JdSignAuth::challenge()   A
last analyzed

Complexity

Conditions 1
Paths 1

Size

Total Lines 4
Code Lines 1

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
dl 0
loc 4
rs 10
c 0
b 0
f 0
cc 1
eloc 1
nc 1
nop 1
1
<?php
2
3
namespace graychen\yii2\jd\deposit\filters;
4
5
use common\models\User;
6
use yii\filters\auth\AuthMethod;
7
8
class JdSignAuth extends AuthMethod
9
{
10
    public $realm = 'api';
11
    public $auth;
12
13
    /**
14
     * @inheritdoc
15
     */
16
    public function authenticate($user, $request, $response)
17
    {
18
        $rawParams = $params = empty($request->getBodyParams()) ? $request->getQueryParams() : $request->getBodyParams();
19
        if ($params['customerId'] != getenv('JINDONG_API_CUSTOMERID')) {
20
            $this->handleFailure($response);
21
        }
22
        $sign = $this->createSign($params);
23
        if ($sign != $rawParams['sign']) {
24
            $this->handleFailure($response);
25
        }
26
        $request->setBodyParams($params);
27
28
        return new User();
0 ignored issues
show
Bug Best Practice introduced by
The return type of return new \common\models\User(); (common\models\User) is incompatible with the return type declared by the interface yii\filters\auth\AuthInterface::authenticate of type yii\web\IdentityInterface.

If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design.

Let’s take a look at an example:

class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}

Our function my_function expects a Post object, and outputs the author of the post. The base class Post returns a simple string and outputting a simple string will work just fine. However, the child class BlogPost which is a sub-type of Post instead decided to return an object, and is therefore violating the SOLID principles. If a BlogPost were passed to my_function, PHP would not complain, but ultimately fail when executing the strtoupper call in its body.

Loading history...
29
    }
30
31
    /**
32
     * @inheritdoc
33
     */
34
    public function challenge($response)
35
    {
36
        //$response->getHeaders()->set('WWW-Authenticate', "Basic realm=\"{$this->realm}\"");
0 ignored issues
show
Unused Code Comprehensibility introduced by
77% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
37
    }
38
39
    /**
40
     * 生成签名验证串sign
41
     * @param array $params post或get请求的请求参数数组
42
     * @return string sign签名验证串
43
     */
44
    public function createSign($params)
45
    {
46
        $data = $params['data'];
47
        $signStr = "customerId=" . getenv('JINDONG_API_CUSTOMERID') . "&data=" . $data . "&timestamp=" . $params['timestamp'] . "&" . getenv('JINDONG_API_PRIVATEKEY');
48
        $sign = md5($signStr);
49
        return $sign;
50
    }
51
}
52