Spomky-Labs /
u2f-php
| Conditions | 18 |
| Paths | 16 |
| Total Lines | 90 |
| Code Lines | 41 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 28 | public function check(string $credentialId, AuthenticatorAssertionResponse $authenticatorAssertionResponse, PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions, ?string $rpId = null): void |
||
| 29 | { |
||
| 30 | /* @see 7.2.1 */ |
||
| 31 | if (!$this->isCredentialIdAllowed($credentialId, $publicKeyCredentialRequestOptions->getAllowCredentials())) { |
||
| 32 | throw new \InvalidArgumentException('The credential ID is not allowed.'); |
||
| 33 | } |
||
| 34 | /* @see 7.2.2 */ |
||
| 35 | if (null !== $authenticatorAssertionResponse->getUserHandle()) { |
||
| 36 | throw new \RuntimeException('Not supported.'); //TODO: implementation shall be done. |
||
| 37 | } |
||
| 38 | |||
| 39 | /* @see 7.2.3 */ |
||
| 40 | if (!$this->credentialRepository->hasCredential($credentialId)) { |
||
| 41 | throw new \InvalidArgumentException('No credential public key available for the given credential ID.'); |
||
| 42 | } |
||
| 43 | $credentialPublicKey = $this->credentialRepository->getCredentialPublicKey($credentialId); |
||
| 44 | |||
| 45 | /** @see 7.2.4 */ |
||
| 46 | /** @see 7.2.5 */ |
||
| 47 | //Nothing to do. Use of objets directly |
||
| 48 | |||
| 49 | /** @see 7.2.6 */ |
||
| 50 | $C = $authenticatorAssertionResponse->getClientDataJSON(); |
||
| 51 | |||
| 52 | /* @see 7.2.7 */ |
||
| 53 | if ('webauthn.get' !== $C->getType()) { |
||
| 54 | throw new \InvalidArgumentException('The client data type is not "webauthn.get".'); |
||
| 55 | } |
||
| 56 | |||
| 57 | /* @see 7.2.8 */ |
||
| 58 | if (hash_equals($publicKeyCredentialRequestOptions->getChallenge(), $C->getChallenge())) { |
||
| 59 | throw new \InvalidArgumentException('Invalid challenge.'); |
||
| 60 | } |
||
| 61 | |||
| 62 | /** @see 7.2.9 */ |
||
| 63 | $rpId = $rpId ?? $publicKeyCredentialRequestOptions->getRpId(); |
||
| 64 | if (null === $rpId) { |
||
| 65 | throw new \InvalidArgumentException('No rpId.'); |
||
| 66 | } |
||
| 67 | $parsedRelyingPartyId = parse_url($C->getOrigin()); |
||
| 68 | if (!array_key_exists('host', $parsedRelyingPartyId) || !\is_string($parsedRelyingPartyId['host'])) { |
||
| 69 | throw new \InvalidArgumentException('Invalid origin rpId.'); |
||
| 70 | } |
||
| 71 | if ($parsedRelyingPartyId['host'] !== $rpId) { |
||
| 72 | throw new \InvalidArgumentException('rpId mismatch.'); |
||
| 73 | } |
||
| 74 | |||
| 75 | /* @see 7.2.10 */ |
||
| 76 | if ($C->getTokenBinding()) { |
||
| 77 | throw new \InvalidArgumentException('Token binding not supported.'); |
||
| 78 | } |
||
| 79 | |||
| 80 | /** @see 7.2.11 */ |
||
| 81 | $rpIdHash = hash('sha256', $rpId, true); |
||
| 82 | if (!hash_equals($rpIdHash, $authenticatorAssertionResponse->getAuthenticatorData()->getRpIdHash())) { |
||
| 83 | throw new \InvalidArgumentException('rpId hash mismatch.'); |
||
| 84 | } |
||
| 85 | |||
| 86 | /* @see 7.2.12 */ |
||
| 87 | if (!$authenticatorAssertionResponse->getAuthenticatorData()->isUserPresent()) { |
||
| 88 | throw new \InvalidArgumentException('User was not present'); |
||
| 89 | } |
||
| 90 | |||
| 91 | /* @see 7.2.13 */ |
||
| 92 | if (AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_REQUIRED === $publicKeyCredentialRequestOptions->getUserVerification() && !$authenticatorAssertionResponse->getAuthenticatorData()->isUserVerified()) { |
||
| 93 | throw new \InvalidArgumentException('User authentication required.'); |
||
| 94 | } |
||
| 95 | |||
| 96 | /* @see 7.2.14 */ |
||
| 97 | if (0 !== $publicKeyCredentialRequestOptions->getExtensions()->count()) { |
||
| 98 | throw new \InvalidArgumentException('Extensions not supported.'); |
||
| 99 | } |
||
| 100 | |||
| 101 | /** @see 7.2.15 */ |
||
| 102 | $getClientDataJSONHash = hash('sha256', $authenticatorAssertionResponse->getClientDataJSON()->getRawData(), true); |
||
| 103 | |||
| 104 | /* @see 7.2.16 */ |
||
| 105 | $coseKey = $credentialPublicKey->getNormalizedData(); |
||
| 106 | $key = "\04".$coseKey[-2].$coseKey[-3]; |
||
| 107 | if (1 !== openssl_verify($authenticatorAssertionResponse->getAuthenticatorData()->getAuthData().$getClientDataJSONHash, $authenticatorAssertionResponse->getSignature(), $this->getPublicKeyAsPem($key), OPENSSL_ALGO_SHA256)) { |
||
| 108 | throw new \InvalidArgumentException('Invalid signature.'); |
||
| 109 | } |
||
| 110 | |||
| 111 | /* @see 7.2.17 */ |
||
| 112 | $storedCounter = $this->credentialRepository->getCredentialCounter($credentialId); |
||
| 113 | $currentCounter = $authenticatorAssertionResponse->getAuthenticatorData()->getSignCount(); |
||
| 114 | if ($storedCounter >= $currentCounter) { |
||
| 115 | throw new \InvalidArgumentException('Invalid counter.'); |
||
| 116 | } |
||
| 117 | $this->credentialRepository->updateCredentialCounter($credentialId, $currentCounter); |
||
| 118 | |||
| 147 |
