bingo-soft /
jabe
| Total Complexity | 60 |
| Total Lines | 388 |
| Duplicated Lines | 0 % |
| Changes | 1 | ||
| Bugs | 0 | Features | 0 |
Complex classes like DbIdentityServiceProvider often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use DbIdentityServiceProvider, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 34 | class DbIdentityServiceProvider extends DbReadOnlyIdentityServiceProvider implements WritableIdentityProviderInterface |
||
| 35 | { |
||
| 36 | //protected static final IndentityLogger LOG = ProcessEngineLogger.INDENTITY_LOGGER; |
||
| 37 | |||
| 38 | // users //////////////////////////////////////////////////////// |
||
| 39 | |||
| 40 | public function createNewUser(string $userId): UserEntity |
||
| 41 | { |
||
| 42 | $this->checkAuthorization(Permissions::create(), Resources::user(), null); |
||
|
Bug
introduced
by
|
|||
| 43 | return new UserEntity($userId); |
||
| 44 | } |
||
| 45 | |||
| 46 | public function saveUser(UserInterface $user): IdentityOperationResult |
||
| 47 | { |
||
| 48 | $userEntity = $user; |
||
| 49 | |||
| 50 | // encrypt password |
||
| 51 | $userEntity->encryptPassword(); |
||
| 52 | |||
| 53 | $operation = null; |
||
| 54 | if ($userEntity->getRevision() == 0) { |
||
| 55 | $operation = IdentityOperationResult::OPERATION_CREATE; |
||
| 56 | $this->checkAuthorization(Permissions::create(), Resources::user(), null); |
||
| 57 | $this->getDbEntityManager()->insert($userEntity); |
||
| 58 | $this->createDefaultAuthorizations($userEntity); |
||
| 59 | } else { |
||
| 60 | $operation = IdentityOperationResult::OPERATION_UPDATE; |
||
| 61 | $this->checkAuthorization(Permissions::update(), Resources::user(), $user->getId()); |
||
| 62 | $this->getDbEntityManager()->merge($userEntity); |
||
| 63 | } |
||
| 64 | |||
| 65 | return new IdentityOperationResult($userEntity, $operation); |
||
| 66 | } |
||
| 67 | |||
| 68 | public function deleteUser(string $userId): IdentityOperationResult |
||
| 69 | { |
||
| 70 | $this->checkAuthorization(Permissions::delete(), Resources::user(), $userId); |
||
| 71 | $user = $this->findUserById($userId); |
||
| 72 | if ($user != null) { |
||
| 73 | $this->deleteMembershipsByUserId($userId); |
||
| 74 | $this->deleteTenantMembershipsOfUser($userId); |
||
| 75 | |||
| 76 | $this->deleteAuthorizations(Resources::user(), $userId); |
||
| 77 | |||
| 78 | Context::getCommandContext()->runWithoutAuthorization(function () use ($scope, $userId) { |
||
| 79 | $tenants = $scope->createTenantQuery()->userMember($userId)->list(); |
||
| 80 | if (!empty($tenants)) { |
||
| 81 | foreach ($tenants as $tenant) { |
||
| 82 | $scope->deleteAuthorizationsForUser(Resources::tenant(), $tenant->getId(), $userId); |
||
| 83 | } |
||
| 84 | } |
||
| 85 | return null; |
||
| 86 | }); |
||
| 87 | |||
| 88 | $this->getDbEntityManager()->delete($user); |
||
| 89 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_DELETE); |
||
| 90 | } |
||
| 91 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_NONE); |
||
| 92 | } |
||
| 93 | |||
| 94 | public function checkPassword(string $userId, string $password): bool |
||
| 95 | { |
||
| 96 | $user = $this->findUserById($userId); |
||
| 97 | if ($user == null || empty($password)) { |
||
| 98 | return false; |
||
| 99 | } |
||
| 100 | |||
| 101 | if ($this->isUserLocked($user)) { |
||
| 102 | return false; |
||
| 103 | } |
||
| 104 | |||
| 105 | if ($this->matchPassword($password, $user)) { |
||
| 106 | $this->unlockUser($user); |
||
| 107 | return true; |
||
| 108 | } else { |
||
| 109 | $this->lockUser($user); |
||
| 110 | return false; |
||
| 111 | } |
||
| 112 | } |
||
| 113 | |||
| 114 | protected function isUserLocked(UserEntity $user): bool |
||
| 115 | { |
||
| 116 | $processEngineConfiguration = Context::getProcessEngineConfiguration(); |
||
| 117 | |||
| 118 | $maxAttempts = $processEngineConfiguration->getLoginMaxAttempts(); |
||
| 119 | $attempts = $user->getAttempts(); |
||
| 120 | |||
| 121 | if ($attempts >= $maxAttempts) { |
||
| 122 | return true; |
||
| 123 | } |
||
| 124 | |||
| 125 | $lockExpirationTime = $user->getLockExpirationTime(); |
||
| 126 | $currentTime = ClockUtil::getCurrentTime(); |
||
| 127 | |||
| 128 | return $lockExpirationTime !== null && (new \DateTime($lockExpirationTime)) > $currentTime; |
||
| 129 | } |
||
| 130 | |||
| 131 | protected function lockUser(UserEntity $user): void |
||
| 132 | { |
||
| 133 | $processEngineConfiguration = Context::getProcessEngineConfiguration(); |
||
| 134 | |||
| 135 | $max = $processEngineConfiguration->getLoginDelayMaxTime(); |
||
| 136 | $baseTime = $processEngineConfiguration->getLoginDelayBase(); |
||
| 137 | $factor = $processEngineConfiguration->getLoginDelayFactor(); |
||
| 138 | $attempts = $user->getAttempts() + 1; |
||
| 139 | |||
| 140 | $delay = $baseTime * pow($factor, $attempts - 1); |
||
| 141 | $delay = min($delay, $max); |
||
| 142 | |||
| 143 | $currentTime = ClockUtil::getCurrentTime()->getTimestamp(); |
||
| 144 | $lockExpirationTime = (new \DateTime())->setTimestamp($currentTime + $delay); |
||
| 145 | |||
| 146 | if ($attempts >= $processEngineConfiguration->getLoginMaxAttempts()) { |
||
| 147 | //LOG.infoUserPermanentlyLocked(user.getId()); |
||
| 148 | } else { |
||
| 149 | //LOG.infoUserTemporarilyLocked(user.getId(), lockExpirationTime); |
||
| 150 | } |
||
| 151 | |||
| 152 | $this->getIdentityInfoManager()->updateUserLock($user, $attempts, $lockExpirationTime); |
||
| 153 | } |
||
| 154 | |||
| 155 | public function unlockUser($userOrUserId): IdentityOperationResult |
||
| 156 | { |
||
| 157 | if (is_string($userOrUserId)) { |
||
| 158 | $user = $this->findUserById($userOrUserId); |
||
| 159 | if ($user != null) { |
||
| 160 | return $this->unlockUser($user); |
||
| 161 | } |
||
| 162 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_NONE); |
||
| 163 | } elseif ($userOrUserId instanceof UserEntity) { |
||
| 164 | if ($user->getAttempts() > 0 || $user->getLockExpirationTime() !== null) { |
||
| 165 | $this->getIdentityInfoManager()->updateUserLock($user, 0, null); |
||
| 166 | return new IdentityOperationResult($user, IdentityOperationResult::OPERATION_UNLOCK); |
||
| 167 | } |
||
| 168 | return new IdentityOperationResult($user, IdentityOperationResult::OPERATION_NONE); |
||
| 169 | } |
||
| 170 | } |
||
| 171 | |||
| 172 | // groups //////////////////////////////////////////////////////// |
||
| 173 | |||
| 174 | public function createNewGroup(string $groupId): GroupEntity |
||
| 175 | { |
||
| 176 | $this->checkAuthorization(Permissions::create(), Resources::group(), null); |
||
| 177 | return new GroupEntity($groupId); |
||
| 178 | } |
||
| 179 | |||
| 180 | public function saveGroup(GroupInterface $group): IdentityOperationResult |
||
| 181 | { |
||
| 182 | $groupEntity = $group; |
||
| 183 | $operation = null; |
||
| 184 | if ($groupEntity->getRevision() == 0) { |
||
| 185 | $operation = IdentityOperationResult::OPERATION_CREATE; |
||
| 186 | $this->checkAuthorization(Permissions::create(), Resources::group(), null); |
||
| 187 | $this->getDbEntityManager()->insert($groupEntity); |
||
| 188 | $this->createDefaultAuthorizations($group); |
||
| 189 | } else { |
||
| 190 | $operation = IdentityOperationResult::OPERATION_UPDATE; |
||
| 191 | $this->checkAuthorization(Permissions::update(), Resources::group(), $group->getId()); |
||
| 192 | $this->getDbEntityManager()->merge($groupEntity); |
||
| 193 | } |
||
| 194 | return new IdentityOperationResult($groupEntity, $operation); |
||
| 195 | } |
||
| 196 | |||
| 197 | public function deleteGroup(string $groupId): IdentityOperationResult |
||
| 198 | { |
||
| 199 | $this->checkAuthorization(Permissions::delete(), Resources::group(), $groupId); |
||
| 200 | $group = $this->findGroupById($groupId); |
||
| 201 | if ($group !== null) { |
||
| 202 | $this->deleteMembershipsByGroupId($groupId); |
||
| 203 | $this->deleteTenantMembershipsOfGroup($groupId); |
||
| 204 | |||
| 205 | $this->deleteAuthorizations(Resources::group(), $groupId); |
||
| 206 | |||
| 207 | $scope = $this; |
||
| 208 | Context::getCommandContext()->runWithoutAuthorization(function () use ($scope, $groupId) { |
||
| 209 | $tenants = $scope->createTenantQuery()->groupMember($groupId)->list(); |
||
| 210 | if (!empty($tenants)) { |
||
| 211 | foreach ($tenants as $tenant) { |
||
| 212 | $this->deleteAuthorizationsForGroup(Resources::tenant(), $tenant->getId(), $groupId); |
||
| 213 | } |
||
| 214 | } |
||
| 215 | return null; |
||
| 216 | }); |
||
| 217 | $this->getDbEntityManager()->delete(group); |
||
| 218 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_DELETE); |
||
| 219 | } |
||
| 220 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_NONE); |
||
| 221 | } |
||
| 222 | |||
| 223 | // tenants ////////////////////////////////////////////////////// |
||
| 224 | |||
| 225 | public function createNewTenant(string $tenantId): TenantInterface |
||
| 226 | { |
||
| 227 | $this->checkAuthorization(Permissions::create(), Resources::tenant(), null); |
||
| 228 | return new TenantEntity($tenantId); |
||
| 229 | } |
||
| 230 | |||
| 231 | public function saveTenant(TenantInterface $tenant): IdentityOperationResult |
||
| 232 | { |
||
| 233 | $tenantEntity = $tenant; |
||
| 234 | $operation = null; |
||
| 235 | if ($tenantEntity->getRevision() == 0) { |
||
| 236 | $operation = IdentityOperationResult::OPERATION_CREATE; |
||
| 237 | $this->checkAuthorization(Permissions::create(), Resources::tenant(), null); |
||
| 238 | $this->getDbEntityManager()->insert($tenantEntity); |
||
| 239 | $this->createDefaultAuthorizations($tenant); |
||
| 240 | } else { |
||
| 241 | $operation = IdentityOperationResult::OPERATION_UPDATE; |
||
| 242 | $this->checkAuthorization(Permissions::update(), Resources::tenant(), $tenant->getId()); |
||
| 243 | $this->getDbEntityManager()->merge($tenantEntity); |
||
| 244 | } |
||
| 245 | return new IdentityOperationResult($tenantEntity, $operation); |
||
| 246 | } |
||
| 247 | |||
| 248 | public function deleteTenant(string $tenantId): IdentityOperationResult |
||
| 249 | { |
||
| 250 | $this->checkAuthorization(Permissions::delete(), Resources::tenant(), $tenantId); |
||
| 251 | $tenant = $this->findTenantById($tenantId); |
||
| 252 | if ($tenant !== null) { |
||
| 253 | $this->deleteTenantMembershipsOfTenant($tenantId); |
||
| 254 | $this->deleteAuthorizations(Resources::tenant(), $tenantId); |
||
| 255 | $this->getDbEntityManager()->delete($tenant); |
||
| 256 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_DELETE); |
||
| 257 | } |
||
| 258 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_NONE); |
||
| 259 | } |
||
| 260 | |||
| 261 | // membership ////////////////////////////////////////////////////// |
||
| 262 | |||
| 263 | public function createMembership(string $userId, string $groupId): IdentityOperationResult |
||
| 264 | { |
||
| 265 | $this->checkAuthorization(Permissions::create(), Resources::groupMembership(), $groupId); |
||
| 266 | $user = $this->findUserById($userId); |
||
| 267 | EnsureUtil::ensureNotNull("No user found with id '" . $userId . "'.", "user", $user); |
||
| 268 | $group = $this->findGroupById($groupId); |
||
| 269 | EnsureUtil::ensureNotNull("No group found with id '" . $groupId . "'.", "group", $group); |
||
| 270 | $membership = new MembershipEntity(); |
||
| 271 | $membership->setUser($user); |
||
| 272 | $membership->setGroup($group); |
||
| 273 | $this->getDbEntityManager()->insert($membership); |
||
| 274 | $this->createDefaultMembershipAuthorizations($userId, $groupId); |
||
| 275 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_CREATE); |
||
| 276 | } |
||
| 277 | |||
| 278 | public function deleteMembership(string $userId, string $groupId): IdentityOperationResult |
||
| 279 | { |
||
| 280 | $this->checkAuthorization(Permissions::delete(), Resources::groupMembership(), $groupId); |
||
| 281 | if ($this->existsMembership($userId, $groupId)) { |
||
| 282 | $this->deleteAuthorizations(Resources::groupMembership(), $groupId); |
||
| 283 | $parameters = []; |
||
| 284 | $parameters["userId"] = $userId; |
||
| 285 | $parameters["groupId"] = $groupId; |
||
| 286 | $this->getDbEntityManager()->delete(MembershipEntity::class, "deleteMembership", $parameters); |
||
| 287 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_DELETE); |
||
| 288 | } |
||
| 289 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_NONE); |
||
| 290 | } |
||
| 291 | |||
| 292 | protected function deleteMembershipsByUserId(string $userId): void |
||
| 293 | { |
||
| 294 | $this->getDbEntityManager()->delete(MembershipEntity::class, "deleteMembershipsByUserId", $userId); |
||
| 295 | } |
||
| 296 | |||
| 297 | protected function deleteMembershipsByGroupId(string $groupId): void |
||
| 298 | { |
||
| 299 | $this->getDbEntityManager()->delete(MembershipEntity::class, "deleteMembershipsByGroupId", $groupId); |
||
| 300 | } |
||
| 301 | |||
| 302 | public function createTenantUserMembership(string $tenantId, string $userId): IdentityOperationResult |
||
| 303 | { |
||
| 304 | $this->checkAuthorization(Permissions::create(), Resources::tenantMembership(), $tenantId); |
||
| 305 | |||
| 306 | $tenant = $this->findTenantById($tenantId); |
||
| 307 | $user = $this->findUserById($userId); |
||
| 308 | |||
| 309 | EnsureUtil::ensureNotNull("No tenant found with id '" . $tenantId . "'.", "tenant", $tenant); |
||
| 310 | EnsureUtil::ensureNotNull("No user found with id '" . $userId . "'.", "user", $user); |
||
| 311 | |||
| 312 | $membership = new TenantMembershipEntity(); |
||
| 313 | $membership->setTenant($tenant); |
||
| 314 | $membership->setUser($user); |
||
| 315 | |||
| 316 | $this->getDbEntityManager()->insert($membership); |
||
| 317 | |||
| 318 | $this->createDefaultTenantMembershipAuthorizations($tenant, $user); |
||
| 319 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_CREATE); |
||
| 320 | } |
||
| 321 | |||
| 322 | public function createTenantGroupMembership(string $tenantId, string $groupId): IdentityOperationResult |
||
| 323 | { |
||
| 324 | $this->checkAuthorization(Permissions::create(), Resources::tenantMembership(), $tenantId); |
||
| 325 | |||
| 326 | $tenant = $this->findTenantById($tenantId); |
||
| 327 | $group = $this->findGroupById($groupId); |
||
| 328 | |||
| 329 | EnsureUtil::ensureNotNull("No tenant found with id '" . $tenantId . "'.", "tenant", $tenant); |
||
| 330 | EnsureUtil::ensureNotNull("No group found with id '" . $groupId . "'.", "group", $group); |
||
| 331 | |||
| 332 | $membership = new TenantMembershipEntity(); |
||
| 333 | $membership->setTenant($tenant); |
||
| 334 | $membership->setGroup($group); |
||
| 335 | |||
| 336 | $this->getDbEntityManager()->insert($membership); |
||
| 337 | |||
| 338 | $this->createDefaultTenantMembershipAuthorizations($tenant, $group); |
||
| 339 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_CREATE); |
||
| 340 | } |
||
| 341 | |||
| 342 | public function deleteTenantUserMembership(string $tenantId, string $userId): IdentityOperationResult |
||
| 357 | } |
||
| 358 | |||
| 359 | public function deleteTenantGroupMembership(string $tenantId, string $groupId): IdentityOperationResult |
||
| 360 | { |
||
| 361 | $this->checkAuthorization(Permissions::delete(), Resources::tenantMembership(), $tenantId); |
||
| 362 | |||
| 363 | if ($this->existsTenantMembership($tenantId, null, $groupId)) { |
||
| 364 | $this->deleteAuthorizations(Resources::tenantMembership(), $groupId); |
||
| 365 | |||
| 366 | $this->deleteAuthorizationsForGroup(Resources::tenant(), $tenantId, $groupId); |
||
| 367 | |||
| 368 | $parameters = []; |
||
| 369 | $parameters["tenantId"] = $tenantId; |
||
| 370 | $parameters["groupId"] = $groupId; |
||
| 371 | $this->getDbEntityManager()->delete(TenantMembershipEntity::class, "deleteTenantMembership", $parameters); |
||
| 372 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_DELETE); |
||
| 373 | } |
||
| 374 | return new IdentityOperationResult(null, IdentityOperationResult::OPERATION_NONE); |
||
| 375 | } |
||
| 376 | |||
| 377 | protected function deleteTenantMembershipsOfUser(string $userId): void |
||
| 378 | { |
||
| 379 | $this->getDbEntityManager()->delete(TenantMembershipEntity::class, "deleteTenantMembershipsOfUser", $userId); |
||
| 380 | } |
||
| 381 | |||
| 382 | protected function deleteTenantMembershipsOfGroup(string $groupId): void |
||
| 383 | { |
||
| 384 | $this->getDbEntityManager()->delete(TenantMembershipEntity::class, "deleteTenantMembershipsOfGroup", $groupId); |
||
| 385 | } |
||
| 386 | |||
| 387 | protected function deleteTenantMembershipsOfTenant(string $tenant): void |
||
| 390 | } |
||
| 391 | |||
| 392 | // authorizations //////////////////////////////////////////////////////////// |
||
| 393 | |||
| 394 | protected function createDefaultAuthorizations(/*UserEntity|GroupInterface|TenantInterface*/$data): void |
||
| 395 | { |
||
| 396 | if ($data instanceof UserEntity) { |
||
| 397 | if (Context::getProcessEngineConfiguration()->isAuthorizationEnabled()) { |
||
| 398 | $this->saveDefaultAuthorizations($this->getResourceAuthorizationProvider()->newUser($data)); |
||
| 399 | } |
||
| 400 | } elseif ($data instanceof GroupInterface) { |
||
| 401 | if ($this->AuthorizationEnabled()) { |
||
| 402 | $this->saveDefaultAuthorizations($this->getResourceAuthorizationProvider()->newGroup($data)); |
||
| 403 | } |
||
| 404 | } elseif ($data instanceof TenantInterface) { |
||
| 405 | if ($this->AuthorizationEnabled()) { |
||
| 406 | $this->saveDefaultAuthorizations($this->getResourceAuthorizationProvider()->newTenant($data)); |
||
| 407 | } |
||
| 408 | } |
||
| 409 | } |
||
| 410 | |||
| 411 | protected function createDefaultMembershipAuthorizations(string $userId, string $groupId): void |
||
| 415 | } |
||
| 416 | } |
||
| 417 | |||
| 418 | protected function createDefaultTenantMembershipAuthorizations(TenantInterface $tenant, /*UserInterface|GroupInterface*/$data): void |
||
| 419 | { |
||
| 420 | if ($this->AuthorizationEnabled()) { |
||
| 421 | $this->saveDefaultAuthorizations($this->getResourceAuthorizationProvider()->tenantMembershipCreated($tenant, $data)); |
||
| 422 | } |
||
| 423 | } |
||
| 424 | } |
||
| 425 |
Loading history...