Surfnet\StepupMiddleware\ApiBundle\Authorization\Service\IdentityAuthorizationService

Complexity

Total Complexity

20

Size/Duplication

Total Lines	161
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	10

Importance

Changes

0

6 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	11	1
A	assertInstitutionIsWhitelisted()	0	23	4
A	assertCommandMayBeExecutedOnBehalfOf()	0	5	1
B	assertSelfServiceCommandMayBeExecutedOnBehalfOf()	0	31	6
A	assertRaCommandMayBeExecutedOnBehalfOf()	0	30	5
A	isSraa()	0	13	3

<?php
/**
 * Copyright 2010 SURFnet B.V.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Surfnet\StepupMiddleware\ApiBundle\Authorization\Service;


use Psr\Log\LoggerInterface;
use Surfnet\Stepup\Configuration\Value\InstitutionRole;
use Surfnet\Stepup\Identity\Value\IdentityId;
use Surfnet\Stepup\Identity\Value\Institution;
use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\IdentityService;
use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\WhitelistService;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\Command;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\RaExecutable;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\SelfServiceExecutable;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Identity\Command\CreateIdentityCommand;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Identity\Command\UpdateIdentityCommand;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;

class IdentityAuthorizationService
{

    /**
     * @var WhitelistService
     */
    private $whitelistService;
    /**
     * @var IdentityService
     */
    private $identityService;
    /**
     * @var InstitutionAuthorizationService
     */
    private $institutionAuthorizationService;
    /**
     * @var LoggerInterface
     */
    private $logger;

    public function __construct(
        WhitelistService $whitelistService,
        IdentityService $identityService,
        LoggerInterface $logger,
        InstitutionAuthorizationService $institutionAuthorizationService
    ) {
        $this->logger = $logger;
        $this->institutionAuthorizationService = $institutionAuthorizationService;
        $this->whitelistService = $whitelistService;
        $this->identityService = $identityService;
    }

    /**
     * @param Institution      $institution
     * @param IdentityId $actorId
     */
    public function assertInstitutionIsWhitelisted(Institution $institution, IdentityId $actorId)
    {
        if ($this->whitelistService->isWhitelisted($institution)) {
            return;
        }

        if (!$actorId) {
            throw new AccessDeniedHttpException(sprintf(
                'Institution "%s" is not on the whitelist and no actor is found, processing of command denied',
                $institution
            ));
        }

        if ($this->isSraa($actorId)) {
            return;
        }

        throw new AccessDeniedHttpException(sprintf(
            'Institution "%s" is not on the whitelist and actor "%s" is not an SRAA, processing of command denied',
            $institution,
            $actorId
        ));
    }

    /**
     * @param IdentityId $actorId
     * @param Institution $actorInstitution
     * @param Command $command
     */
    public function assertCommandMayBeExecutedOnBehalfOf(IdentityId $actorId, Institution $actorInstitution, Command $command)
    {
        $this->assertSelfServiceCommandMayBeExecutedOnBehalfOf($actorId, $command);
        $this->assertRaCommandMayBeExecutedOnBehalfOf($actorId, $actorInstitution, $command);
    }

    /**
     * @param string $actorId

Should the type for parameter $actorId not be IdentityId?

     * @param Command $command
     */
    private function assertSelfServiceCommandMayBeExecutedOnBehalfOf(IdentityId $actorId, Command $command)
    {
        // Assert self service command could be executed
        if ($command instanceof SelfServiceExecutable) {
            $this->logger->notice('Asserting a SelfService command');

            // the createIdentityCommand is used to create an Identity for a new user,
            // the updateIdentityCommand is used to update name or email of an identity
            // Both are only sent by the SS when the Identity is not logged in yet,
            // thus there is not Metadata::actorInstitution,
            if ($command instanceof CreateIdentityCommand || $command instanceof UpdateIdentityCommand) {
                return;
            }

            // If the actor is SRAA all actions should be allowed
            if ($this->isSraa($actorId)) {
                return;
            }

            // Validate if the actor is the user
            if ($command->getIdentityId() !== $actorId) {
                throw new AccessDeniedHttpException(sprintf(
                    'The actor "%s" is not allowed to act on behalf of identity "%s" processing of command denied',
                    $actorId,
                    $command->getIdentityId()
                ));
            }

            return;
        }
    }

    /**
     * @param string $actorId

Should the type for parameter $actorId not be IdentityId?

     * @param string $actorInstitution

Should the type for parameter $actorInstitution not be Institution?

     * @param Command $command
     */
    private function assertRaCommandMayBeExecutedOnBehalfOf(IdentityId $actorId, Institution $actorInstitution, Command $command)
    {
        // Assert RAA specific authorizations
        if ($command instanceof RaExecutable) {
            $this->logger->notice('Asserting a RA command');

            // If the actor is SRAA all actions should be allowed
            if ($this->isSraa($actorId)) {
                return;
            }

            $raInstitution = $command->getRaInstitution();
            if (is_null($raInstitution)) {
                $raInstitution = $actorInstitution;
            }

            $authorizationContext = $this->institutionAuthorizationService->buildInstitutionAuthorizationContext(
                new IdentityId($actorId),
                InstitutionRole::useRaa()
            );

            if (!$authorizationContext->getInstitutions()->contains(new Institution($raInstitution))) {
                throw new AccessDeniedHttpException(sprintf(
                    'The actor "%s" is not allowed to act on behalf of institution  "%s" processing of command denied',
                    $actorId,
                    $raInstitution
                ));
            }
        }
    }

    /**
     * @param string $actorId
     * @return bool
     */
    private function isSraa($actorId)
    {
        $registrationAuthorityCredentials = $this->identityService->findRegistrationAuthorityCredentialsOf($actorId);
        if (!$registrationAuthorityCredentials) {
            return false;
        }

        if (!$registrationAuthorityCredentials->isSraa()) {

This if statement, and the following return statement can be replaced with return $registrationAuthorityCredentials->isSraa();.

            return false;
        }

        return true;
    }
}