From 8bbc782b9640e5bd06845de96d864e1fcc7bbf04 Mon Sep 17 00:00:00 2001
From: Maurits van der Schee <maurits@vdschee.nl>
Date: Sat, 13 Oct 2018 08:33:10 +0200
Subject: [PATCH] Add support for file uploads

---
 README.md                                     |  2 +-
 api.php                                       | 33 +++++++++++++++----
 examples/clients/auth.php/vanilla.html        |  2 +-
 examples/clients/auth0/vanilla.html           |  2 +-
 examples/clients/upload/form.html             | 12 +++++++
 src/Tqdev/PhpCrudApi/Api.php                  |  4 +++
 .../Middleware/FileUploadMiddleware.php       |  9 +++--
 src/Tqdev/PhpCrudApi/Request.php              | 11 ++++++-
 8 files changed, 62 insertions(+), 13 deletions(-)
 create mode 100644 examples/clients/upload/form.html

diff --git a/README.md b/README.md
index 32f8c09..12a82ba 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ https://github.com/mevdschee/php-crud-api/tree/v1
 
 Related projects:
 
-  - [PHP-API-AUTH](https://github.com/mevdschee/php-api-auth): Authentication add-on supporting JWT for username/password.
+  - [PHP-API-AUTH](https://github.com/mevdschee/php-api-auth): Single file PHP script that is an authentication provider for PHP-CRUD-API (v2)
   - [PHP-SP-API](https://github.com/mevdschee/php-sp-api): Single file PHP script that adds a REST API to a SQL database.
   - [PHP-CRUD-UI](https://github.com/mevdschee/PHP-crud-ui): Single file PHP script that adds a UI to a PHP-CRUD-API (v1) project.
   - [VUE-CRUD-UI](https://github.com/nlware/vue-crud-ui): Single file Vue.js script that adds a UI to a PHP-CRUD-API (v1) project.
diff --git a/api.php b/api.php
index 713defa..fe19a7e 100644
--- a/api.php
+++ b/api.php
@@ -3192,14 +3192,17 @@ class FileUploadMiddleware extends Middleware
         if (!empty($files)) {
             $body = $request->getBody();
             foreach ($files as $fieldName => $file) {
-                if (isset($file['error'])) {
+                if (isset($file['error']) && $file['error']) {
                     return $this->responder->error(ErrorCode::FILE_UPLOAD_FAILED, $fieldName);
                 }
                 foreach ($file as $key => $value) {
-                    if ($key == 'tmp_nam') {
+                    if ($key == 'tmp_name') {
                         $value = base64_encode(file_get_contents($value));
+                        $key = $fieldName;
+                    } else {
+                        $key = $fieldName . '_' . $key;
                     }
-                    $body[$fieldName . '_' . $key] = $value;
+                    $body->$key = $value;
                 }
             }
             $request->setBody($body);
@@ -3290,8 +3293,14 @@ class JwtAuthMiddleware extends Middleware
         }
         foreach ($requirements as $field => $values) {
             if (!empty($values)) {
-                if (!isset($claims[$field]) || !in_array($claims[$field], $values)) {
-                    return array();
+                if ($field == 'alg') {
+                    if (!isset($header[$field]) || !in_array($header[$field], $values)) {
+                        return array();
+                    }
+                } else {
+                    if (!isset($claims[$field]) || !in_array($claims[$field], $values)) {
+                        return array();
+                    }
                 }
             }
         }
@@ -5055,6 +5064,9 @@ class Api
                 case 'jwtAuth':
                     new JwtAuthMiddleware($router, $responder, $properties);
                     break;
+                case 'fileUpload':
+                    new FileUploadMiddleware($router, $responder, $properties);
+                    break;
                 case 'validation':
                     new ValidationMiddleware($router, $responder, $properties, $reflection);
                     break;
@@ -5366,7 +5378,11 @@ class Request
     private function parseBody(String $body = null)
     {
         if (!$body) {
-            $body = file_get_contents('php://input');
+            if (!empty($_FILES)) {
+                $body = json_encode($_POST);
+            } else {
+                $body = file_get_contents('php://input');
+            }
         }
         $this->body = $body;
     }
@@ -5464,6 +5480,11 @@ class Request
         }
         return new Request($method, $path, $query, $headers, $body);
     }
+
+    public function getUploadedFiles(): array
+    {
+        return $_FILES;
+    }
 }
 
 // file: src/Tqdev/PhpCrudApi/Response.php
diff --git a/examples/clients/auth.php/vanilla.html b/examples/clients/auth.php/vanilla.html
index a4e2bce..d7a78ef 100644
--- a/examples/clients/auth.php/vanilla.html
+++ b/examples/clients/auth.php/vanilla.html
@@ -2,7 +2,7 @@
 <head>
 <meta charset="utf-8" /> 
 <script>
-var authUrl = 'authorize.php'; // hostname ending in '.auth0.com'
+var authUrl = 'auth.php'; // hostname ending in '.auth0.com'
 var clientId = 'default'; // client id as defined in auth0
 var audience = 'api.php'; // api audience as defined in auth0
 window.onload = function () {
diff --git a/examples/clients/auth0/vanilla.html b/examples/clients/auth0/vanilla.html
index 8deaa0b..3c17a92 100644
--- a/examples/clients/auth0/vanilla.html
+++ b/examples/clients/auth0/vanilla.html
@@ -19,7 +19,7 @@ window.onload = function () {
                 document.getElementById('output').innerHTML = JSON.stringify(JSON.parse(req.responseText), undefined, 4);
             }
         }
-        url = 'http://127.0.0.3/api.php/records/posts?join=categories&join=tags&join=comments&filter=id,eq,1';
+        url = '/api.php/records/posts?join=categories&join=tags&join=comments&filter=id,eq,1';
         req.open("GET", url, true);
         req.setRequestHeader('X-Authorization', 'Bearer '+accessToken);
         req.send();
diff --git a/examples/clients/upload/form.html b/examples/clients/upload/form.html
new file mode 100644
index 0000000..1607f83
--- /dev/null
+++ b/examples/clients/upload/form.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<form action="api.php/records/categories" method="post" enctype="multipart/form-data">
+    <input type="text" name="name" value="upload">
+    <input type="file" name="icon">
+    <input type="submit" value="upload">
+</form>
+
+</body>
+</html>
diff --git a/src/Tqdev/PhpCrudApi/Api.php b/src/Tqdev/PhpCrudApi/Api.php
index cbc35e7..534c94f 100644
--- a/src/Tqdev/PhpCrudApi/Api.php
+++ b/src/Tqdev/PhpCrudApi/Api.php
@@ -14,6 +14,7 @@ use Tqdev\PhpCrudApi\Middleware\AuthorizationMiddleware;
 use Tqdev\PhpCrudApi\Middleware\BasicAuthMiddleware;
 use Tqdev\PhpCrudApi\Middleware\CorsMiddleware;
 use Tqdev\PhpCrudApi\Middleware\CustomizationMiddleware;
+use Tqdev\PhpCrudApi\Middleware\FileUploadMiddleware;
 use Tqdev\PhpCrudApi\Middleware\FirewallMiddleware;
 use Tqdev\PhpCrudApi\Middleware\JwtAuthMiddleware;
 use Tqdev\PhpCrudApi\Middleware\MultiTenancyMiddleware;
@@ -59,6 +60,9 @@ class Api
                 case 'jwtAuth':
                     new JwtAuthMiddleware($router, $responder, $properties);
                     break;
+                case 'fileUpload':
+                    new FileUploadMiddleware($router, $responder, $properties);
+                    break;
                 case 'validation':
                     new ValidationMiddleware($router, $responder, $properties, $reflection);
                     break;
diff --git a/src/Tqdev/PhpCrudApi/Middleware/FileUploadMiddleware.php b/src/Tqdev/PhpCrudApi/Middleware/FileUploadMiddleware.php
index 6e04c85..7a400fb 100644
--- a/src/Tqdev/PhpCrudApi/Middleware/FileUploadMiddleware.php
+++ b/src/Tqdev/PhpCrudApi/Middleware/FileUploadMiddleware.php
@@ -13,14 +13,17 @@ class FileUploadMiddleware extends Middleware
         if (!empty($files)) {
             $body = $request->getBody();
             foreach ($files as $fieldName => $file) {
-                if (isset($file['error'])) {
+                if (isset($file['error']) && $file['error']) {
                     return $this->responder->error(ErrorCode::FILE_UPLOAD_FAILED, $fieldName);
                 }
                 foreach ($file as $key => $value) {
-                    if ($key == 'tmp_nam') {
+                    if ($key == 'tmp_name') {
                         $value = base64_encode(file_get_contents($value));
+                        $key = $fieldName;
+                    } else {
+                        $key = $fieldName . '_' . $key;
                     }
-                    $body[$fieldName . '_' . $key] = $value;
+                    $body->$key = $value;
                 }
             }
             $request->setBody($body);
diff --git a/src/Tqdev/PhpCrudApi/Request.php b/src/Tqdev/PhpCrudApi/Request.php
index f9e0692..fccbe69 100644
--- a/src/Tqdev/PhpCrudApi/Request.php
+++ b/src/Tqdev/PhpCrudApi/Request.php
@@ -78,7 +78,11 @@ class Request
     private function parseBody(String $body = null)
     {
         if (!$body) {
-            $body = file_get_contents('php://input');
+            if (!empty($_FILES)) {
+                $body = json_encode($_POST);
+            } else {
+                $body = file_get_contents('php://input');
+            }
         }
         $this->body = $body;
     }
@@ -176,4 +180,9 @@ class Request
         }
         return new Request($method, $path, $query, $headers, $body);
     }
+
+    public function getUploadedFiles(): array
+    {
+        return $_FILES;
+    }
 }