+global\Login::doLogIn()

Complexity

Conditions	11
Paths	54

Size

Total Lines	78
Code Lines	39

Duplication

Lines	11
Ratio	14.1 %

Importance

Changes

0

<?php
    public function doLogIn($email, $password, $rememberMe, $userIp, $userAgent){

        // 1. check if user is blocked
        if($this->isIpBlocked($userIp)) {
            $this->errors[] = "Your IP Address has been blocked";
            return false;
        }

        // 2. validate only presence
        $validation = new Validation();
        if(!$validation->validate([

This code seems to be duplicated across your project.

            "Your Email" => [$email, 'required'],
            "Your Password" => [$password, 'required']])){
            $this->errors = $validation->errors();
            return false;
        }

        // 3. check if user has previous failed login attempts
        $database = Database::openConnection();
        $database->getByUserEmail("failed_logins", $email);
        $failedLogin = $database->fetchAssociative();

        $last_time   = isset($failedLogin["last_failed_login"])? $failedLogin["last_failed_login"]: null;
        $count       = isset($failedLogin["failed_login_attempts"])? $failedLogin["failed_login_attempts"]: null;

        // check if the failed login attempts exceeded limits
        // @see Validation::attempts()

38% of this comment could be valid code. Did you maybe forget this after debugging?

        if(!$validation->validate([

This code seems to be duplicated across your project.

            'Failed Login' => [["last_time" => $last_time, "count" => $count], 'attempts']])){
            $this->errors = $validation->errors();
            return false;
        }

        // 4. get user from database
        $database->prepare("SELECT * FROM users WHERE email = :email AND is_email_activated = 1 LIMIT 1");
        $database->bindValue(':email', $email);
        $database->execute();
        $user = $database->fetchAssociative();

        $userId = isset($user["id"])? $user["id"]: null;
        $hashedPassword = isset($user["hashed_password"])? $user["hashed_password"]: null;

        // 5. validate data returned from users table
        if(!$validation->validate([
            "Login" => [["user_id" => $userId, "hashed_password" => $hashedPassword, "password" => $password], 'credentials']])){

            // if not valid, then increment number of failed logins
            $this->incrementFailedLogins($email, $failedLogin);

It seems like $failedLogin defined by $database->fetchAssociative() on line 110 can also be of type boolean; however, Login::incrementFailedLogins() does only seem to accept array, maybe add an additional type check?

            // also, check if current IP address is trying to login using multiple accounts,
            // if so, then block it, if not, just add a new record to database
            $this->handleIpFailedLogin($userIp, $email);

            $this->errors = $validation->errors();
            return false;
        }

        // reset session
        Session::reset(["user_id" => $userId, "role" => $user["role"], "ip" => $userIp, "user_agent" => $userAgent]);

        // if remember me checkbox is checked, then save data to cookies as well
        if(!empty($rememberMe) && $rememberMe === "rememberme"){

            // reset cookie, Cookie token usable only once
            Cookie::reset($userId);

        } else {

            Cookie::remove($userId);
        }

        // if user credentials are valid then,
        // reset failed logins & forgotten password tokens
        $this->resetFailedLogins($email);
        $this->resetPasswordToken($userId);

        return true;
    }

}