AuthorizationService::assertRegistrationOfSelfAssertedTokensIsAllowed()

Complexity

Conditions	9
Paths	10

Size

Total Lines	46
Code Lines	24

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    public function assertRegistrationOfSelfAssertedTokensIsAllowed(IdentityId $identityId): AuthorizationDecision
    {
        $identity = $this->findIdentity($identityId);
        if (!$identity instanceof Identity) {
            return $this->deny('Identity not found');
        }
        $institutionConfiguration = $this->findInstitutionConfiguration($identity);

        if (!$institutionConfiguration instanceof InstitutionConfigurationOptions) {
            return $this->deny(
                'Institution configuration could not be found, unable to ascertain if self-asserted tokens feature is enabled',
            );
        }

        if (!$institutionConfiguration->selfAssertedTokensOption->isEnabled()) {
            return $this->deny(
                sprintf('Institution "%s", does not allow self-asserted tokens', (string)$identity->institution),
            );
        }

        $hasVettedSecondFactorToken = $this->secondFactorService->hasVettedByIdentity($identityId);

        $options = $this->identityService->getSelfAssertedTokenRegistrationOptions(
            $identity,
            $hasVettedSecondFactorToken,
        );

        if ($hasVettedSecondFactorToken) {
            return $this->deny('Identity already has a vetted second factor');
        }

        // Only allow self-asserted token (SAT) if the user does not have a token yet, or the first
        // registered token was a SAT.
        $hadOtherTokenType = $options->possessedSelfAssertedToken === false && $options->possessedToken;
        if ($hadOtherTokenType) {
            return $this->deny(
                'Identity never possessed a self-asserted token, but did/does possess one of the other types',
            );
        }
        // The Identity is not allowed to do a SAT when he had a RT, but lost it. And also currently has no SF
        $hasActiveRecoveryToken = $this->recoveryTokenService->identityHasActiveRecoveryToken($identity);
        if ($options->possessedSelfAssertedToken && !$hasActiveRecoveryToken) {
            return $this->deny('Identity lost both Recovery and Second Factor token, SAT is not allowed');
        }

        return $this->allow();
    }