Completed
Push — master ( 298ac7...0024da )
by Oleg
12:58
created

PasswordManager::isValid()   B

Complexity

Conditions 4
Paths 8

Size

Total Lines 26
Code Lines 18

Duplication

Lines 0
Ratio 0 %

Code Coverage

Tests 0
CRAP Score 20

Importance

Changes 0
Metric Value
dl 0
loc 26
ccs 0
cts 16
cp 0
rs 8.5806
c 0
b 0
f 0
cc 4
eloc 18
nc 8
nop 2
crap 20
1
<?php
2
declare(strict_types=1);
3
4
namespace SlayerBirden\DataFlowServer\Authentication\Service;
5
6
use Doctrine\Common\Collections\Criteria;
7
use Doctrine\ORM\EntityManager;
8
use Doctrine\ORM\ORMException;
9
use Psr\Log\LoggerInterface;
10
use SlayerBirden\DataFlowServer\Authentication\Entities\Password;
11
use SlayerBirden\DataFlowServer\Authentication\Exception\InvalidCredentialsException;
12
use SlayerBirden\DataFlowServer\Authentication\Exception\PasswordExpiredException;
13
use SlayerBirden\DataFlowServer\Authentication\PasswordManagerInterface;
14
use SlayerBirden\DataFlowServer\Domain\Entities\User;
15
16
class PasswordManager implements PasswordManagerInterface
17
{
18
    /**
19
     * @var EntityManager
20
     */
21
    private $entityManager;
22
    /**
23
     * @var LoggerInterface
24
     */
25
    private $logger;
26
27 4
    public function __construct(EntityManager $entityManager, LoggerInterface $logger)
0 ignored issues
show
Bug introduced by
You have injected the EntityManager via parameter $entityManager. This is generally not recommended as it might get closed and become unusable. Instead, it is recommended to inject the ManagerRegistry and retrieve the EntityManager via getManager() each time you need it.

The EntityManager might become unusable for example if a transaction is rolled back and it gets closed. Let’s assume that somewhere in your application, or in a third-party library, there is code such as the following:

function someFunction(ManagerRegistry $registry) {
    $em = $registry->getManager();
    $em->getConnection()->beginTransaction();
    try {
        // Do something.
        $em->getConnection()->commit();
    } catch (\Exception $ex) {
        $em->getConnection()->rollback();
        $em->close();

        throw $ex;
    }
}

If that code throws an exception and the EntityManager is closed. Any other code which depends on the same instance of the EntityManager during this request will fail.

On the other hand, if you instead inject the ManagerRegistry, the getManager() method guarantees that you will always get a usable manager instance.

Loading history...
28
    {
29 4
        $this->entityManager = $entityManager;
30 4
        $this->logger = $logger;
31 4
    }
32
33
    public function isValid(string $password, User $user): bool
34
    {
35
        try {
36
            $results = $this->entityManager
37
                ->getRepository(Password::class)
38
                ->matching(
39
                    Criteria::create()
40
                        ->where(Criteria::expr()->eq('owner', $user))
41
                        ->andWhere(Criteria::expr()->eq('active', true))
42
                );
43
            if ($results->count()) {
44
                /** @var Password $pw */
45
                $pw = $results->first();
46
                if ($this->isExpired($pw)) {
47
                    throw new PasswordExpiredException('Password is expired.');
48
                }
49
                return password_verify($password, $pw->getHash());
50
            } else {
51
                throw new InvalidCredentialsException('Invalid login/password combination.');
52
            }
53
        } catch (ORMException $exception) {
54
            $this->logger->error((string)$exception);
55
        }
56
57
        return false;
58
    }
59
60
    /**
61
     * @param Password $password
62
     * @return bool
63
     */
64
    private function isExpired(Password $password)
65
    {
66
        return $password->getDue() < new \DateTime();
67
    }
68
69 1
    public function getHash(string $password): string
70
    {
71 1
        return password_hash($password, PASSWORD_DEFAULT);
72
    }
73
}
74