IdP::eligibility() - Code Metrics - Inspection of "beef up the invitation system to ask for IdP/SP/bo..." - GEANT/CAT - Measure and Improve Code Quality continuously with Scrutinizer

Test Failed

Push — master ( 2cdad9...933f57 )

by Stefan

created 2019-03-15 15:14 UTC

IdP::eligibility() A

↳ Parent: IdP

Complexity

Conditions	4
Paths	4

Size

Total Lines	10
Code Lines	9

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
eloc	9
dl	0
loc	10
rs	9.9666
c	0
b	0
f	0
cc	4
nc	4
nop	0

<?php

/*
 * *****************************************************************************
 * Contributions to this work were made on behalf of the GÉANT project, a 
 * project that has received funding from the European Union’s Framework 
 * Programme 7 under Grant Agreements No. 238875 (GN3) and No. 605243 (GN3plus),
 * Horizon 2020 research and innovation programme under Grant Agreements No. 
 * 691567 (GN4-1) and No. 731122 (GN4-2).
 * On behalf of the aforementioned projects, GEANT Association is the sole owner
 * of the copyright in all material which was developed by a member of the GÉANT
 * project. GÉANT Vereniging (Association) is registered with the Chamber of 
 * Commerce in Amsterdam with registration number 40535155 and operates in the 
 * UK as a branch of GÉANT Vereniging.
 * 
 * Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands. 
 * UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK
 *
 * License: see the web/copyright.inc.php file in the file structure or
 *          <base_url>/copyright.php after deploying the software
 */

/**
 * This file contains Federation, IdP and Profile classes.
 * These should be split into separate files later.
 *
 * @package Developer
 */
/**
 * 
 */

namespace core;

use \Exception;

/**
 * This class represents an Identity Provider (IdP).
 * IdPs have properties of their own, and may have one or more Profiles. The
 * profiles can override the institution-wide properties.
 *
 * @author Stefan Winter <[email protected]>
 * @author Tomasz Wolniewicz <[email protected]>
 *
 * @license see LICENSE file in root directory
 *
 * @package Developer
 */
class IdP extends EntityWithDBProperties {

    const EXTERNAL_DB_SYNCSTATE_NOT_SYNCED = 0;
    const EXTERNAL_DB_SYNCSTATE_SYNCED = 1;
    const EXTERNAL_DB_SYNCSTATE_NOTSUBJECTTOSYNCING = 2;

    const TYPE_IDP = 'IdP';
    const TYPE_SP  = 'SP';
    const TYPE_IDPSP = 'IdPSP';
    
    /**
     *
     * @var int synchronisation state with external database, if any
     */
    private $externalDbSyncstate;

    /**
     * The shortname of this IdP's federation
     * @var string 
     */
    public $federation;

    /**
     * The type of participant in DB enum notation
     * @var string
     */
    public $type;
    
    /**
     * Constructs an IdP object based on its details in the database.
     * Cannot be used to define a new IdP in the database! This happens via Federation::newIdP()
     *
     * @param int $instId the database row identifier
     */
    public function __construct(int $instId) {
        $this->databaseType = "INST";
        parent::__construct(); // now databaseHandle and logging is available
        $this->entityOptionTable = "institution_option";
        $this->entityIdColumn = "institution_id";

        $this->identifier = $instId;

        $idp = $this->databaseHandle->exec("SELECT inst_id, country,external_db_syncstate FROM institution WHERE inst_id = $this->identifier");
        // SELECT -> returns resource, not boolean
        if (!$instQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $idp)) {
            throw new Exception("IdP $this->identifier not found in database!");
        }

        $this->federation = $instQuery->country;
        $this->externalDbSyncstate = $instQuery->external_db_syncstate;

        // fetch attributes from DB; populates $this->attributes array
        $this->attributes = $this->retrieveOptionsFromDatabase("SELECT DISTINCT option_name, option_lang, option_value, row 
                                            FROM $this->entityOptionTable
                                            WHERE $this->entityIdColumn = ?  
                                            ORDER BY option_name", "IdP");

        $this->attributes[] = ["name" => "internal:country",
            "lang" => NULL,
            "value" => $this->federation,
            "level" => "IdP",
            "row" => 0,
            "flag" => NULL];

        $this->name = $this->languageInstance->getLocalisedValue($this->getAttributes('general:instname'));
        $eligibility = $this->eligibility();
        if (in_array(IdP::ELIGIBILITY_IDP, $eligibility) && in_array(IdP::ELIGIBILITY_SP, $eligibility)) {
            $this->type = IdP::TYPE_IDPSP;
        } elseif (in_array(IdP::ELIGIBILITY_IDP, $eligibility)) {
            $this->type = IdP::TYPE_IDP;
        } else {
            $this->type = IdP::TYPE_SP;
        }
        $this->loggerInstance->debug(3, "--- END Constructing new IdP object ... ---\n");
    }

    /**
     * This function retrieves all registered profiles for this IdP from the database
     *
     * @param bool $activeOnly if and set to non-zero will cause listing of only those institutions which have some valid profiles defined.
     * @return \core\AbstractProfile[] list of Profiles of this IdP
     */
    public function listProfiles(bool $activeOnly = FALSE) {
        $query = "SELECT profile_id FROM profile WHERE inst_id = $this->identifier" . ($activeOnly ? " AND showtime = 1" : "");
        $allProfiles = $this->databaseHandle->exec($query);
        $returnarray = [];
        // SELECT -> resource, not boolean
        while ($profileQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allProfiles)) {
            $oneProfile = ProfileFactory::instantiate($profileQuery->profile_id, $this);
            $oneProfile->institution = $this->identifier;
            $returnarray[] = $oneProfile;
        }

        $this->loggerInstance->debug(4, "listProfiles: " . print_r($returnarray, true));
        return $returnarray;
    }
    
    /**
     * This function retrieves all SP deployments for this organisation from the database
     *
     * @param bool $activeOnly if and set to non-zero will cause listing of only those institutions which have some valid profiles defined.
     * @return \core\AbstractDeployment[] list of deployments of this IdP
     */
    public function listDeployments(bool $activeOnly = FALSE) {
        $query = "SELECT deployment_id FROM deployment WHERE inst_id = $this->identifier" . ($activeOnly ? " AND status = " . AbstractDeployment::ACTIVE : "");
        $allDeployments = $this->databaseHandle->exec($query);
        $returnarray = [];
        // SELECT -> resource, not boolean
        while ($deploymentQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allDeployments)) {
            $returnarray[] = new DeploymentManaged($this,$deploymentQuery->deployment_id);
        }

        $this->loggerInstance->debug(4, "listDeployments: " . print_r($returnarray, true));
        return $returnarray;
    }

    const PROFILES_INCOMPLETE = 0;
    const PROFILES_CONFIGURED = 1;
    const PROFILES_SHOWTIME = 2;

    /**
     * looks through all the profiles of the inst and determines the highest prod-ready level among the profiles
     * @return int highest level of completeness of all the profiles of the inst
     */
    public function maxProfileStatus() {
        $allProfiles = $this->databaseHandle->exec("SELECT sufficient_config + showtime AS maxlevel FROM profile WHERE inst_id = $this->identifier ORDER BY maxlevel DESC LIMIT 1");
        // SELECT yields a resource, not a boolean
        while ($res = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allProfiles)) {
            return $res->maxlevel;
        }
        return self::PROFILES_INCOMPLETE;
    }

    /** This function retrieves an array of authorised users which can
     * manipulate this institution.
     * 
     * @return array owners of the institution; numbered array with members ID, MAIL and LEVEL
     */
    public function listOwners() {
        $returnarray = [];
        $admins = $this->databaseHandle->exec("SELECT user_id, orig_mail, blesslevel FROM ownership WHERE institution_id = $this->identifier ORDER BY user_id");
        // SELECT -> resource, not boolean
        while ($ownerQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $admins)) {
            $returnarray[] = ['ID' => $ownerQuery->user_id, 'MAIL' => $ownerQuery->orig_mail, 'LEVEL' => $ownerQuery->blesslevel];
        }
        return $returnarray;
    }

    /**
     * Primary owners are allowed to invite other (secondary) admins to the institution
     * 
     * @param string $user ID of a logged-in user
     * @return boolean TRUE if this user is an admin with FED-level blessing
     */
    public function isPrimaryOwner($user) {
        foreach ($this->listOwners() as $oneOwner) {
            if ($oneOwner['ID'] == $user && $oneOwner['LEVEL'] == "FED") {
                return TRUE;
            }
        }
        return FALSE;
    }

    /**
     * This function gets the profile count for a given IdP.
     * 
     * The count could be retreived from the listProfiles method
     * but this is less expensive.
     *
     * @return int profile count
     */
    public function profileCount() {
        $result = $this->databaseHandle->exec("SELECT profile_id FROM profile 
             WHERE inst_id = $this->identifier");
        // SELECT -> resource, not boolean
        return(mysqli_num_rows(/** @scrutinizer ignore-type */ $result));
    }

    /**
     * This function gets the deployment count for a given IdP.
     *
     * @return int deployment count
     */
    public function deploymentCount() {
        $result = $this->databaseHandle->exec("SELECT deployment_id FROM deployment
             WHERE inst_id = $this->identifier");
        // SELECT -> resource, not boolean
        return(mysqli_num_rows(/** @scrutinizer ignore-type */ $result));
    }

    const ELIGIBILITY_IDP = "IdP";
    const ELIGIBILITY_SP = "SP";
    /**
     * checks whether the participant is an IdP, an SP, or both.
     * 
     * @return array list of eligibilities
     */
    public function eligibility() {
        $eligibilites = $this->databaseHandle->exec("SELECT type FROM institution WHERE inst_id = $this->identifier");
        while ($iterator = mysqli_fetch_object(/** @scrutinizer ignore-type */ $eligibilites)) {
            switch ($iterator->type) {
                case "IdP":
                    return [ IdP::ELIGIBILITY_IDP ];
                case "SP":
                    return [ IdP::ELIGIBILITY_SP ];
                default:
                    return [ IdP::ELIGIBILITY_IDP, IdP::ELIGIBILITY_SP ];
            }
        }
    }
    
    /**
     * This function sets the timestamp of last modification of the child profiles to the current timestamp.
     * 
     * This is needed for installer caching: all installers which are on disk 
     * must be re-created if an attribute changes. This timestamp here
     * is used to determine if the installer on disk is still new enough.
     * 
     * @return void
     */
    public function updateFreshness() {
        // freshness is always defined for *Profiles*
        // IdP needs to update timestamp of all its profiles if an IdP-wide attribute changed
        $this->databaseHandle->exec("UPDATE profile SET last_change = CURRENT_TIMESTAMP WHERE inst_id = '$this->identifier'");
    }

    /**
     * Adds a new profile to this IdP.
     * 
     * Only creates the DB entry for the Profile. If you want to add attributes later, see Profile::addAttribute().
     *
     * @param string $type exactly "RADIUS" or "SILVERBULLET", all other values throw an Exception
     * @return AbstractProfile|NULL new Profile object if successful, or NULL if an error occured
     */
    public function newProfile(string $type) {
        $this->databaseHandle->exec("INSERT INTO profile (inst_id) VALUES($this->identifier)");
        $identifier = $this->databaseHandle->lastID();
        if ($identifier > 0) {
            switch ($type) {
                case AbstractProfile::PROFILETYPE_RADIUS:
                    return new ProfileRADIUS($identifier, $this);
                case AbstractProfile::PROFILETYPE_SILVERBULLET:
                    $theProfile = new ProfileSilverbullet($identifier, $this);
                    $theProfile->addSupportedEapMethod(new \core\common\EAP(\core\common\EAP::EAPTYPE_SILVERBULLET), 1);
                    $theProfile->setRealm($this->identifier . "-" . $theProfile->identifier . "." . strtolower($this->federation) . strtolower(CONFIG_CONFASSISTANT['SILVERBULLET']['realm_suffix']));
                    return $theProfile;
                default:
                    throw new Exception("This type of profile is unknown and can not be added.");
            }
        }
        return NULL;
    }

    /**
     * Adds a new hotspot deployment to this IdP.
     * 
     * Only creates the DB entry for the deployment. If you want to add attributes later, see Profile::addAttribute().
     *
     * @param string $type exactly "RADIUS-SP" or "MANAGED-SP", all other values throw an Exception
     * @return DeploymentManaged the newly created deployment
     */
    public function newDeployment(string $type) {
            switch ($type) {
                case AbstractDeployment::DEPLOYMENTTYPE_CLASSIC:
                    // classic deployment exist in the eduroam DB. We don't do anything here.
                    throw new Exception("This type of deployment is handled externally and requesting it here makes no sense.");
                case AbstractDeployment::DEPLOYMENTTYPE_MANAGED:
                    $this->databaseHandle->exec("INSERT INTO deployment (inst_id) VALUES($this->identifier)");
                    $identifier = $this->databaseHandle->lastID();
                    return new DeploymentManaged($this, $identifier);
                default:
                    throw new Exception("This type of deployment is unknown and can not be added.");
            }
    }

    /**
     * deletes the IdP and all its profiles
     * 
     * @return void
     */
    public function destroy() {
        common\Entity::intoThePotatoes();
        /* delete all profiles */
        foreach ($this->listProfiles() as $profile) {
            $profile->destroy();
        }
        /* double-check that all profiles are gone */
        $profiles = $this->listProfiles();

        if (count($profiles) > 0) {
            throw new Exception("This IdP shouldn't have any profiles any more!");
        }

        $this->databaseHandle->exec("DELETE FROM ownership WHERE institution_id = $this->identifier");
        $this->databaseHandle->exec("DELETE FROM institution_option WHERE institution_id = $this->identifier");
        $this->databaseHandle->exec("DELETE FROM institution WHERE inst_id = $this->identifier");

        // notify federation admins

        $fed = new Federation($this->federation);
        foreach ($fed->listFederationAdmins() as $id) {
            $user = new User($id);
            $message = sprintf(_("Hi,

the %s %s in your %s federation %s has been deleted from %s.

We thought you might want to know.

Best regards,

%s"), common\Entity::$nomenclature_inst, $this->name, CONFIG_CONFASSISTANT['CONSORTIUM']['display_name'], strtoupper($fed->name), CONFIG['APPEARANCE']['productname'], CONFIG['APPEARANCE']['productname_long']);
            $user->sendMailToUser(sprintf(_("%s in your federation was deleted"), common\Entity::$nomenclature_inst), $message);
        }
        common\Entity::outOfThePotatoes();
    }

    /**
     * Performs a lookup in an external database to determine matching entities to this IdP. 
     * 
     * The business logic of this function is roaming consortium specific; if no match algorithm is known for the consortium, FALSE is returned.
     * 
     * @return mixed list of entities in external database that correspond to this IdP or FALSE if no consortium-specific matching function is defined
     */
    public function getExternalDBSyncCandidates() {
        if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
            $list = [];
            $usedarray = [];
            // extract all institutions from the country
            $externalHandle = DBConnection::handle("EXTERNAL");
            $lowerFed = strtolower($this->federation);
            $candidateList = $externalHandle->exec("SELECT id_institution AS id, name AS collapsed_name FROM view_active_idp_institution WHERE country = ?", "s", $lowerFed);
            $syncstate = self::EXTERNAL_DB_SYNCSTATE_SYNCED;
            $alreadyUsed = $this->databaseHandle->exec("SELECT DISTINCT external_db_id FROM institution WHERE external_db_id IS NOT NULL AND external_db_syncstate = ?", "i", $syncstate);
            // SELECT -> resource, not boolean
            while ($alreadyUsedQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $alreadyUsed)) {
                $usedarray[] = $alreadyUsedQuery->external_db_id;
            }

            // and split them into ID, LANG, NAME pairs (operating on a resource, not boolean)
            while ($candidateListQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $candidateList)) {
                if (in_array($candidateListQuery->id, $usedarray)) {
                    continue;
                }
                $names = explode('#', $candidateListQuery->collapsed_name);
                foreach ($names as $name) {
                    $perlang = explode(': ', $name, 2);
                    $list[] = ["ID" => $candidateListQuery->id, "lang" => $perlang[0], "name" => $perlang[1]];
                }
            }
            // now see if any of the languages in CAT match any of those in the external DB
            $mynames = $this->getAttributes("general:instname");
            $matchingCandidates = [];
            foreach ($mynames as $onename) {
                foreach ($list as $listentry) {
                    if (($onename['lang'] == $listentry['lang'] || $onename['lang'] == "C") && $onename['value'] == $listentry['name'] && array_search($listentry['ID'], $matchingCandidates) === FALSE) {
                        $matchingCandidates[] = $listentry['ID'];
                    }
                }
            }
            return $matchingCandidates;
        }
        return FALSE;
    }

    /**
     * returns the state of sync with the external DB.
     * 
     * @return int
     */
    public function getExternalDBSyncState() {
        if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
            return $this->externalDbSyncstate;
        }
        return self::EXTERNAL_DB_SYNCSTATE_NOTSUBJECTTOSYNCING;
    }

    /**
     * Retrieves the external DB identifier of this institution. Returns FALSE if no ID is known.
     * 
     * @return string|boolean the external identifier; or FALSE if no external ID is known
     */
    public function getExternalDBId() {
        if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
            $idQuery = $this->databaseHandle->exec("SELECT external_db_id FROM institution WHERE inst_id = $this->identifier AND external_db_syncstate = " . self::EXTERNAL_DB_SYNCSTATE_SYNCED);
            // SELECT -> it's a resource, not a boolean
            if (mysqli_num_rows(/** @scrutinizer ignore-type */ $idQuery) == 0) {
                return FALSE;
            }
            $externalIdQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $idQuery);
            return $externalIdQuery->external_db_id;
        }
        return FALSE;
    }

    /**
     * Associates the external DB id with a CAT id
     * 
     * @param string $identifier the external DB id, which can be alpha-numeric
     * @return void
     */
    public function setExternalDBId(string $identifier) {
        if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
            $syncState = self::EXTERNAL_DB_SYNCSTATE_SYNCED;
            $alreadyUsed = $this->databaseHandle->exec("SELECT DISTINCT external_db_id FROM institution WHERE external_db_id = ? AND external_db_syncstate = ?", "si", $identifier, $syncState);
            // SELECT -> resource, not boolean
            if (mysqli_num_rows(/** @scrutinizer ignore-type */ $alreadyUsed) == 0) {
                $this->databaseHandle->exec("UPDATE institution SET external_db_id = ?, external_db_syncstate = ? WHERE inst_id = ?", "sii", $identifier, $syncState, $this->identifier);
            }
        }
    }

    /**
     * removes the link between a CAT institution and the external DB
     * 
     * @return void
     */
    public function removeExternalDBId() {
        if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
            if ($this->getExternalDBId() !== FALSE) {
                $syncState = self::EXTERNAL_DB_SYNCSTATE_NOT_SYNCED;
                $this->databaseHandle->exec("UPDATE institution SET external_db_id = NULL, external_db_syncstate = ? WHERE inst_id = ?", "ii", $syncState, $this->identifier);
            }
        }
    }

}


1			<?php
2
3			/*
4			* *****************************************************************************
5			* Contributions to this work were made on behalf of the GÉANT project, a
6			* project that has received funding from the European Union’s Framework
7			* Programme 7 under Grant Agreements No. 238875 (GN3) and No. 605243 (GN3plus),
8			* Horizon 2020 research and innovation programme under Grant Agreements No.
9			* 691567 (GN4-1) and No. 731122 (GN4-2).
10			* On behalf of the aforementioned projects, GEANT Association is the sole owner
11			* of the copyright in all material which was developed by a member of the GÉANT
12			* project. GÉANT Vereniging (Association) is registered with the Chamber of
13			* Commerce in Amsterdam with registration number 40535155 and operates in the
14			* UK as a branch of GÉANT Vereniging.
15			*
16			* Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands.
17			* UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK
18			*
19			* License: see the web/copyright.inc.php file in the file structure or
20			* <base_url>/copyright.php after deploying the software
21			*/
22
23			/**
24			* This file contains Federation, IdP and Profile classes.
25			* These should be split into separate files later.
26			*
27			* @package Developer
28			*/
29			/**
30			*
31			*/
32
33			namespace core;
34
35			use \Exception;
36
37			/**
38			* This class represents an Identity Provider (IdP).
39			* IdPs have properties of their own, and may have one or more Profiles. The
40			* profiles can override the institution-wide properties.
41			*
42			* @author Stefan Winter <[email protected]>
43			* @author Tomasz Wolniewicz <[email protected]>
44			*
45			* @license see LICENSE file in root directory
46			*
47			* @package Developer
48			*/
49			class IdP extends EntityWithDBProperties {
50
51			const EXTERNAL_DB_SYNCSTATE_NOT_SYNCED = 0;
52			const EXTERNAL_DB_SYNCSTATE_SYNCED = 1;
53			const EXTERNAL_DB_SYNCSTATE_NOTSUBJECTTOSYNCING = 2;
54
55			const TYPE_IDP = 'IdP';
56			const TYPE_SP = 'SP';
57			const TYPE_IDPSP = 'IdPSP';
58
59			/**
60			*
61			* @var int synchronisation state with external database, if any
62			*/
63			private $externalDbSyncstate;
64
65			/**
66			* The shortname of this IdP's federation
67			* @var string
68			*/
69			public $federation;
70
71			/**
72			* The type of participant in DB enum notation
73			* @var string
74			*/
75			public $type;
76
77			/**
78			* Constructs an IdP object based on its details in the database.
79			* Cannot be used to define a new IdP in the database! This happens via Federation::newIdP()
80			*
81			* @param int $instId the database row identifier
82			*/
83			public function __construct(int $instId) {
84			$this->databaseType = "INST";
85			parent::__construct(); // now databaseHandle and logging is available
86			$this->entityOptionTable = "institution_option";
87			$this->entityIdColumn = "institution_id";
88
89			$this->identifier = $instId;
90
91			$idp = $this->databaseHandle->exec("SELECT inst_id, country,external_db_syncstate FROM institution WHERE inst_id = $this->identifier");
92			// SELECT -> returns resource, not boolean
93			if (!$instQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $idp)) {
94			throw new Exception("IdP $this->identifier not found in database!");
95			}
96
97			$this->federation = $instQuery->country;
98			$this->externalDbSyncstate = $instQuery->external_db_syncstate;
99
100			// fetch attributes from DB; populates $this->attributes array
101			$this->attributes = $this->retrieveOptionsFromDatabase("SELECT DISTINCT option_name, option_lang, option_value, row
102			FROM $this->entityOptionTable
103			WHERE $this->entityIdColumn = ?
104			ORDER BY option_name", "IdP");
105
106			$this->attributes[] = ["name" => "internal:country",
107			"lang" => NULL,
108			"value" => $this->federation,
109			"level" => "IdP",
110			"row" => 0,
111			"flag" => NULL];
112
113			$this->name = $this->languageInstance->getLocalisedValue($this->getAttributes('general:instname'));
114			$eligibility = $this->eligibility();
115			if (in_array(IdP::ELIGIBILITY_IDP, $eligibility) && in_array(IdP::ELIGIBILITY_SP, $eligibility)) {
116			$this->type = IdP::TYPE_IDPSP;
117			} elseif (in_array(IdP::ELIGIBILITY_IDP, $eligibility)) {
118			$this->type = IdP::TYPE_IDP;
119			} else {
120			$this->type = IdP::TYPE_SP;
121			}
122			$this->loggerInstance->debug(3, "--- END Constructing new IdP object ... ---\n");
123			}
124
125			/**
126			* This function retrieves all registered profiles for this IdP from the database
127			*
128			* @param bool $activeOnly if and set to non-zero will cause listing of only those institutions which have some valid profiles defined.
129			* @return \core\AbstractProfile[] list of Profiles of this IdP
130			*/
131			public function listProfiles(bool $activeOnly = FALSE) {
132			$query = "SELECT profile_id FROM profile WHERE inst_id = $this->identifier" . ($activeOnly ? " AND showtime = 1" : "");
133			$allProfiles = $this->databaseHandle->exec($query);
134			$returnarray = [];
135			// SELECT -> resource, not boolean
136			while ($profileQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allProfiles)) {
137			$oneProfile = ProfileFactory::instantiate($profileQuery->profile_id, $this);
138			$oneProfile->institution = $this->identifier;
139			$returnarray[] = $oneProfile;
140			}
141
142			$this->loggerInstance->debug(4, "listProfiles: " . print_r($returnarray, true));
143			return $returnarray;
144			}
145
146			/**
147			* This function retrieves all SP deployments for this organisation from the database
148			*
149			* @param bool $activeOnly if and set to non-zero will cause listing of only those institutions which have some valid profiles defined.
150			* @return \core\AbstractDeployment[] list of deployments of this IdP
151			*/
152			public function listDeployments(bool $activeOnly = FALSE) {
153			$query = "SELECT deployment_id FROM deployment WHERE inst_id = $this->identifier" . ($activeOnly ? " AND status = " . AbstractDeployment::ACTIVE : "");
154			$allDeployments = $this->databaseHandle->exec($query);
155			$returnarray = [];
156			// SELECT -> resource, not boolean
157			while ($deploymentQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allDeployments)) {
158			$returnarray[] = new DeploymentManaged($this,$deploymentQuery->deployment_id);
159			}
160
161			$this->loggerInstance->debug(4, "listDeployments: " . print_r($returnarray, true));
162			return $returnarray;
163			}
164
165			const PROFILES_INCOMPLETE = 0;
166			const PROFILES_CONFIGURED = 1;
167			const PROFILES_SHOWTIME = 2;
168
169			/**
170			* looks through all the profiles of the inst and determines the highest prod-ready level among the profiles
171			* @return int highest level of completeness of all the profiles of the inst
172			*/
173			public function maxProfileStatus() {
174			$allProfiles = $this->databaseHandle->exec("SELECT sufficient_config + showtime AS maxlevel FROM profile WHERE inst_id = $this->identifier ORDER BY maxlevel DESC LIMIT 1");
175			// SELECT yields a resource, not a boolean
176			while ($res = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allProfiles)) {
177			return $res->maxlevel;
178			}
179			return self::PROFILES_INCOMPLETE;
180			}
181
182			/** This function retrieves an array of authorised users which can
183			* manipulate this institution.
184			*
185			* @return array owners of the institution; numbered array with members ID, MAIL and LEVEL
186			*/
187			public function listOwners() {
188			$returnarray = [];
189			$admins = $this->databaseHandle->exec("SELECT user_id, orig_mail, blesslevel FROM ownership WHERE institution_id = $this->identifier ORDER BY user_id");
190			// SELECT -> resource, not boolean
191			while ($ownerQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $admins)) {
192			$returnarray[] = ['ID' => $ownerQuery->user_id, 'MAIL' => $ownerQuery->orig_mail, 'LEVEL' => $ownerQuery->blesslevel];
193			}
194			return $returnarray;
195			}
196
197			/**
198			* Primary owners are allowed to invite other (secondary) admins to the institution
199			*
200			* @param string $user ID of a logged-in user
201			* @return boolean TRUE if this user is an admin with FED-level blessing
202			*/
203			public function isPrimaryOwner($user) {
204			foreach ($this->listOwners() as $oneOwner) {
205			if ($oneOwner['ID'] == $user && $oneOwner['LEVEL'] == "FED") {
206			return TRUE;
207			}
208			}
209			return FALSE;
210			}
211
212			/**
213			* This function gets the profile count for a given IdP.
214			*
215			* The count could be retreived from the listProfiles method
216			* but this is less expensive.
217			*
218			* @return int profile count
219			*/
220			public function profileCount() {
221			$result = $this->databaseHandle->exec("SELECT profile_id FROM profile
222			WHERE inst_id = $this->identifier");
223			// SELECT -> resource, not boolean
224			return(mysqli_num_rows(/** @scrutinizer ignore-type */ $result));
225			}
226
227			/**
228			* This function gets the deployment count for a given IdP.
229			*
230			* @return int deployment count
231			*/
232			public function deploymentCount() {
233			$result = $this->databaseHandle->exec("SELECT deployment_id FROM deployment
234			WHERE inst_id = $this->identifier");
235			// SELECT -> resource, not boolean
236			return(mysqli_num_rows(/** @scrutinizer ignore-type */ $result));
237			}
238
239			const ELIGIBILITY_IDP = "IdP";
240			const ELIGIBILITY_SP = "SP";
241			/**
242			* checks whether the participant is an IdP, an SP, or both.
243			*
244			* @return array list of eligibilities
245			*/
246			public function eligibility() {
247			$eligibilites = $this->databaseHandle->exec("SELECT type FROM institution WHERE inst_id = $this->identifier");
248			while ($iterator = mysqli_fetch_object(/** @scrutinizer ignore-type */ $eligibilites)) {
249			switch ($iterator->type) {
250			case "IdP":
251			return [ IdP::ELIGIBILITY_IDP ];
252			case "SP":
253			return [ IdP::ELIGIBILITY_SP ];
254			default:
255			return [ IdP::ELIGIBILITY_IDP, IdP::ELIGIBILITY_SP ];
256			}
257			}
258			}
259
260			/**
261			* This function sets the timestamp of last modification of the child profiles to the current timestamp.
262			*
263			* This is needed for installer caching: all installers which are on disk
264			* must be re-created if an attribute changes. This timestamp here
265			* is used to determine if the installer on disk is still new enough.
266			*
267			* @return void
268			*/
269			public function updateFreshness() {
270			// freshness is always defined for Profiles
271			// IdP needs to update timestamp of all its profiles if an IdP-wide attribute changed
272			$this->databaseHandle->exec("UPDATE profile SET last_change = CURRENT_TIMESTAMP WHERE inst_id = '$this->identifier'");
273			}
274
275			/**
276			* Adds a new profile to this IdP.
277			*
278			* Only creates the DB entry for the Profile. If you want to add attributes later, see Profile::addAttribute().
279			*
280			* @param string $type exactly "RADIUS" or "SILVERBULLET", all other values throw an Exception
281			* @return AbstractProfile\|NULL new Profile object if successful, or NULL if an error occured
282			*/
283			public function newProfile(string $type) {
284			$this->databaseHandle->exec("INSERT INTO profile (inst_id) VALUES($this->identifier)");
285			$identifier = $this->databaseHandle->lastID();
286			if ($identifier > 0) {
287			switch ($type) {
288			case AbstractProfile::PROFILETYPE_RADIUS:
289			return new ProfileRADIUS($identifier, $this);
290			case AbstractProfile::PROFILETYPE_SILVERBULLET:
291			$theProfile = new ProfileSilverbullet($identifier, $this);
292			$theProfile->addSupportedEapMethod(new \core\common\EAP(\core\common\EAP::EAPTYPE_SILVERBULLET), 1);
293			$theProfile->setRealm($this->identifier . "-" . $theProfile->identifier . "." . strtolower($this->federation) . strtolower(CONFIG_CONFASSISTANT['SILVERBULLET']['realm_suffix']));
294			return $theProfile;
295			default:
296			throw new Exception("This type of profile is unknown and can not be added.");
297			}
298			}
299			return NULL;
300			}
301
302			/**
303			* Adds a new hotspot deployment to this IdP.
304			*
305			* Only creates the DB entry for the deployment. If you want to add attributes later, see Profile::addAttribute().
306			*
307			* @param string $type exactly "RADIUS-SP" or "MANAGED-SP", all other values throw an Exception
308			* @return DeploymentManaged the newly created deployment
309			*/
310			public function newDeployment(string $type) {
311			switch ($type) {
312			case AbstractDeployment::DEPLOYMENTTYPE_CLASSIC:
313			// classic deployment exist in the eduroam DB. We don't do anything here.
314			throw new Exception("This type of deployment is handled externally and requesting it here makes no sense.");
315			case AbstractDeployment::DEPLOYMENTTYPE_MANAGED:
316			$this->databaseHandle->exec("INSERT INTO deployment (inst_id) VALUES($this->identifier)");
317			$identifier = $this->databaseHandle->lastID();
318			return new DeploymentManaged($this, $identifier);
319			default:
320			throw new Exception("This type of deployment is unknown and can not be added.");
321			}
322			}
323
324			/**
325			* deletes the IdP and all its profiles
326			*
327			* @return void
328			*/
329			public function destroy() {
330			common\Entity::intoThePotatoes();
331			/* delete all profiles */
332			foreach ($this->listProfiles() as $profile) {
333			$profile->destroy();
334			}
335			/* double-check that all profiles are gone */
336			$profiles = $this->listProfiles();
337
338			if (count($profiles) > 0) {
339			throw new Exception("This IdP shouldn't have any profiles any more!");
340			}
341
342			$this->databaseHandle->exec("DELETE FROM ownership WHERE institution_id = $this->identifier");
343			$this->databaseHandle->exec("DELETE FROM institution_option WHERE institution_id = $this->identifier");
344			$this->databaseHandle->exec("DELETE FROM institution WHERE inst_id = $this->identifier");
345
346			// notify federation admins
347
348			$fed = new Federation($this->federation);
349			foreach ($fed->listFederationAdmins() as $id) {
350			$user = new User($id);
351			$message = sprintf(_("Hi,
352
353			the %s %s in your %s federation %s has been deleted from %s.
354
355			We thought you might want to know.
356
357			Best regards,
358
359			%s"), common\Entity::$nomenclature_inst, $this->name, CONFIG_CONFASSISTANT['CONSORTIUM']['display_name'], strtoupper($fed->name), CONFIG['APPEARANCE']['productname'], CONFIG['APPEARANCE']['productname_long']);
360			$user->sendMailToUser(sprintf(_("%s in your federation was deleted"), common\Entity::$nomenclature_inst), $message);
361			}
362			common\Entity::outOfThePotatoes();
363			}
364
365			/**
366			* Performs a lookup in an external database to determine matching entities to this IdP.
367			*
368			* The business logic of this function is roaming consortium specific; if no match algorithm is known for the consortium, FALSE is returned.
369			*
370			* @return mixed list of entities in external database that correspond to this IdP or FALSE if no consortium-specific matching function is defined
371			*/
372			public function getExternalDBSyncCandidates() {
373			if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
374			$list = [];
375			$usedarray = [];
376			// extract all institutions from the country
377			$externalHandle = DBConnection::handle("EXTERNAL");
378			$lowerFed = strtolower($this->federation);
379			$candidateList = $externalHandle->exec("SELECT id_institution AS id, name AS collapsed_name FROM view_active_idp_institution WHERE country = ?", "s", $lowerFed);
380			$syncstate = self::EXTERNAL_DB_SYNCSTATE_SYNCED;
381			$alreadyUsed = $this->databaseHandle->exec("SELECT DISTINCT external_db_id FROM institution WHERE external_db_id IS NOT NULL AND external_db_syncstate = ?", "i", $syncstate);
382			// SELECT -> resource, not boolean
383			while ($alreadyUsedQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $alreadyUsed)) {
384			$usedarray[] = $alreadyUsedQuery->external_db_id;
385			}
386
387			// and split them into ID, LANG, NAME pairs (operating on a resource, not boolean)
388			while ($candidateListQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $candidateList)) {
389			if (in_array($candidateListQuery->id, $usedarray)) {
390			continue;
391			}
392			$names = explode('#', $candidateListQuery->collapsed_name);
393			foreach ($names as $name) {
394			$perlang = explode(': ', $name, 2);
395			$list[] = ["ID" => $candidateListQuery->id, "lang" => $perlang[0], "name" => $perlang[1]];
396			}
397			}
398			// now see if any of the languages in CAT match any of those in the external DB
399			$mynames = $this->getAttributes("general:instname");
400			$matchingCandidates = [];
401			foreach ($mynames as $onename) {
402			foreach ($list as $listentry) {
403			if (($onename['lang'] == $listentry['lang'] \|\| $onename['lang'] == "C") && $onename['value'] == $listentry['name'] && array_search($listentry['ID'], $matchingCandidates) === FALSE) {
404			$matchingCandidates[] = $listentry['ID'];
405			}
406			}
407			}
408			return $matchingCandidates;
409			}
410			return FALSE;
411			}
412
413			/**
414			* returns the state of sync with the external DB.
415			*
416			* @return int
417			*/
418			public function getExternalDBSyncState() {
419			if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
420			return $this->externalDbSyncstate;
421			}
422			return self::EXTERNAL_DB_SYNCSTATE_NOTSUBJECTTOSYNCING;
423			}
424
425			/**
426			* Retrieves the external DB identifier of this institution. Returns FALSE if no ID is known.
427			*
428			* @return string\|boolean the external identifier; or FALSE if no external ID is known
429			*/
430			public function getExternalDBId() {
431			if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
432			$idQuery = $this->databaseHandle->exec("SELECT external_db_id FROM institution WHERE inst_id = $this->identifier AND external_db_syncstate = " . self::EXTERNAL_DB_SYNCSTATE_SYNCED);
433			// SELECT -> it's a resource, not a boolean
434			if (mysqli_num_rows(/** @scrutinizer ignore-type */ $idQuery) == 0) {
435			return FALSE;
436			}
437			$externalIdQuery = mysqli_fetch_object(/** @scrutinizer ignore-type */ $idQuery);
438			return $externalIdQuery->external_db_id;
439			}
440			return FALSE;
441			}
442
443			/**
444			* Associates the external DB id with a CAT id
445			*
446			* @param string $identifier the external DB id, which can be alpha-numeric
447			* @return void
448			*/
449			public function setExternalDBId(string $identifier) {
450			if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
451			$syncState = self::EXTERNAL_DB_SYNCSTATE_SYNCED;
452			$alreadyUsed = $this->databaseHandle->exec("SELECT DISTINCT external_db_id FROM institution WHERE external_db_id = ? AND external_db_syncstate = ?", "si", $identifier, $syncState);
453			// SELECT -> resource, not boolean
454			if (mysqli_num_rows(/** @scrutinizer ignore-type */ $alreadyUsed) == 0) {
455			$this->databaseHandle->exec("UPDATE institution SET external_db_id = ?, external_db_syncstate = ? WHERE inst_id = ?", "sii", $identifier, $syncState, $this->identifier);
456			}
457			}
458			}
459
460			/**
461			* removes the link between a CAT institution and the external DB
462			*
463			* @return void
464			*/
465			public function removeExternalDBId() {
466			if (CONFIG_CONFASSISTANT['CONSORTIUM']['name'] == "eduroam" && isset(CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo']) && CONFIG_CONFASSISTANT['CONSORTIUM']['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
467			if ($this->getExternalDBId() !== FALSE) {
468			$syncState = self::EXTERNAL_DB_SYNCSTATE_NOT_SYNCED;
469			$this->databaseHandle->exec("UPDATE institution SET external_db_id = NULL, external_db_syncstate = ? WHERE inst_id = ?", "ii", $syncState, $this->identifier);
470			}
471			}
472			}
473
474			}
475

GEANT / CAT

Push — master ( 2cdad9...933f57 )

IdP::eligibility() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like