kalanis\Restful\Security\Authentication\TimeoutAuthenticator

Complexity

Total Complexity

5

Size/Duplication

Total Lines	33
Duplicated Lines	0 %

Test Coverage

Coverage

90.91%

Importance

Changes

0

2 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	5	1
A	authenticate()	0	14	4

<?php

namespace kalanis\Restful\Security\Authentication;


use kalanis\Restful\Http\IInput;
use kalanis\Restful\Security\Exceptions\RequestTimeoutException;


/**
 * Verify request timeout to avoid replay attack (needs to be applied with any HashAuthenticator)
 * @package kalanis\Restful\Security\Authentication
 */
class TimeoutAuthenticator implements IRequestAuthenticator
{

    /**
     * @param string $requestTimeKey in user request data
     * @param int $timeout in milliseconds
     */
    public function __construct(
        #[\SensitiveParameter] private readonly string $requestTimeKey,
        private readonly int                           $timeout,
    )
    {
    }

    /**
     * Authenticate request timeout
     *
     * @throws RequestTimeoutException
     */
    public function authenticate(IInput $input): bool
    {
        $timestamp = time();
        $data = $input->getData();
        if (!isset($data[$this->requestTimeKey]) || !$data[$this->requestTimeKey]) {
            throw new RequestTimeoutException('Request time not found in requested data.');
        }

        $diff = $timestamp - $data[$this->requestTimeKey];
        if ($diff > $this->timeout) {
            throw new RequestTimeoutException('Request timeout');
        }

        return true;
    }
}