Firesphere / silverstripe-bootstrapmfa

src/Extensions/MemberExtension.php

<?php

namespace Firesphere\BootstrapMFA\Extensions;

use DateTime;
use Firesphere\BootstrapMFA\Authenticators\BootstrapMFAAuthenticator;
use Firesphere\BootstrapMFA\Models\BackupCode;
use Firesphere\BootstrapMFA\Providers\BootstrapMFAProvider;
use SilverStripe\Control\Controller;
use SilverStripe\Core\Config\Config;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\Forms\CheckboxField;
use SilverStripe\Forms\FieldList;
use SilverStripe\Forms\LiteralField;
use SilverStripe\Forms\Tab;
use SilverStripe\ORM\DataExtension;
use SilverStripe\ORM\DataList;
use SilverStripe\ORM\FieldType\DBDatetime;
use SilverStripe\Security\Member;
use SilverStripe\Security\PasswordEncryptor;
use SilverStripe\Security\Security;
use SilverStripe\SiteConfig\SiteConfig;

/**
 * Class MemberExtension
 *
 * @package Firesphere\BootstrapMFA
 * @property Member|MemberExtension $owner
 * @property boolean $MFAEnabled
 * @property string $PrimaryMFA
 * @property string $BackupCodeSalt
 * @method DataList|BackupCode[] BackupCodes()
 */
class MemberExtension extends DataExtension
{
    /**
     * @var array
     */
    private static $db = [

The private property $db is not used, and could be removed.

        'MFAEnabled'     => 'Boolean(false)',
        'PrimaryMFA'     => 'Varchar(255)',
        'BackupCodeSalt' => 'Varchar(255)'
    ];

    /**
     * @var array
     */
    private static $has_many = [

The private property $has_many is not used, and could be removed.

        'BackupCodes' => BackupCode::class
    ];

    /**
     * @var bool
     */
    public $updateMFA = false;

    /**
     * @param FieldList $fields
     */
    public function updateCMSFields(FieldList $fields)
    {
        // Force the updateMFA value of this field. This resolves that when it's checked and submitted
        // The checkbox stays checked.
        $this->updateMFA = false;
        $fields->removeByName(['BackupCodes', 'PrimaryMFA', 'BackupCodeSalt']);
        $session = Controller::curr()->getRequest()->getSession();
        $rootTabSet = $fields->fieldByName('Root');
        // We need to push the tab for unit tests
        $tab = Tab::create(
            'MFA',
            _t(self::class . '.MFATAB', 'Multi Factor Authentication')
        );
        $rootTabSet->push(
            $tab
        );
        $fields->addFieldToTab(
            'Root.MFA',
            $enabled = CheckboxField::create('MFAEnabled', _t(self::class . '.MFAEnabled', 'MFA Enabled'))
        );
        $fields->addFieldToTab(
            'Root.MFA',
            CheckboxField::create('updateMFA', _t(self::class . '.RESETMFA', 'Reset MFA codes'))
        );

        if ($session->get('tokens')) {
            $field = LiteralField::create('tokens', $session->get('tokens'));
            $fields->addFieldToTab('Root.MFA', $field);
            $session->clear('tokens');
        }
    }

    /**
     * Force enable MFA on the member if needed
     */
    public function onBeforeWrite()
    {
        if (!$this->owner->MFAEnabled && SiteConfig::current_site_config()->ForceMFA) {
            $this->owner->MFAEnabled = true;
            $this->owner->updateMFA = true;
        }
        if (!$this->owner->BackupCodeSalt || $this->owner->updateMFA) {
            $algorithm = Security::config()->get('password_encryption_algorithm');

            $encryptor = PasswordEncryptor::create_for_algorithm($algorithm);

            // No password. It's not even used in the salt generation
            $this->owner->BackupCodeSalt = $encryptor->salt('');
        }
    }

    /**
     *
     * @throws \Psr\Container\NotFoundExceptionInterface
     * @throws \SilverStripe\ORM\ValidationException
     */
    public function onAfterWrite()
    {
        parent::onAfterWrite();
        if ($this->owner->updateMFA) {
            /** @var BootstrapMFAProvider $provider */
            $provider = Injector::inst()->get(BootstrapMFAProvider::class);
            $provider->setMember($this->owner);

It seems like $this->owner can also be of type Firesphere\BootstrapMFA\Extensions\MemberExtension; however, parameter $member of Firesphere\BootstrapMFA\Providers\BootstrapMFAProvider::setMember() does only seem to accept SilverStripe\Security\Member, maybe add an additional type check?

            $provider->updateTokens();
        }
    }

    /**
     * Check if a member is in grace period based on Created, date or enforcement
     * @return bool
     * @throws \Exception
     */
    public function isInGracePeriod()
    {
        /** @var Member|MemberExtension $member */
        $member = $this->owner;

        // If MFA is enabled on the member, we're always using it
        if ($member->MFAEnabled) {
            return false;
        }

        /** @var SiteConfig|SiteConfigExtension $config */
        $config = SiteConfig::current_site_config();
        // If MFA is not enforced, we're in an endless grace period
        if ($config->ForceMFA === null) {
            return true;
        }

        // Default the grace start day
        $graceStartDay = ($member->Created > $config->ForceMFA) ? $member->Created : $config->ForceMFA;

The property Created does not exist on Firesphere\BootstrapMFA\Extensions\MemberExtension. Did you maybe forget to declare it?

        $graceStartDay = new DateTime($graceStartDay);

        $gracePeriodInDays = Config::inst()->get(BootstrapMFAAuthenticator::class, 'grace_period');

        $nowDate = new DateTime(DBDatetime::now()->Format(DBDatetime::ISO_DATE));

        $daysSinceGraceStart = $nowDate->diff($graceStartDay)->days;

        return $daysSinceGraceStart < $gracePeriodInDays;
    }
}