Cakasim\Payone\Sdk\Redirect\Token\Format\Decoder

Complexity

Total Complexity

12

Size/Duplication

Total Lines	124
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	4	1
A	base62Decode()	0	15	3
B	decode()	0	52	6
A	decrypt()	0	9	2

<?php

declare(strict_types=1);

namespace Cakasim\Payone\Sdk\Redirect\Token\Format;

use Cakasim\Payone\Sdk\Config\ConfigExceptionInterface;
use Cakasim\Payone\Sdk\Config\ConfigInterface;
use Cakasim\Payone\Sdk\Redirect\Token\Token;
use Cakasim\Payone\Sdk\Redirect\Token\TokenInterface;

/**
 * @author Fabian Böttcher <me@cakasim.de>
 * @since 0.1.0
 */
class Decoder implements DecoderInterface
{
    /**
     * @var ConfigInterface The SDK config.
     */
    protected $config;

    /**
     * @var SignerInterface The token signer.
     */
    protected $signer;

    /**
     * Constructs the token encoder.
     *
     * @param ConfigInterface $config The SDK config.
     * @param SignerInterface $signer The token signer.
     */
    public function __construct(ConfigInterface $config, SignerInterface $signer)
    {
        $this->config = $config;
        $this->signer = $signer;
    }

    /**
     * @inheritDoc
     */
    public function decode(string $token): TokenInterface
    {
        $token = explode('.', $token, 4);

        if (count($token) !== 3) {
            throw new DecoderException("Failed token decoding, the token encoded format is invalid.");
        }

        // Collect parts of the token.
        $iv = $token[0];
        $signature = $token[2];
        $token = $token[1];

        // base64 decode the token parts.
        $iv = $this->base62Decode($iv);
        $signature = $this->base62Decode($signature);
        $token = $this->base62Decode($token);

        try {
            // Create the expected (valid) signature of the token payload data.
            $expectedSignature = $this->signer->createSignature($token);
        } catch (SignerExceptionInterface $e) {
            throw new DecoderException("Failed token decoding, could not create trusted token signature.", 0, $e);
        }

        // Ensure that signatures match.
        if ($signature !== $expectedSignature) {
            throw new DecoderException("Failed token decoding, the token signature is invalid.");
        }

        try {
            // Load token encryption config.
            $encryptionMethod = $this->config->get('redirect.token_encryption_method');
            $encryptionKey = $this->config->get('redirect.token_encryption_key');
        } catch (ConfigExceptionInterface $e) {
            throw new DecoderException("Failed token decoding, the token encryption config is incomplete.", 0, $e);
        }

        // Get binary SHA-256 hash of cleartext encryption key.
        $encryptionKey = hash('sha256', $encryptionKey, true);

        // Decrypt the token payload data.
        $token = $this->decrypt($token, $encryptionMethod, $encryptionKey, $iv);

        // JSON decode the token payload.
        $token = json_decode($token, true);

        if (!is_array($token)) {
            throw new DecoderException("Failed token decoding, the token payload data is invalid.");
        }

        return new Token($token);
    }

    /**
     * Decodes the provided base64 encoded data.
     *
     * @param string $data The base64 encoded data to decode.
     * @return string The decoded data.
     * @throws DecoderExceptionInterface If decoding fails.
     */
    protected function base62Decode(string $data): string
    {
        $data = gmp_init($data, 62);

        if (!($data instanceof \GMP)) {
            throw new DecoderException("Failed token decoding, the token could not be base62 decoding.");
        }

        $data = gmp_export($data);

        if (!is_string($data)) {

The condition is_string($data) is always true.

            throw new DecoderException("Failed token decoding, the token could not be base62 decoding.");
        }

        return $data;
    }

    /**
     * Decrypts the provided data.
     *
     * @param string $data The data to decrypt.
     * @param string $method The cipher method.
     * @param string $key The encryption key.
     * @param string $iv The initialization vector.
     * @return string The decrypted data.
     * @throws DecoderException If the decryption fails.
     */
    protected function decrypt(string $data, string $method, string $key, string $iv): string
    {
        $data = openssl_decrypt($data, $method, $key, OPENSSL_RAW_DATA, $iv);

        if (!is_string($data)) {

The condition is_string($data) is always true.

            throw new DecoderException("Failed token decoding, the token could not be decrypted.");
        }

        return $data;
    }
}