Surfnet\YubikeyApiClient\Crypto\Signer

Complexity

Total Complexity

8

Size/Duplication

Total Lines	86
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	1

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	12	4
A	sign()	0	9	1
A	verifySignature()	0	10	1
A	buildQueryString()	0	10	2

<?php

/**
 * Copyright 2014 SURFnet bv
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Surfnet\YubikeyApiClient\Crypto;

use Surfnet\YubikeyApiClient\Exception\InvalidArgumentException;

class Signer
{
    /**
     * @var array Valid parameters in the response message
     */
    private static $validResponseParams = [
        'nonce',
        'otp',
        'sessioncounter',
        'sessionuse',
        'sl',
        'status',
        't',
        'timeout',
        'timestamp'
    ];

    /**
     * @var string The base64-decoded client secret
     */
    private $clientSecret;

    /**
     * @param string $clientSecret The base64-encoded client secret
     */
    public function __construct($clientSecret)
    {
        if (!is_string($clientSecret)) {
            throw new InvalidArgumentException('Client secret must be string.');
        }

        $this->clientSecret = base64_decode($clientSecret);

        if (!is_string($this->clientSecret) || base64_encode($this->clientSecret) !== $clientSecret) {
            throw new InvalidArgumentException('Given client secret is not a base64-decodable string.');
        }
    }

    /**
     * Signs an array by calculating a signature and setting it on the 'h' key.
     *
     * @param array $data
     * @return array
     */
    public function sign(array $data)
    {
        ksort($data);

        $queryString = $this->buildQueryString($data);
        $data['h'] = base64_encode(hash_hmac('sha1', $queryString, $this->clientSecret, true));

        return $data;
    }

    /**
     * Verifies that the signature in the 'h' key matches the expected signature.
     *
     * @param array $data
     * @return bool
     */
    public function verifySignature(array $data)
    {
        $signedData = array_intersect_key($data, array_flip(self::$validResponseParams));
        ksort($signedData);

        $queryString = $this->buildQueryString($signedData);
        $signature = base64_encode(hash_hmac('sha1', $queryString, $this->clientSecret, true));

        return hash_equals($signature, $data['h']);
    }

    /**
     * @param array $query
     * @return string
     */
    private function buildQueryString(array $query)
    {
        $queryString = '';

        foreach ($query as $key => $value) {
            $queryString .= '&' . sprintf('%s=%s', $key, $value);
        }

        return substr($queryString, 1);
    }
}