_post_request_has_forbidden_request_body_params(string $bodyParam): void
+    {
+        Route::post('/api/posts', function () {
+            return response('All good', 200);
+        })->middleware(['api', 'auth.apikey']);
+
+        $this->post('/api/posts', [$bodyParam => 'value'])->assertInternalServerError();
+    }
+
+    public function forbiddenRequestParams(): array
+    {
+        return [
+            ['keyable'],
+            ['apiKey'],
+        ];
+    }
 }