private function validateAPIToken($token, $request)
    {
        //get owner with that token
        $SQL_token = Convert::raw2sql($token);
        $tokenColumn = $this->tokenConfig['DBColumn'];

        $tokenOwner = DataObject::get_one(
            $this->tokenConfig['owner'],
            "\"" . $this->tokenConfig['DBColumn'] . "\"='" . $SQL_token . "'",
            false
        );

        if ($tokenOwner) {
            //check token expiry
            $tokenExpire = $tokenOwner->{$this->tokenConfig['expireDBColumn']};
            $now = time();
            $life = $this->tokenConfig['life'];

            if ($tokenExpire > ($now - $life)) {
                // check if token should automatically be updated
                if ($this->tokenConfig['autoRefresh']) {
                    $tokenOwner->setField($this->tokenConfig['expireDBColumn'], $now + $life);
                    $tokenOwner->write();
                }
                //all good, log Member in
                if (is_a($tokenOwner, Member::class)) {
                    # this is a login without the logging
                    Config::nest();
                    Config::modify()->set(Member::class, 'session_regenerate_id', true);
                    $identityStore = Injector::inst()->get(IdentityStore::class);
                    $identityStore->logIn($tokenOwner, false, $request);
                    Config::unnest();
                }

                return true;
            } else {
                //too old
                return new RESTfulAPIError(403,
                    'Token expired.',
                    array(
                        'message' => 'Token expired.',
                        'code' => self::AUTH_CODE_TOKEN_EXPIRED,
                    )
                );
            }
        } else {
            //token not found
            //not sure it's wise to say it doesn't exist. Let's be shady here
            return new RESTfulAPIError(403,
                'Token invalid.',
                array(
                    'message' => 'Token invalid.',
                    'code' => self::AUTH_CODE_TOKEN_INVALID,
                )
            );
        }
    }
private function validateAPIToken($token, $request)
    {
        //get owner with that token
        $SQL_token = Convert::raw2sql($token);
        $tokenColumn = $this->tokenConfig['DBColumn'];

        $tokenOwner = DataObject::get_one(
            $this->tokenConfig['owner'],
            "\"" . $this->tokenConfig['DBColumn'] . "\"='" . $SQL_token . "'",
            false
        );

        if ($tokenOwner) {
            //check token expiry
            $tokenExpire = $tokenOwner->{$this->tokenConfig['expireDBColumn']};
            $now = time();
            $life = $this->tokenConfig['life'];

            if ($tokenExpire > ($now - $life)) {
                // check if token should automatically be updated
                if ($this->tokenConfig['autoRefresh']) {
                    $tokenOwner->setField($this->tokenConfig['expireDBColumn'], $now + $life);
                    $tokenOwner->write();
                }
                //all good, log Member in
                if (is_a($tokenOwner, Member::class)) {
                    # this is a login without the logging
                    Config::nest();
                    Config::modify()->set(Member::class, 'session_regenerate_id', true);
                    $identityStore = Injector::inst()->get(IdentityStore::class);
                    $identityStore->logIn($tokenOwner, false, $request);
                    Config::unnest();
                }

                return true;
            } else {
                //too old
                return new RESTfulAPIError(403,
                    'Token expired.',
                    array(
                        'message' => 'Token expired.',
                        'code' => self::AUTH_CODE_TOKEN_EXPIRED,
                    )
                );
            }
        } else {
            //token not found
            //not sure it's wise to say it doesn't exist. Let's be shady here
            return new RESTfulAPIError(403,
                'Token invalid.',
                array(
                    'message' => 'Token invalid.',
                    'code' => self::AUTH_CODE_TOKEN_INVALID,
                )
            );
        }
    }
private function validateAPIToken ( $ token , $ request ) { //get owner with that token $ SQL_token = Convert :: raw2sql ( $ token ) ; $ tokenColumn = $ this -> tokenConfig [ 'DBColumn' ] ; $ tokenOwner = DataObject :: get_one ( $ this -> tokenConfig [ 'owner' ] , "\"" . $ this -> tokenConfig [ 'DBColumn' ] . "\"='" . $ SQL_token . "'" , false ) ; if ( $ tokenOwner ) { //check token expiry $ tokenExpire = $ tokenOwner -> { $ this -> tokenConfig [ 'expireDBColumn' ] } ; $ now = time ( ) ; $ life = $ this -> tokenConfig [ 'life' ] ; if ( $ tokenExpire > ( $ now - $ life ) ) { // check if token should automatically be updated if ( $ this -> tokenConfig [ 'autoRefresh' ] ) { $ tokenOwner -> setField ( $ this -> tokenConfig [ 'expireDBColumn' ] , $ now + $ life ) ; $ tokenOwner -> write ( ) ; } //all good, log Member in if ( is_a ( $ tokenOwner , Member :: class ) ) { # this is a login without the logging Config :: nest ( ) ; Config :: modify ( ) -> set ( Member :: class , 'session_regenerate_id' , true ) ; $ identityStore = Injector :: inst ( ) -> get ( IdentityStore :: class ) ; $ identityStore -> logIn ( $ tokenOwner , false , $ request ) ; Config :: unnest ( ) ; } return true ; } else { //too old return new RESTfulAPIError ( 403 , 'Token expired.' , array ( 'message' => 'Token expired.' , 'code' => self :: AUTH_CODE_TOKEN_EXPIRED , ) ) ; } } else { //token not found //not sure it's wise to say it doesn't exist. Let's be shady here return new RESTfulAPIError ( 403 , 'Token invalid.' , array ( 'message' => 'Token invalid.' , 'code' => self :: AUTH_CODE_TOKEN_INVALID , ) ) ; } }
Validate the API token

@param  string                 $token    Authentication token
@param  HTTPRequest            $request  HTTP API request
@return true|RESTfulAPIError            True if token is valid OR RESTfulAPIError with details
Validate the API token