Ecodev / felix

src/Middleware/SignedQueryMiddleware.php

<?php

declare(strict_types=1);

namespace Ecodev\Felix\Middleware;

use Cake\Chronos\Chronos;

The type Cake\Chronos\Chronos was not found. Maybe you did not declare it correctly or list all dependencies?

use Ecodev\Felix\Validator\IPRange;
use Exception;
use Laminas\Diactoros\CallbackStream;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

/**
 * Validate that the GraphQL query contains a valid signature in the `X-Signature` HTTP header.
 *
 * The signature payload is the GraphQL operation (or operations in case of batching). That means that the query itself
 * and the variables are signed. But it specifically does **not** include uploaded files.
 *
 * The signature is valid for a limited time only, ~15 minutes.
 *
 * The signature syntax is:
 *
 * ```ebnf
 * signature = "v1", ".", timestamp, ".", hash
 * timestamp = current unix time
 * hash = HMAC_SHA256( payload )
 * payload = timestamp, graphql operations
 * ```
 */
final class SignedQueryMiddleware implements MiddlewareInterface
{
    public function __construct(
        private readonly array $keys,
        private readonly array $allowedIps,
        private readonly bool $required = true
    ) {
        if ($this->required && !$this->keys) {
            throw new Exception('Signed queries are required, but no keys are configured');
        }
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        if ($this->required) {
            $request = $this->verify($request);
        }

        return $handler->handle($request);
    }

    private function verify(ServerRequestInterface $request): ServerRequestInterface
    {
        $signature = $request->getHeader('X-Signature')[0] ?? '';
        if (!$signature) {
            if ($this->isAllowedIp($request)) {
                return $request;
            }

            throw new Exception('Missing `X-Signature` HTTP header in signed query', 403);
        }

        if (preg_match('~^v1\.(?<timestamp>\d{10})\.(?<hash>[0-9a-f]{64})$~', $signature, $m)) {
            $timestamp = $m['timestamp'];
            $hash = $m['hash'];

            $this->verifyTimestamp($timestamp);

            return $this->verifyHash($request, $timestamp, $hash);
        }

        throw new Exception('Invalid `X-Signature` HTTP header in signed query', 403);
    }

    private function verifyTimestamp(string $timestamp): void
    {
        $now = Chronos::now()->timestamp;
        $leeway = 15 * 900; // 15 minutes
        $past = $now - $leeway;
        $future = $now + $leeway;
        if ($timestamp < $past || $timestamp > $future) {
            throw new Exception('Signed query is expired', 403);
        }
    }

    private function verifyHash(ServerRequestInterface $request, string $timestamp, string $hash): ServerRequestInterface
    {
        ['request' => $request, 'operations' => $operations] = $this->getOperations($request);
        $payload = $timestamp . $operations;

        foreach ($this->keys as $key) {
            $computedHash = hash_hmac('sha256', $payload, $key);
            if ($hash === $computedHash) {
                return $request;
            }
        }

        throw new Exception('Invalid signed query', 403);
    }

    /**
     * @return array{request: ServerRequestInterface, operations: string}
     */
    private function getOperations(ServerRequestInterface $request): array
    {
        $contents = $request->getBody()->getContents();

        if ($contents) {
            return [
                // Pseudo-rewind the request, even if non-rewindable, so the next
                // middleware still accesses the stream from the beginning
                'request' => $request->withBody(new CallbackStream(fn () => $contents)),
                'operations' => $contents,
            ];
        }

        $parsedBody = $request->getParsedBody();
        if (is_array($parsedBody)) {
            $operations = $parsedBody['operations'] ?? null;
            if ($operations) {
                return [
                    'request' => $request,
                    'operations' => $operations,
                ];
            }
        }

        throw new Exception('Could not find GraphQL operations in request', 403);
    }

    private function isAllowedIp(ServerRequestInterface $request): bool
    {
        $remoteAddress = $request->getServerParams()['REMOTE_ADDR'] ?? '';

        if (!$remoteAddress || !is_string($remoteAddress)) {
            return false;
        }

        return IPRange::matches($remoteAddress, $this->allowedIps);
    }
}