add the profile hash control

config/packages/nelmio_cors.yaml

@@ -3,7 +3,7 @@ nelmio_cors:
         origin_regex: true
         allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
         allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
-        allow_headers: ['Content-Type', 'Authorization', 'x-accessid', 'x-switch-user']
+        allow_headers: ['Content-Type', 'Authorization', 'x-accessid', 'x-switch-user', 'profileHash']
         expose_headers: ['Link']
         max_age: 3600
     paths:

src/EventListener/OnKernelRequestPreRead.php

@@ -5,6 +5,7 @@ namespace App\EventListener;
 use ApiPlatform\Symfony\EventListener\EventPriorities;
 use App\Entity\Access\Access;
 use App\Service\Doctrine\FiltersConfigurationService;
+use App\Service\Utils\ObjectUtils;
 use App\Service\Utils\StringsUtils;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -15,9 +16,10 @@ use Symfony\Component\HttpKernel\KernelEvents;
 class OnKernelRequestPreRead implements EventSubscriberInterface
 {
     public function __construct(
-        private RequestStack $requestStack,
-        private Security $security,
-        private FiltersConfigurationService $filtersConfigurationService
+        private RequestStack                $requestStack,
+        private Security                    $security,
+        private FiltersConfigurationService $filtersConfigurationService,
+        private readonly ObjectUtils $objectUtils
     ) {
     }
 
@@ -45,8 +47,22 @@ class OnKernelRequestPreRead implements EventSubscriberInterface
             );
 
             if ($timeConstraintEnabled) {
+                // Configure les filtres pour prendre en compte les contraintes temporelles
                 $this->filtersConfigurationService->configureTimeConstraintFilters($access->getId());
             }
+
+            $profileHash = $event->getRequest()->headers->get('profileHash');
+            if ($profileHash !== null) {
+                $profileMask = [
+                    'activityYear' => $access->getActivityYear(),
+                    'historical' => $access->getHistorical(),
+                ];
+                $expectedHash = $this->objectUtils->hash($profileMask, 'sha1');
+
+                if ($expectedHash !== $profileHash) {
+                    throw new \RuntimeException('Invalid profile hash');
+                }
+            }
         }
     }
 }

src/Service/Utils/ObjectUtils.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Service\Utils;
+
+class ObjectUtils
+{
+    /**
+     * Créé un hash à partir d'un objet
+     * (après l'avoir trié selon ses clés, et convertit en json sans espace)
+     *
+     * @param object|array $instance
+     * @param string $algorithm
+     * @return string
+     */
+    public function hash(object | array $instance, string $algorithm = 'sha256'): string
+    {
+        // Convertit l'objet en tableau associatif
+        $array = (array)$instance;
+        // Puis trie l'objet selon ses clés, encode en json, et hash
+        ksort($array);
+        $json = json_encode($array);
+        return hash($algorithm, $json);
+    }
+}