bugfixes jwt

.gitignore

@@ -2,3 +2,4 @@
 /public/
 /composer.lock
 /.phpunit.result.cache
+/var/

src/Jwt/JwtToken.php

@@ -13,6 +13,8 @@
 use Lcobucci\JWT\Validation\Constraint\IdentifiedBy;
 use Lcobucci\JWT\Validation\Constraint\SignedWith;
 use Contao\System;
+use Symfony\Component\Filesystem\Filesystem;
+use Symfony\Component\Filesystem\Path;
 
 class JwtToken
 {
@@ -24,15 +26,48 @@ class JwtToken
      */
     private static function getDefaultKeyString(): string
     {
-        $keyString = System::getContainer()->getParameter('kernel.secret');
-        return \substr($keyString, 10, 32);
+        // if secret becomes '' it is caught by InMemory::plainText because checked for empty
+
+        try {
+
+            $secret = null;
+            $projectDir = System::getContainer()->getParameter('kernel.project_dir');
+
+            $filesystem = new Filesystem();
+            $secretFile = Path::join($projectDir, 'var/alpdesk_jwt_secret');
+
+            if ($filesystem->exists($secretFile)) {
+                $secret = \file_get_contents($secretFile);
+            }
+
+            if (!\is_string($secret) || \strlen($secret) < 32) {
+
+                // legacySupport - Remove in future and do not use kernel.secret
+                $keyString = System::getContainer()->getParameter('kernel.secret');
+                if (\is_string($keyString) && $keyString !== '' && \strlen($keyString) >= 42) {
+                    $secret = \substr($keyString, 10, 32);
+                } else {
+                    $secret = \bin2hex(\random_bytes(32));
+                }
+
+                $filesystem->dumpFile($secretFile, $secret);
+
+            }
+
+            return $secret;
+
+        } catch (\Throwable) {
+            return '';
+        }
+
     }
 
     /**
      * @return Configuration
      */
     private static function getConfig(): Configuration
     {
+        // Empty key is caught
         $config = Configuration::forSymmetricSigner(new Sha256(), InMemory::plainText(self::getDefaultKeyString()));
         $config->setValidationConstraints(new SignedWith($config->signer(), $config->signingKey()));
 

tests/Jwt/JwtTokenTest.php

@@ -84,6 +84,7 @@ protected function setUp(): void
 
         System::setContainer(new StubContainerInterface());
         System::getContainer()->setParameter('kernel.secret', '000adc04469d7c761f1407279738f4268e8cf58310e6ff2b3b317df0c61d3fc2');
+        System::getContainer()->setParameter('kernel.project_dir', '.');
 
     }