SamlToken::changeInstitutionScope() - Code Metrics - Inspection of "Move RAA identity check to SamlToken" - OpenConext/Stepup-RA - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — feature/fine-grained-authoriza... ( 98a8e7...c547db )

unknown

created 2018-11-07 09:57 UTC

SamlToken::changeInstitutionScope() A

↳ Parent: SamlToken

Complexity

Conditions	5
Paths	3

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	23
rs	9.2408
c	0
b	0
f	0
cc	5
nc	3
nop	2

<?php

/**
 * Copyright 2014 SURFnet bv
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Surfnet\StepupRa\RaBundle\Security\Authentication\Token;

use Surfnet\StepupBundle\Value\Loa;
use Surfnet\StepupMiddlewareClientBundle\Configuration\Dto\InstitutionConfigurationOptions;
use Surfnet\StepupRa\RaBundle\Exception\LogicException;
use Surfnet\StepupRa\RaBundle\Exception\RuntimeException;
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
use Symfony\Component\Security\Core\Role\RoleInterface;

class SamlToken extends AbstractToken
{
    /**
     * @var \SAML2\Assertion
     */
    public $assertion;

    /**
     * @var \Surfnet\StepupBundle\Value\Loa
     */
    private $loa;

    /**
     * @var InstitutionConfigurationOptions
     */
    private $institutionConfigurationOptions;

    /**
     * @var string
     */
    private $raManagementInstitution;

    /**
     * The SHO of the identity
     *
     * @var string
     */
    private $schacHomeOrganization;

    /**
     * The identity institution is set with the SHO of the identity. This value is not overridden like the user
     * institution can be. This value can be used to get the identities institution regardless of the scope it
     * is performing RAA tasks for at this moment.
     *
     * @var string
     */
    private $identityInstitution;

    public function __construct(
        Loa $loa,
        array $roles = [],
        InstitutionConfigurationOptions $institutionConfigurationOptions = null,
        $schacHomeOrganization = ''
    ) {
        parent::__construct($roles);

        $this->loa = $loa;
        $this->setAuthenticated(count($roles));
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
        $this->institutionConfigurationOptions = $institutionConfigurationOptions;
        $this->schacHomeOrganization = $schacHomeOrganization;
    }

    /**
     * @return InstitutionConfigurationOptions
     */
    public function getInstitutionConfigurationOptions()
    {
        return $this->institutionConfigurationOptions;
    }

    /**
     * @param string $institution
     * @param InstitutionConfigurationOptions $institutionConfigurationOptions
     */
    public function changeInstitutionScope(
        $institution,
        InstitutionConfigurationOptions $institutionConfigurationOptions
    ) {
        if ($this->getUser() === null) {
            throw new LogicException('Cannot change institution scope: token does not contain a user');
        }

        $roles = array_map(function (RoleInterface $role) {
            return $role->getRole();
        }, $this->getRoles());

        if (!in_array('ROLE_SRAA', $roles) && !in_array('ROLE_RAA', $roles) && !in_array('ROLE_RA', $roles)) {
            throw new RuntimeException(sprintf(
                'Unauthorized to change institution scope to "%s": role (S)RA(A) required, found roles "%s"',
                $institution,
                implode(', ', $roles)
            ));
        }

        $this->getUser()->institution = $institution;
        $this->institutionConfigurationOptions = $institutionConfigurationOptions;
    }

    /**
     * Returns the user credentials.
     *
     * @return mixed The user credentials
     */
    public function getCredentials()
    {
        return '';
    }

    /**
     * @return Loa
     */
    public function getLoa()
    {
        return $this->loa;
    }

    public function serialize()
    {
        return serialize(
            [
                parent::serialize(),
                $this->loa,
                $this->institutionConfigurationOptions,
                $this->raManagementInstitution,
                $this->identityInstitution,
                $this->schacHomeOrganization,
            ]
        );
    }

    public function unserialize($serialized)
    {
        list($parent, $this->loa, $this->institutionConfigurationOptions, $this->raManagementInstitution, $this->identityInstitution, $this->schacHomeOrganization) = unserialize(
            $serialized
        );

        parent::unserialize($parent);
    }

    /**
     * @return string
     */
    public function getIdentityInstitution()
    {
        // If the identityInstitution is not yet set, fill it with the institution of the identity.
        if (!$this->identityInstitution) {
            $this->identityInstitution = $this->getUser()->institution;
        }
        return $this->identityInstitution;
    }


    /**
     * @return string
     */
    public function getRaManagementInstitution()
    {
        if (!$this->raManagementInstitution) {
            return $this->getUser()->institution;
        }
        return $this->raManagementInstitution;
    }

    /**
     * @return string
     */
    public function getSchacHomeInstitution()
    {
        return $this->schacHomeOrganization;
    }

    /**
     * @return string
     */
    public function getIdentityOriginalInstitution()
    {
        if (!$this->isUserSraa()) {
            return $this->getSchacHomeInstitution();
        }

        return $this->getUser()->institution;
    }

    /**
     * @return string

     */
    private function isUserSraa()
    {
        /**
         * @var SamlToken $token
         */
        foreach ($this->getRoles() as $role){
            if ($role->getRole() == 'ROLE_SRAA') {
                return true;
            }
        }

        return false;
    }
}


1			<?php
2
3			/**
4			* Copyright 2014 SURFnet bv
5			*
6			* Licensed under the Apache License, Version 2.0 (the "License");
7			* you may not use this file except in compliance with the License.
8			* You may obtain a copy of the License at
9			*
10			* http://www.apache.org/licenses/LICENSE-2.0
11			*
12			* Unless required by applicable law or agreed to in writing, software
13			* distributed under the License is distributed on an "AS IS" BASIS,
14			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15			* See the License for the specific language governing permissions and
16			* limitations under the License.
17			*/
18
19			namespace Surfnet\StepupRa\RaBundle\Security\Authentication\Token;
20
21			use Surfnet\StepupBundle\Value\Loa;
22			use Surfnet\StepupMiddlewareClientBundle\Configuration\Dto\InstitutionConfigurationOptions;
23			use Surfnet\StepupRa\RaBundle\Exception\LogicException;
24			use Surfnet\StepupRa\RaBundle\Exception\RuntimeException;
25			use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
26			use Symfony\Component\Security\Core\Role\RoleInterface;
27
28			class SamlToken extends AbstractToken
29			{
30			/**
31			* @var \SAML2\Assertion
32			*/
33			public $assertion;
34
35			/**
36			* @var \Surfnet\StepupBundle\Value\Loa
37			*/
38			private $loa;
39
40			/**
41			* @var InstitutionConfigurationOptions
42			*/
43			private $institutionConfigurationOptions;
44
45			/**
46			* @var string
47			*/
48			private $raManagementInstitution;
49
50			/**
51			* The SHO of the identity
52			*
53			* @var string
54			*/
55			private $schacHomeOrganization;
56
57			/**
58			* The identity institution is set with the SHO of the identity. This value is not overridden like the user
59			* institution can be. This value can be used to get the identities institution regardless of the scope it
60			* is performing RAA tasks for at this moment.
61			*
62			* @var string
63			*/
64			private $identityInstitution;
65
66			public function __construct(
67			Loa $loa,
68			array $roles = [],
69			InstitutionConfigurationOptions $institutionConfigurationOptions = null,
70			$schacHomeOrganization = ''
71			) {
72			parent::__construct($roles);
73
74			$this->loa = $loa;
75			$this->setAuthenticated(count($roles));
			0 ignored issues – show Documentation introduced 2015-12-15 13:46 UTC by Report Bug Copy Issue Report `count($roles)` is of type `integer`, but the function expects a `boolean`. It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { } $x = '123'; // string "123" // Instead of acceptsInteger($x); // we recommend to use acceptsInteger((integer) $x); Loading history...
76			$this->institutionConfigurationOptions = $institutionConfigurationOptions;
77			$this->schacHomeOrganization = $schacHomeOrganization;
78			}
79
80			/**
81			* @return InstitutionConfigurationOptions
82			*/
83			public function getInstitutionConfigurationOptions()
84			{
85			return $this->institutionConfigurationOptions;
86			}
87
88			/**
89			* @param string $institution
90			* @param InstitutionConfigurationOptions $institutionConfigurationOptions
91			*/
92			public function changeInstitutionScope(
93			$institution,
94			InstitutionConfigurationOptions $institutionConfigurationOptions
95			) {
96			if ($this->getUser() === null) {
97			throw new LogicException('Cannot change institution scope: token does not contain a user');
98			}
99
100			$roles = array_map(function (RoleInterface $role) {
101			return $role->getRole();
102			}, $this->getRoles());
103
104			if (!in_array('ROLE_SRAA', $roles) && !in_array('ROLE_RAA', $roles) && !in_array('ROLE_RA', $roles)) {
105			throw new RuntimeException(sprintf(
106			'Unauthorized to change institution scope to "%s": role (S)RA(A) required, found roles "%s"',
107			$institution,
108			implode(', ', $roles)
109			));
110			}
111
112			$this->getUser()->institution = $institution;
113			$this->institutionConfigurationOptions = $institutionConfigurationOptions;
114			}
115
116			/**
117			* Returns the user credentials.
118			*
119			* @return mixed The user credentials
120			*/
121			public function getCredentials()
122			{
123			return '';
124			}
125
126			/**
127			* @return Loa
128			*/
129			public function getLoa()
130			{
131			return $this->loa;
132			}
133
134			public function serialize()
135			{
136			return serialize(
137			[
138			parent::serialize(),
139			$this->loa,
140			$this->institutionConfigurationOptions,
141			$this->raManagementInstitution,
142			$this->identityInstitution,
143			$this->schacHomeOrganization,
144			]
145			);
146			}
147
148			public function unserialize($serialized)
149			{
150			list($parent, $this->loa, $this->institutionConfigurationOptions, $this->raManagementInstitution, $this->identityInstitution, $this->schacHomeOrganization) = unserialize(
151			$serialized
152			);
153
154			parent::unserialize($parent);
155			}
156
157			/**
158			* @return string
159			*/
160			public function getIdentityInstitution()
161			{
162			// If the identityInstitution is not yet set, fill it with the institution of the identity.
163			if (!$this->identityInstitution) {
164			$this->identityInstitution = $this->getUser()->institution;
165			}
166			return $this->identityInstitution;
167			}
168
169
170			/**
171			* @return string
172			*/
173			public function getRaManagementInstitution()
174			{
175			if (!$this->raManagementInstitution) {
176			return $this->getUser()->institution;
177			}
178			return $this->raManagementInstitution;
179			}
180
181			/**
182			* @return string
183			*/
184			public function getSchacHomeInstitution()
185			{
186			return $this->schacHomeOrganization;
187			}
188
189			/**
190			* @return string
191			*/
192			public function getIdentityOriginalInstitution()
193			{
194			if (!$this->isUserSraa()) {
195			return $this->getSchacHomeInstitution();
196			}
197
198			return $this->getUser()->institution;
199			}
200
201			/**
202			* @return string
			0 ignored issues – show Documentation introduced 2018-11-06 15:39 UTC by Report Bug Copy Issue Report Should the return type not be `boolean`? This check compares the return type specified in the `@return` annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch. Loading history...
203			*/
204			private function isUserSraa()
205			{
206			/**
207			* @var SamlToken $token
208			*/
209			foreach ($this->getRoles() as $role){
210			if ($role->getRole() == 'ROLE_SRAA') {
211			return true;
212			}
213			}
214
215			return false;
216			}
217			}
218

OpenConext / Stepup-RA

Push — feature/fine-grained-authoriza... ( 98a8e7...c547db )

SamlToken::changeInstitutionScope() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like