Surfnet\StepupRa\RaBundle\Security\Authentication\Token\SamlToken

Complexity

Total Complexity

19

Size/Duplication

Total Lines	176
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	4

Importance

Changes

0

11 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	13	1
A	getInstitutionConfigurationOptions()	0	4	1
A	changeInstitutionScope()	0	23	5
A	getCredentials()	0	4	1
A	getLoa()	0	4	1
A	serialize()	0	12	1
A	unserialize()	0	14	1
A	getRaManagementInstitution()	0	7	2
A	getSchacHomeInstitution()	0	4	1
A	getIdentityOriginalInstitution()	0	8	2
A	isUserSraa()	0	13	3

<?php

/**
 * Copyright 2014 SURFnet bv
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Surfnet\StepupRa\RaBundle\Security\Authentication\Token;

use Surfnet\StepupBundle\Value\Loa;
use Surfnet\StepupMiddlewareClientBundle\Configuration\Dto\InstitutionConfigurationOptions;
use Surfnet\StepupRa\RaBundle\Exception\LogicException;
use Surfnet\StepupRa\RaBundle\Exception\RuntimeException;
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
use Symfony\Component\Security\Core\Role\RoleInterface;

class SamlToken extends AbstractToken
{
    /**
     * @var \SAML2\Assertion
     */
    public $assertion;

    /**
     * @var \Surfnet\StepupBundle\Value\Loa
     */
    private $loa;

    /**
     * @var InstitutionConfigurationOptions
     */
    private $institutionConfigurationOptions;

    /**
     * @var string
     */
    private $raManagementInstitution;

    /**
     * The identity institution is set with the SHO of the identity. This value is not overridden like the user
     * institution can be. This value can be used to get the identities institution regardless of the scope it
     * is performing RAA tasks for at this moment.
     *
     * @var string
     */
    private $schacHomeOrganization;


    public function __construct(
        Loa $loa,
        array $roles = [],
        InstitutionConfigurationOptions $institutionConfigurationOptions = null,
        $schacHomeOrganization = ''
    ) {
        parent::__construct($roles);

        $this->loa = $loa;
        $this->setAuthenticated(count($roles));

count($roles) is of type integer, but the function expects a boolean.

        $this->institutionConfigurationOptions = $institutionConfigurationOptions;
        $this->schacHomeOrganization = $schacHomeOrganization;
    }

    /**
     * @return InstitutionConfigurationOptions
     */
    public function getInstitutionConfigurationOptions()
    {
        return $this->institutionConfigurationOptions;
    }

    /**
     * @param string $institution
     * @param InstitutionConfigurationOptions $institutionConfigurationOptions
     */
    public function changeInstitutionScope(
        $institution,
        InstitutionConfigurationOptions $institutionConfigurationOptions
    ) {
        if ($this->getUser() === null) {
            throw new LogicException('Cannot change institution scope: token does not contain a user');
        }

        $roles = array_map(function (RoleInterface $role) {
            return $role->getRole();
        }, $this->getRoles());

        if (!in_array('ROLE_SRAA', $roles) && !in_array('ROLE_RAA', $roles) && !in_array('ROLE_RA', $roles)) {
            throw new RuntimeException(sprintf(
                'Unauthorized to change institution scope to "%s": role (S)RA(A) required, found roles "%s"',
                $institution,
                implode(', ', $roles)
            ));
        }

        $this->getUser()->institution = $institution;
        $this->institutionConfigurationOptions = $institutionConfigurationOptions;
    }

    /**
     * Returns the user credentials.
     *
     * @return mixed The user credentials
     */
    public function getCredentials()
    {
        return '';
    }

    /**
     * @return Loa
     */
    public function getLoa()
    {
        return $this->loa;
    }

    public function serialize()
    {
        return serialize(
            [
                parent::serialize(),
                $this->loa,
                $this->institutionConfigurationOptions,
                $this->raManagementInstitution,
                $this->schacHomeOrganization,
            ]
        );
    }

    public function unserialize($serialized)
    {
        list(
            $parent,
            $this->loa,
            $this->institutionConfigurationOptions,
            $this->raManagementInstitution,
            $this->schacHomeOrganization
            ) = unserialize(
                $serialized
            );

        parent::unserialize($parent);
    }

    /**
     * @return string
     */
    public function getRaManagementInstitution()
    {
        if (!$this->raManagementInstitution) {
            return $this->getUser()->institution;
        }
        return $this->raManagementInstitution;
    }

    /**
     * @return string
     */
    public function getSchacHomeInstitution()
    {
        return $this->schacHomeOrganization;
    }

    /**
     * @return string
     */
    public function getIdentityOriginalInstitution()
    {
        if (!$this->isUserSraa()) {
            return $this->getSchacHomeInstitution();
        }

        return $this->getUser()->institution;
    }

    /**
     * @return string

Should the return type not be boolean?

     */
    private function isUserSraa()
    {
        /**
         * @var SamlToken $token
         */
        foreach ($this->getRoles() as $role) {
            if ($role->getRole() == 'ROLE_SRAA') {
                return true;
            }
        }

        return false;
    }
}