core\Federation::getIdentityProvidersCertStatus()

Complexity

Conditions	8
Paths	20

Size

Total Lines	40
Code Lines	30

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function getIdentityProvidersCertStatus() {
        $query = "SELECT distinct profile.profile_id  FROM profile JOIN profile_option ON profile.profile_id = profile_option.profile_id WHERE option_name='profile:production' AND profile.sufficient_config = 1";
        $activeProfiles = [];
        $result = $this->databaseHandle->exec($query);
        $rows = $result->fetch_all();
        foreach ($rows as $row) {
           $activeProfiles[] = $row[0];
        }
        $query = "SELECT institution.inst_id AS inst_id, profile.profile_id AS profile_id, profile_option.option_value AS cert FROM profile_option JOIN profile ON profile_option.profile_id=profile.profile_id JOIN institution ON profile.inst_id=institution.inst_id WHERE profile_option.option_name='eap:ca_file' and institution.country='".$this->tld."'";        
        $result = $this->databaseHandle->exec($query);
        $rows = $result->fetch_all();
        $x509 = new \core\common\X509();
        $certsStatus = [];
        $idpCertStatus = [];
        foreach ($rows as $row) {
            $inst = $row[0];
            $profile = $row[1];
            // pass any rofile which is not active
            if (!in_array($profile, $activeProfiles)) {
                continue;
            }
            $encodedCert = $row[2];
            if (!isset($idpCertStatus[$inst])) {
                $idpCertStatus[$inst] = \core\AbstractProfile::CERT_STATUS_OK;
            }
            
            // check if we have already seen this cert if not, continue analysis
            if (!isset($certsStatus[$encodedCert])) {
                $tm = $x509->processCertificate(base64_decode($encodedCert))['full_details']['validTo_time_t'] - time();
                if ($tm < \config\ConfAssistant::CERT_WARNINGS['expiry_critical']) {
                    $certsStatus[$encodedCert] = \core\AbstractProfile::CERT_STATUS_ERROR;
                } elseif ($tm < \config\ConfAssistant::CERT_WARNINGS['expiry_warning']) {
                    $certsStatus[$encodedCert] = \core\AbstractProfile::CERT_STATUS_WARN;
                } else {
                    $certsStatus[$encodedCert] = \core\AbstractProfile::CERT_STATUS_OK;
                }
            }
            $idpCertStatus[$inst] = max($idpCertStatus[$inst], $certsStatus[$encodedCert]);
        }
        return $idpCertStatus;
    }
}