Tiqr_Service::authenticate()

Complexity

Conditions	10
Paths	10

Size

Total Lines	60
Code Lines	33

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	22
CRAP Score	12.4464

Importance

Changes	4
Bugs	0	Features	1

<?php
    public function authenticate(string $userId, string $userSecret, string $sessionKey, string $response): int
    {
        try {
            $state = $this->_getStateValue(self::PREFIX_CHALLENGE, $sessionKey);
            if (is_null($state)) {
                $this->logger->notice('The auth challenge could not be found in the state storage');
                return self::AUTH_RESULT_INVALID_CHALLENGE;
            }
        } catch (Exception $e) {
            $this->logger->error('Error looking up challenge in state storage', array('exception' => $e));
            throw $e;
        }

        $sessionId = $state["sessionId"] ?? NULL;   // Application's sessionId
        $challenge = $state["challenge"] ?? NULL;   // The challenge we sent to the Tiqr client
        if (!is_string($sessionId) || (!is_string($challenge)) ) {
            throw new RuntimeException('Invalid state for state storage');
        }

        // The user ID is optional, it is set when the application requested authentication of a specific userId
        // instead of letting the client decide
        $challengeUserId = $state["userId"] ?? NULL;

        // If the application requested a specific userId, verify that that is that userId that we're now authenticating
        if ($challengeUserId!==NULL && ($userId !== $challengeUserId)) {
            $this->logger->error(
                sprintf('Authentication failed: the requested userId "%s" does not match userId "%s" that is being authenticated',
                $challengeUserId, $userId)
            );
            return self::AUTH_RESULT_INVALID_USERID; // requested and actual userId do not match
        }

        try {
            $equal = $this->_ocraService->verifyResponse($response, $userId, $userSecret, $challenge, $sessionKey);
        } catch (Exception $e) {
            $this->logger->error(sprintf('Error verifying OCRA response for user "%s"', $userId), array('exception' => $e));
            throw $e;
        }

        if ($equal) {
            // Set application session as authenticated
            $this->_setStateValue(self::PREFIX_AUTHENTICATED, $sessionId, $userId, self::LOGIN_EXPIRE);
            $this->logger->notice(sprintf('Authenticated user "%s" in session "%s"', $userId, $sessionId));

            // Cleanup challenge
            // Future authentication attempts with this sessionKey will get a AUTH_RESULT_INVALID_CHALLENGE
            // This QR code / push notification cannot be used again
            // Cleaning up only after successful authentication enables the user to retry authentication after e.g. an
            // invalid response
            try {
                $this->_unsetStateValue(self::PREFIX_CHALLENGE, $sessionKey); // May throw
            } catch (Exception $e) {
                // Only log error
                $this->logger->warning('Could not delete authentication session key', array('error' => $e));
            }

            return self::AUTH_RESULT_AUTHENTICATED;
        }
        $this->logger->error('Authentication failed: invalid response');
        return self::AUTH_RESULT_INVALID_RESPONSE;
    }