src/EventSubscriber/ApiRequestLoggingSubscriber.php line 34

Open in your IDE?
  1. <?php
  3. namespace App\EventSubscriber;
  5. use App\Entity\ApiClient;
  6. use App\Entity\ApiRequestLog;
  7. use App\Entity\User;
  8. use App\Security\ApiTokenAuthenticator;
  9. use Doctrine\ORM\EntityManagerInterface;
  10. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  11. use Symfony\Component\HttpKernel\Event\RequestEvent;
  12. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  13. use Symfony\Component\HttpKernel\KernelEvents;
  15. class ApiRequestLoggingSubscriber implements EventSubscriberInterface
  16. {
  17.     private const START_ATTR = '_api_start_time';
  19.     private EntityManagerInterface $em;
  21.     public function __construct(EntityManagerInterface $em)
  22.     {
  23.         $this->em = $em;
  24.     }
  26.     public static function getSubscribedEvents(): array
  27.     {
  28.         return [
  29.             KernelEvents::REQUEST => ['onRequest', 1024],
  30.             KernelEvents::RESPONSE => ['onResponse', -1024],
  31.         ];
  32.     }
  34.     public function onRequest(RequestEvent $event): void
  35.     {
  36.         $request = $event->getRequest();
  37.         if (!str_starts_with($request->getPathInfo(), '/api/v1')) {
  38.             return;
  39.         }
  40.         $request->attributes->set(self::START_ATTR, microtime(true));
  41.     }
  43.     public function onResponse(ResponseEvent $event): void
  44.     {
  45.         $request = $event->getRequest();
  46.         if (!str_starts_with($request->getPathInfo(), '/api/v1')) {
  47.             return;
  48.         }
  49.         $response = $event->getResponse();
  50.         $start = $request->attributes->get(self::START_ATTR);
  51.         $duration = $start ? (int) ((microtime(true) - $start) * 1000) : null;
  53.         $this->attachRateLimitHeaders($request, $response);
  55.         $log = new ApiRequestLog();
  56.         $log->setMethod($request->getMethod());
  57.         $log->setPath($request->getPathInfo());
  58.         $log->setStatusCode($response->getStatusCode());
  59.         $log->setIp($request->getClientIp());
  60.         $log->setUserAgent(substr((string) $request->headers->get('User-Agent', ''), 0, 255));
  61.         $log->setDurationMs($duration);
  63.         $client = $request->attributes->get(ApiTokenAuthenticator::ATTR_CLIENT);
  64.         if ($client instanceof ApiClient) {
  65.             $log->setApiClient($client);
  66.         }
  67.         $impersonated = $request->attributes->get(ApiTokenAuthenticator::ATTR_IMPERSONATED_BY);
  68.         if ($impersonated instanceof User) {
  69.             $log->setImpersonatedByUser($impersonated);
  70.         }
  72.         $errorCode = $this->extractErrorCode($response);
  73.         if ($errorCode !== null) {
  74.             $log->setErrorCode($errorCode);
  75.         }
  77.         try {
  78.             $this->em->persist($log);
  79.             $this->em->flush();
  80.         } catch (\Throwable $e) {
  81.             // logging must never break the response
  82.         }
  83.     }
  85.     private function attachRateLimitHeaders($request, $response): void
  86.     {
  87.         $minute = $request->attributes->get(ApiTokenAuthenticator::ATTR_RATE_MINUTE);
  88.         $hour = $request->attributes->get(ApiTokenAuthenticator::ATTR_RATE_HOUR);
  89.         if (is_array($minute)) {
  90.             $response->headers->set('X-RateLimit-Limit', (string) $minute['limit']);
  91.             $response->headers->set('X-RateLimit-Remaining', (string) $minute['remaining']);
  92.             $response->headers->set('X-RateLimit-Reset', (string) $minute['reset']);
  93.         }
  94.         if (is_array($hour)) {
  95.             $response->headers->set('X-RateLimit-Hour-Limit', (string) $hour['limit']);
  96.             $response->headers->set('X-RateLimit-Hour-Remaining', (string) $hour['remaining']);
  97.         }
  98.     }
  100.     private function extractErrorCode($response): ?string
  101.     {
  102.         if ($response->getStatusCode() < 400) {
  103.             return null;
  104.         }
  105.         $content = $response->getContent();
  106.         if (!is_string($content) || $content === '') {
  107.             return null;
  108.         }
  109.         $data = json_decode($content, true);
  110.         return is_array($data) && isset($data['error']['code']) ? (string) $data['error']['code'] : null;
  111.     }
  112. }