TYPO3\CMS\Backend\Controller\AbstractMfaController

Complexity

Total Complexity

17

Size/Duplication

Total Lines	91
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	0

8 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	9	1
A	getLanguageService()	0	3	1
A	isActionAllowed()	0	3	1
A	isValidIdentifier()	0	5	3
B	initializeMfaConfiguration()	0	25	7
A	isProviderAllowed()	0	3	1
A	getLocalizedProviderTitle()	0	3	2
A	getBackendUser()	0	3	1

<?php

declare(strict_types=1);

/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */

namespace TYPO3\CMS\Backend\Controller;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use TYPO3\CMS\Backend\Routing\UriBuilder;
use TYPO3\CMS\Backend\Template\ModuleTemplate;
use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderManifestInterface;
use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderRegistry;
use TYPO3\CMS\Core\Localization\LanguageService;
use TYPO3\CMS\Core\Utility\GeneralUtility;
use TYPO3\CMS\Extbase\Mvc\View\ViewInterface;

/**
 * Abstract class for mfa controllers (configuration and authentication)
 *
 * @internal This class is a specific Backend controller implementation and is not considered part of the Public TYPO3 API.
 */
abstract class AbstractMfaController
{
    protected ModuleTemplate $moduleTemplate;
    protected UriBuilder $uriBuilder;
    protected MfaProviderRegistry $mfaProviderRegistry;
    protected array $mfaTsConfig;
    protected bool $mfaRequired;
    protected array $allowedProviders;
    protected array $allowedActions = [];
    protected ?MfaProviderManifestInterface $mfaProvider = null;
    protected ?ViewInterface $view = null;

    public function __construct(
        ModuleTemplate $moduleTemplate,
        UriBuilder $uriBuilder,
        MfaProviderRegistry $mfaProviderRegistry
    ) {
        $this->moduleTemplate = $moduleTemplate;
        $this->uriBuilder = $uriBuilder;
        $this->mfaProviderRegistry = $mfaProviderRegistry;
        $this->initializeMfaConfiguration();
    }

    /**
     * Main action for handling the request and returning the response
     *
     * @param ServerRequestInterface $request
     * @return ResponseInterface
     */
    abstract public function handleRequest(ServerRequestInterface $request): ResponseInterface;

    protected function isActionAllowed(string $action): bool
    {
        return in_array($action, $this->allowedActions, true);
    }

    protected function isProviderAllowed(string $identifier): bool
    {
        return isset($this->allowedProviders[$identifier]);
    }

    protected function isValidIdentifier(string $identifier): bool
    {
        return $identifier !== ''
            && $this->isProviderAllowed($identifier)
            && $this->mfaProviderRegistry->hasProvider($identifier);
    }

    public function getLocalizedProviderTitle(): string
    {
        return $this->mfaProvider !== null ? $this->getLanguageService()->sL($this->mfaProvider->getTitle()) : '';
    }

    /**
     * Initialize MFA configuration based on TSconfig and global configuration
     */
    protected function initializeMfaConfiguration(): void
    {
        $this->mfaTsConfig = $this->getBackendUser()->getTSConfig()['auth.']['mfa.'] ?? [];

        // Set up required state based on user TSconfig and global configuration
        if (isset($this->mfaTsConfig['required'])) {
            // user TSconfig overrules global configuration
            $this->mfaRequired = (bool)($this->mfaTsConfig['required'] ?? false);
        } else {
            $globalConfig = (int)($GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa'] ?? 0);
            if ($globalConfig <= 1) {
                // 0 and 1 can directly be used by type-casting to boolean
                $this->mfaRequired = (bool)$globalConfig;
            } else {
                // check the admin / non-admin options
                $isAdmin = $this->getBackendUser()->isAdmin();
                $this->mfaRequired = ($globalConfig === 2 && !$isAdmin) || ($globalConfig === 3 && $isAdmin);
            }
        }

        // Set up allowed providers based on user TSconfig and user groupData
        $this->allowedProviders = array_filter($this->mfaProviderRegistry->getProviders(), function ($identifier) {
            return $this->getBackendUser()->check('mfa_providers', $identifier)
                && !GeneralUtility::inList(($this->mfaTsConfig['disableProviders'] ?? ''), $identifier);
        }, ARRAY_FILTER_USE_KEY);
    }

    protected function getBackendUser(): BackendUserAuthentication
    {
        return $GLOBALS['BE_USER'];
    }

    protected function getLanguageService(): LanguageService
    {
        return $GLOBALS['LANG'];
    }
}