AOE\AoeIpauth\Typo3\Service\Authentication

Complexity

Total Complexity

28

Size/Duplication

Total Lines	203
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	5

Test Coverage

Coverage

43.42%

Importance

Changes

0

10 Methods

Rating	Name	Duplication	Size	Complexity
A	authUser()	0	25	5
A	getGroups()	0	18	3
A	doesCurrentUsersIpMatch()	0	13	3
A	findAllUsersByIpAuthentication()	0	5	1
A	findAllGroupsByIpAuthentication()	0	5	1
A	getFeEntityService()	0	7	2
A	getIpService()	0	7	2
A	getIpMatchingService()	0	7	2
A	safeguardContext()	0	15	5
A	getUser()	0	18	4

<?php
namespace AOE\AoeIpauth\Typo3\Service;

/***************************************************************
 *  Copyright notice
 *
 *  (c) 2019 AOE GmbH <dev@aoe.com>
 *
 *  All rights reserved
 *
 *  This script is part of the TYPO3 project. The TYPO3 project is
 *  free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 3 of the License, or
 *  (at your option) any later version.
 *
 *  The GNU General Public License can be found at
 *  http://www.gnu.org/copyleft/gpl.html.
 *
 *  This script is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  This copyright notice MUST APPEAR in all copies of the script!
 ***************************************************************/

use TYPO3\CMS\Core\Utility\GeneralUtility;
use TYPO3\CMS\Core\Authentication\AbstractAuthenticationService;

/**
 * Class Authentication
 *
 * @package AOE\AoeIpauth\Typo3\Service
 */
class Authentication extends AbstractAuthenticationService
{

    /**
     * @var \AOE\AoeIpauth\Service\IpMatchingService
     */
    protected $ipMatchingService = null;

    /**
     * @var \AOE\AoeIpauth\Domain\Service\FeEntityService
     */
    protected $feEntityService = null;

    /**
     * @var \AOE\AoeIpauth\Domain\Service\IpService
     */
    protected $ipService = null;

    /**
     * Makes sure the TCA is readable, necessary for enableFields to work
     * Is de-facto called when using the Preview BE Module
     *
     * @return void
     */
    protected function safeguardContext()
    {
        if (!isset($GLOBALS['TSFE'])) {
            return;
        }

        if (!isset($GLOBALS['TCA'][\AOE\AoeIpauth\Domain\Service\FeEntityService::TABLE_USER])) {
            if (empty($GLOBALS['TSFE']->sys_page)) {
                $GLOBALS['TSFE']->sys_page = GeneralUtility::makeInstance('TYPO3\\CMS\\Frontend\\Page\\PageRepository');
            }
            if (version_compare(TYPO3_version, '7.0.0', '<')) {
                $GLOBALS['TSFE']->getCompressedTCarray();
            }
        }
    }

    /**
     * Gets the user automatically
     *
     * @return bool
     */
    public function getUser()
    {
        // Do not respond to non-fe users and login attempts
        if ('getUserFE' != $this->mode || 'login' == $this->login['status']) {
            return false;
        }

        $this->safeguardContext();

        $clientIp = $this->authInfo['REMOTE_ADDR'];
        $ipAuthenticatedUsers = $this->findAllUsersByIpAuthentication($clientIp);
        if (empty($ipAuthenticatedUsers)) {
            return false;
        }

        $user = array_pop($ipAuthenticatedUsers);
        return $user;
    }

    /**
     * Authenticate a user
     * Return 200 if the IP is right.
     * This means that no more checks are needed.
     * Otherwise authentication may fail because we may don't have a password.
     *
     * @param array Data of user.
     * @return int
     */
    public function authUser($user)
    {
        $this->safeguardContext();

        $authCode = 100;

        // Do not respond to non-fe users and login attempts
        if ('FE' != $this->authInfo['loginType'] || 'login' == $this->login['status']) {
            return $authCode;
        }
        if (!isset($user['uid'])) {
            return $authCode;
        }

        $clientIp = $this->authInfo['REMOTE_ADDR'];
        $userId = $user['uid'];

        $ipMatches = $this->doesCurrentUsersIpMatch($userId, $clientIp);

        if ($ipMatches) {
            $authCode = 200;
        }

        return $authCode;
    }

    /**
     * Get the group list
     *
     * @param string $user
     * @param array $knownGroups
     * @return array
     */
    public function getGroups($user, $knownGroups)

The parameter $user is not used and could be removed.

    {
        // Do not respond to non-FE group calls
        if ('getGroupsFE' != $this->mode) {
            return $knownGroups;
        }

        $this->safeguardContext();

        $clientIp = $this->authInfo['REMOTE_ADDR'];
        $ipAuthenticatedGroups = $this->findAllGroupsByIpAuthentication($clientIp);

        if (!empty($ipAuthenticatedGroups)) {
            $knownGroups = array_merge($ipAuthenticatedGroups, $knownGroups);
        }

        return $knownGroups;
    }

    /**
     * Returns TRUE if the userId's associated IPs match the client IP
     *
     * @param int $userId
     * @param string $clientIp
     * @return bool
     */
    protected function doesCurrentUsersIpMatch($userId, $clientIp)
    {
        $isMatch = false;
        $ips = $this->getIpService()->findIpsByFeUserId($userId);

        foreach ($ips as $ipWhitelist) {
            if ($this->getIpMatchingService()->isIpAllowed($clientIp, $ipWhitelist)) {
                $isMatch = true;
                break;
            }
        }
        return $isMatch;
    }

    /**
     * Finds all users with IP authentication enabled
     *
     * @param string $ip
     * @return array
     */
    protected function findAllUsersByIpAuthentication($ip)
    {
        $users = $this->getFeEntityService()->findAllUsersAuthenticatedByIp($ip);
        return $users;
    }

    /**
     * Finds all groups with IP authentication enabled
     *
     * @param string $ip
     * @return array
     */
    protected function findAllGroupsByIpAuthentication($ip)
    {
        $groups = $this->getFeEntityService()->findAllGroupsAuthenticatedByIp($ip);
        return $groups;
    }

    /**
     * @return \AOE\AoeIpauth\Domain\Service\FeEntityService
     */
    protected function getFeEntityService()
    {
        if (null === $this->feEntityService) {
            $this->feEntityService = GeneralUtility::makeInstance('AOE\\AoeIpauth\\Domain\\Service\\FeEntityService');
        }
        return $this->feEntityService;
    }

    /**
     * @return \AOE\AoeIpauth\Domain\Service\IpService
     */
    protected function getIpService()
    {
        if (null === $this->ipService) {
            $this->ipService = GeneralUtility::makeInstance('AOE\\AoeIpauth\\Domain\\Service\\IpService');
        }
        return $this->ipService;
    }

    /**
     * @return \AOE\AoeIpauth\Service\IpMatchingService
     */
    protected function getIpMatchingService()
    {
        if (null === $this->ipMatchingService) {
            $this->ipMatchingService = GeneralUtility::makeInstance('AOE\\AoeIpauth\\Service\\IpMatchingService');
        }
        return $this->ipMatchingService;
    }
}