CommandAuthorizationService::mayRaCommandBeExecutedOnBehalfOf() - Code Metrics - Inspection of "Use configured institutions for institution lists" - OpenConext/Stepup-Middleware - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — bugfix/institution-listing ( a090c5...2ad763 )

unknown

created 2020-01-21 10:31 UTC

mayRaCommandBeExecutedOnBehalfOf() B

↳ Parent: CommandAuthorizationService

Complexity

Conditions	7
Paths	7

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	33
rs	8.4586
c	0
b	0
f	0
cc	7
nc	7
nop	3

<?php
/**
 * Copyright 2010 SURFnet B.V.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Surfnet\StepupMiddleware\ApiBundle\Authorization\Service;


use Psr\Log\LoggerInterface;
use Surfnet\Stepup\Configuration\Value\InstitutionRole;
use Surfnet\Stepup\Identity\Value\IdentityId;
use Surfnet\Stepup\Identity\Value\Institution;
use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\IdentityService;
use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\WhitelistService;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\Command;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\RaExecutable;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\SelfServiceExecutable;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Identity\Command\CreateIdentityCommand;
use Surfnet\StepupMiddleware\CommandHandlingBundle\Identity\Command\UpdateIdentityCommand;

class CommandAuthorizationService
{

    /**
     * @var WhitelistService
     */
    private $whitelistService;
    /**
     * @var IdentityService
     */
    private $identityService;
    /**
     * @var AuthorizationContextService
     */
    private $authorizationContextService;
    /**
     * @var LoggerInterface
     */
    private $logger;

    public function __construct(
        WhitelistService $whitelistService,
        IdentityService $identityService,
        LoggerInterface $logger,
        AuthorizationContextService $authorizationContextService
    ) {
        $this->logger = $logger;
        $this->authorizationContextService = $authorizationContextService;
        $this->whitelistService = $whitelistService;
        $this->identityService = $identityService;
    }

    /**
     * @param Institution $institution
     * @param IdentityId $actorId

     * @return bool
     */
    public function isInstitutionWhitelisted(Institution $institution, IdentityId $actorId = null)
    {
        // If the actor is SRAA all actions should be allowed
        if (!is_null($actorId) && $this->isSraa($actorId)) {
            return true;
        }

        if ($this->whitelistService->isWhitelisted($institution->getInstitution())) {

            return true;
        }

        return false;
    }

    /**
     * @param string $actorId

     * @param Command $command
     * @return bool
     */
    public function maySelfServiceCommandBeExecutedOnBehalfOf(Command $command, IdentityId $actorId = null)
    {
        // Assert self service command could be executed
        if ($command instanceof SelfServiceExecutable) {
            $this->logger->notice('Asserting a SelfService command');

            // If the actor is SRAA all actions should be allowed
            if ($this->isSraa($actorId)) {
                return true;
            }

            // the createIdentityCommand is used to create an Identity for a new user,
            // the updateIdentityCommand is used to update name or email of an identity
            // Both are only sent by the SS when the Identity is not logged in yet,
            // thus there is not Metadata::actorInstitution,
            if ($command instanceof CreateIdentityCommand || $command instanceof UpdateIdentityCommand) {
                return true;
            }

            // Validate if the actor is the user
            if ($command->getIdentityId() !== $actorId->getIdentityId()) {
function someFunction(A $objectMaybe = null)
{
    if ($objectMaybe instanceof A) {
        $objectMaybe->doSomething();
    }
}
                return false;
            }
        }

        return true;
    }

    /**
     * @param string $actorId

     * @param string $actorInstitution

     * @param Command $command
     * @return bool
     */
    public function mayRaCommandBeExecutedOnBehalfOf(Command $command, IdentityId $actorId = null, Institution $actorInstitution = null)
    {
        // Assert RAA specific authorizations
        if ($command instanceof RaExecutable) {
            $this->logger->notice('Asserting a RA command');

            // The actor metadata should be set
            if  (is_null($actorId) || is_null($actorInstitution)) {
                return false;
            }

            // If the actor is SRAA all actions should be allowed
            if ($this->isSraa($actorId)) {
                return true;
            }

            $raInstitution = $command->getRaInstitution();
            if (is_null($raInstitution)) {
                $raInstitution = $actorInstitution->getInstitution();
            }

            $authorizationContext = $this->authorizationContextService->buildInstitutionAuthorizationContext(
                $actorId,
                InstitutionRole::useRaa()
            );

            if (!$authorizationContext->getInstitutions()->contains(new Institution($raInstitution))) {
                return false;
            }
        }

        return true;
    }

    /**
     * @param IdentityId $actorId

     * @return bool
     */
    private function isSraa(IdentityId $actorId = null)
    {
        if (is_null($actorId)) {
            return false;
        }

        $registrationAuthorityCredentials = $this->identityService->findRegistrationAuthorityCredentialsOf($actorId->getIdentityId());
        if (!$registrationAuthorityCredentials) {
            return false;
        }

        if (!$registrationAuthorityCredentials->isSraa()) {

            return false;
        }

        return true;
    }
}

1			<?php
2			/**
3			* Copyright 2010 SURFnet B.V.
4			*
5			* Licensed under the Apache License, Version 2.0 (the "License");
6			* you may not use this file except in compliance with the License.
7			* You may obtain a copy of the License at
8			*
9			* http://www.apache.org/licenses/LICENSE-2.0
10			*
11			* Unless required by applicable law or agreed to in writing, software
12			* distributed under the License is distributed on an "AS IS" BASIS,
13			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14			* See the License for the specific language governing permissions and
15			* limitations under the License.
16			*/
17
18			namespace Surfnet\StepupMiddleware\ApiBundle\Authorization\Service;
19
20
21			use Psr\Log\LoggerInterface;
22			use Surfnet\Stepup\Configuration\Value\InstitutionRole;
23			use Surfnet\Stepup\Identity\Value\IdentityId;
24			use Surfnet\Stepup\Identity\Value\Institution;
25			use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\IdentityService;
26			use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\WhitelistService;
27			use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\Command;
28			use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\RaExecutable;
29			use Surfnet\StepupMiddleware\CommandHandlingBundle\Command\SelfServiceExecutable;
30			use Surfnet\StepupMiddleware\CommandHandlingBundle\Identity\Command\CreateIdentityCommand;
31			use Surfnet\StepupMiddleware\CommandHandlingBundle\Identity\Command\UpdateIdentityCommand;
32
33			class CommandAuthorizationService
34			{
35
36			/**
37			* @var WhitelistService
38			*/
39			private $whitelistService;
40			/**
41			* @var IdentityService
42			*/
43			private $identityService;
44			/**
45			* @var AuthorizationContextService
46			*/
47			private $authorizationContextService;
48			/**
49			* @var LoggerInterface
50			*/
51			private $logger;
52
53			public function __construct(
54			WhitelistService $whitelistService,
55			IdentityService $identityService,
56			LoggerInterface $logger,
57			AuthorizationContextService $authorizationContextService
58			) {
59			$this->logger = $logger;
60			$this->authorizationContextService = $authorizationContextService;
61			$this->whitelistService = $whitelistService;
62			$this->identityService = $identityService;
63			}
64
65			/**
66			* @param Institution $institution
67			* @param IdentityId $actorId
			0 ignored issues – show Documentation introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report Should the type for parameter `$actorId` not be `null\|IdentityId`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
68			* @return bool
69			*/
70			public function isInstitutionWhitelisted(Institution $institution, IdentityId $actorId = null)
71			{
72			// If the actor is SRAA all actions should be allowed
73			if (!is_null($actorId) && $this->isSraa($actorId)) {
74			return true;
75			}
76
77			if ($this->whitelistService->isWhitelisted($institution->getInstitution())) {
			0 ignored issues – show Unused Code introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report This `if` statement, and the following `return` statement can be replaced with `return $this->whitelistS...ion->getInstitution());`. Loading history...
78			return true;
79			}
80
81			return false;
82			}
83
84			/**
85			* @param string $actorId
			0 ignored issues – show Documentation introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report Should the type for parameter `$actorId` not be `null\|IdentityId`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
86			* @param Command $command
87			* @return bool
88			*/
89			public function maySelfServiceCommandBeExecutedOnBehalfOf(Command $command, IdentityId $actorId = null)
90			{
91			// Assert self service command could be executed
92			if ($command instanceof SelfServiceExecutable) {
93			$this->logger->notice('Asserting a SelfService command');
94
95			// If the actor is SRAA all actions should be allowed
96			if ($this->isSraa($actorId)) {
97			return true;
98			}
99
100			// the createIdentityCommand is used to create an Identity for a new user,
101			// the updateIdentityCommand is used to update name or email of an identity
102			// Both are only sent by the SS when the Identity is not logged in yet,
103			// thus there is not Metadata::actorInstitution,
104			if ($command instanceof CreateIdentityCommand \|\| $command instanceof UpdateIdentityCommand) {
105			return true;
106			}
107
108			// Validate if the actor is the user
109			if ($command->getIdentityId() !== $actorId->getIdentityId()) {
			0 ignored issues – show Bug introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report It seems like `$actorId` is not always an object, but can also be of type `null`. Maybe add an additional type check? If a variable is not always an object, we recommend to add an additional type check to ensure your method call is safe: function someFunction(A $objectMaybe = null) { if ($objectMaybe instanceof A) { $objectMaybe->doSomething(); } } Loading history...
110			return false;
111			}
112			}
113
114			return true;
115			}
116
117			/**
118			* @param string $actorId
			0 ignored issues – show Documentation introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report Should the type for parameter `$actorId` not be `null\|IdentityId`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
119			* @param string $actorInstitution
			0 ignored issues – show Documentation introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report Should the type for parameter `$actorInstitution` not be `null\|Institution`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
120			* @param Command $command
121			* @return bool
122			*/
123			public function mayRaCommandBeExecutedOnBehalfOf(Command $command, IdentityId $actorId = null, Institution $actorInstitution = null)
124			{
125			// Assert RAA specific authorizations
126			if ($command instanceof RaExecutable) {
127			$this->logger->notice('Asserting a RA command');
128
129			// The actor metadata should be set
130			if (is_null($actorId) \|\| is_null($actorInstitution)) {
131			return false;
132			}
133
134			// If the actor is SRAA all actions should be allowed
135			if ($this->isSraa($actorId)) {
136			return true;
137			}
138
139			$raInstitution = $command->getRaInstitution();
140			if (is_null($raInstitution)) {
141			$raInstitution = $actorInstitution->getInstitution();
142			}
143
144			$authorizationContext = $this->authorizationContextService->buildInstitutionAuthorizationContext(
145			$actorId,
146			InstitutionRole::useRaa()
147			);
148
149			if (!$authorizationContext->getInstitutions()->contains(new Institution($raInstitution))) {
150			return false;
151			}
152			}
153
154			return true;
155			}
156
157			/**
158			* @param IdentityId $actorId
			0 ignored issues – show Documentation introduced 2020-01-21 10:14 UTC by Report Bug Copy Issue Report Should the type for parameter `$actorId` not be `null\|IdentityId`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
159			* @return bool
160			*/
161			private function isSraa(IdentityId $actorId = null)
162			{
163			if (is_null($actorId)) {
164			return false;
165			}
166
167			$registrationAuthorityCredentials = $this->identityService->findRegistrationAuthorityCredentialsOf($actorId->getIdentityId());
168			if (!$registrationAuthorityCredentials) {
169			return false;
170			}
171
172			if (!$registrationAuthorityCredentials->isSraa()) {
			0 ignored issues – show Unused Code introduced 2020-01-09 10:47 UTC by Report Bug Copy Issue Report This `if` statement, and the following `return` statement can be replaced with `return $registrationAuth...yCredentials->isSraa();`. Loading history...
173			return false;
174			}
175
176			return true;
177			}
178			}

OpenConext / Stepup-Middleware

Push — bugfix/institution-listing ( a090c5...2ad763 )

mayRaCommandBeExecutedOnBehalfOf() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like