Auth.combined filter

AuthFilter.php

<?php

private function isUserTokenAuthenticated($request)
    {
        $token = $this->tokenAuth->getToken($request);

        if ($token === false || $token === null)
        {
            return '400-no-token';
        }

        try
        {
            $authUser = $this->tokenAuth->toUser($token);
        }
        catch(TokenExpiredException $exception)
        {
            // We will re-throw this error later if no other authentication types give a successful result
            return '401-expired-token';
        }
        catch(JWTException $exception)
        {
            // I think there is a bug here where this exception is thrown regardless of why the token can't be used.
            // For example, an expired token throws this exception, not the TokenExpiredException, even though looking
            // at the details of this general exception the message is: "Could not decode token: Expired Token"!

            // So rather than trust this exception we will manually check the exception message, and if needed alter
            // the exception that will be thrown later. A bug report/question about this behaviour will be made on GitHub.

            $exceptionType = '400-invalid-token';

            switch ($exception->getMessage())
            {
                case 'Could not decode token: Expired Token':
                    $exceptionType = '401-expired-token';
                    break;
            }

            // We will re-throw this error later if no other authentication types give a successful result
            return $exceptionType;
        }

        // TODO: More checks on the user
        //dd($authUser);

        return true;
    }