yrc\filters\auth\HMACSignatureAuth

Complexity

Total Complexity

16

Size/Duplication

Total Lines	103
Duplicated Lines	0 %

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	beforeAction()	0	7	2
A	getBodyFromRequest()	0	12	3
A	getTokenFromAccessToken()	0	16	4
B	authenticate()	0	35	7

<?php

namespace yrc\filters\auth;

use DateTime;
use ncryptf\Authorization;
use ncryptf\Token as NcryptfToken;
use yrc\models\redis\Token;
use yii\helpers\Json;
use yii\filters\auth\AuthMethod;
use yii\web\HttpException;
use yii\web\Request;
use yii\web\Response;
use Yii;

/**
 * HeaderParamAuth is an action filter that supports the authentication based on the access token passed through a query parameter.
 */
final class HMACSignatureAuth extends AuthMethod
{
    // The date header
    const DATE_HEADER = 'X-DATE';
    
    // The authorization header
    const AUTHORIZATION_HEADER = 'Authorization';
    
    // The amount of the seconds the request is permitted to differ from the server time
    const DRIFT_TIME_ALLOWANCE = 90;

    /**
     * @inheritdoc
     */
    public function beforeAction($action)
    {
        if (Yii::$app->request->method === 'OPTIONS') {
            return true;
        }

        return parent::beforeAction($action);
    }

    /**
     * @inheritdoc
     */
    public function authenticate($user, $request, $response)
    {
        $params = Authorization::extractParamsFromHeaderString($request->getHeaders()->get(self::AUTHORIZATION_HEADER));

        if ($params) {
            if ($token = $this->getTokenFromAccessToken($params['access_token'])) {
                try {
                    $date = new DateTime($params['date'] ?? $request->getHeaders()->get(self::DATE_HEADER));
                    $auth = new Authorization(
                        $request->method,
                        $request->getUrl(),
                        $token->getNcryptfToken(),
                        $date,
                        $this->getBodyFromRequest($request),
                        $params['v'],
                        \base64_decode($params['salt'])
                    );

                    if ($auth->verify(\base64_decode($params['hmac']), $auth, static::DRIFT_TIME_ALLOWANCE)) {
                        if ($identity = $user->loginByAccessToken($token, \get_class($this))) {
                            return $identity;
                        }
                    }
                } catch (HttpException $e) {
                    throw $e;
                } catch (\Exception $e) {
                    Yii::error([
                        'message' => 'An unexpected error occured when handling authentication request.',
                        'exception' => $e
                    ]);
                }
            }
        }

        $this->handleFailure($response);
    }

    /**
     * Retrieves a Token object from an access token string
     * @param string $accessToken
     * @return \yrc\models\redis\Token
     */
    private function getTokenFromAccessToken(string $accessToken)
    {
        try {
            $tokenClass = (Yii::$app->user->identityClass::TOKEN_CLASS);
            $token = $tokenClass::find()
                ->where(['access_token' => $accessToken])
                ->one();
        } catch (\Exception $e) {
            return null;
        }

        if ($token === null || $token->isExpired()) {
            return null;
        }

        return $token;
    }

    /**
     * Retrieves the appropriate request body
     * @param \yii\web\Request $request
     * @return mixed
     */
    private function getBodyFromRequest(Request $request)
    {
        $body = $request->getDecryptedBody();
        if ($body === '') {
            return "";
        }

        if ($request->headers->has('X-Force-Serialize')) {
            return Json::encode(Json::decode($body), JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRESERVE_ZERO_FRACTION);
        }

        return $body;
    }
}