1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace yrc\models\redis; |
4
|
|
|
|
5
|
|
|
use Ramsey\Uuid\Uuid; |
6
|
|
|
use Ramsey\Uuid\Exception\UnsatisfiedDependencyException; |
7
|
|
|
|
8
|
|
|
use ncryptf\Utils; |
9
|
|
|
use ncryptf\Keypair; |
10
|
|
|
use ncryptf\middleware\EncryptionKeyInterface; |
|
|
|
|
11
|
|
|
|
12
|
|
|
use yrc\redis\ActiveRecord; |
13
|
|
|
use Yii; |
14
|
|
|
|
15
|
|
|
/** |
16
|
|
|
* Represents a libsodium keypair with an identifiable hash for encrypted requests & responses |
17
|
|
|
* @property integer $id The internal Redis ID for this object |
18
|
|
|
* @property string $hash A UUID1 hash to identify this object publicly |
19
|
|
|
* @property string $secret Secret key material for encryption |
20
|
|
|
* @property string $public Public key material for encryption |
21
|
|
|
* @property string $signing_secret Secret signing key material |
22
|
|
|
* @property string $signing_public Public signing key material |
23
|
|
|
* @property boolean $ephemeral Whether or not this key is single use or not |
24
|
|
|
* @property integer $expires_at The unix timestamp at which this key will expire at and be invalid |
25
|
|
|
*/ |
26
|
|
|
final class EncryptionKey extends ActiveRecord implements EncryptionKeyInterface |
27
|
|
|
{ |
28
|
|
|
/** |
29
|
|
|
* This is our default token lifespan |
30
|
|
|
* @const TOKEN_EXPIRATION_TIME |
31
|
|
|
*/ |
32
|
|
|
const OBJECT_EXPIRATION_TIME = '+15 minutes'; |
33
|
|
|
|
34
|
|
|
/** |
35
|
|
|
* Model attributes |
36
|
|
|
* @return array |
37
|
|
|
*/ |
38
|
|
|
public function attributes() |
39
|
|
|
{ |
40
|
|
|
return [ |
41
|
|
|
'id', |
42
|
|
|
'secret', |
43
|
|
|
'public', |
44
|
|
|
'signing_secret', |
45
|
|
|
'signing_public', |
46
|
|
|
'expires_at', |
47
|
|
|
'ephemeral', |
48
|
|
|
'hash' |
49
|
|
|
]; |
50
|
|
|
} |
51
|
|
|
|
52
|
|
|
/** |
53
|
|
|
* Returns the hash identifier |
54
|
|
|
* |
55
|
|
|
* @return string |
56
|
|
|
*/ |
57
|
|
|
public function getHashIdentifier() : string |
58
|
|
|
{ |
59
|
|
|
return $this->hash; |
60
|
|
|
} |
61
|
|
|
|
62
|
|
|
/** |
63
|
|
|
* Retrieves the box public key |
64
|
|
|
* |
65
|
|
|
* @return string |
66
|
|
|
*/ |
67
|
|
|
public function getBoxPublicKey() : string |
68
|
|
|
{ |
69
|
|
|
return $this->getBoxKeyPair() |
70
|
|
|
->getPublicKey(); |
71
|
|
|
} |
72
|
|
|
|
73
|
|
|
/** |
74
|
|
|
* Retrieves the box secret key |
75
|
|
|
* |
76
|
|
|
* @return string |
77
|
|
|
*/ |
78
|
|
|
public function getBoxSecretKey() : string |
79
|
|
|
{ |
80
|
|
|
return $this->getBoxKeyPair() |
81
|
|
|
->getSecretKey(); |
82
|
|
|
} |
83
|
|
|
|
84
|
|
|
/** |
85
|
|
|
* Retrieves the box keypair |
86
|
|
|
* |
87
|
|
|
* @return Keypair |
88
|
|
|
*/ |
89
|
|
|
public function getBoxKeyPair() : \ncryptf\Keypair |
90
|
|
|
{ |
91
|
|
|
return new \ncryptf\Keypair( |
92
|
|
|
\base64_decode($this->secret), |
93
|
|
|
\base64_decode($this->public) |
94
|
|
|
); |
95
|
|
|
} |
96
|
|
|
|
97
|
|
|
/** |
98
|
|
|
* Retrieves the signing public key |
99
|
|
|
* |
100
|
|
|
* @return string |
101
|
|
|
*/ |
102
|
|
|
public function getSignPublicKey() : string |
103
|
|
|
{ |
104
|
|
|
return $this->getSignKeyPair() |
105
|
|
|
->getPublicKey(); |
106
|
|
|
} |
107
|
|
|
|
108
|
|
|
/** |
109
|
|
|
* Retrieves the signing secret key |
110
|
|
|
* |
111
|
|
|
* @return string |
112
|
|
|
*/ |
113
|
|
|
public function getSignSecretKey() : string |
114
|
|
|
{ |
115
|
|
|
return $this->getSignKeyPair() |
116
|
|
|
->getSecretKey(); |
117
|
|
|
} |
118
|
|
|
|
119
|
|
|
/** |
120
|
|
|
* Retrieves the signing keypair |
121
|
|
|
* |
122
|
|
|
* @return Keypair |
123
|
|
|
*/ |
124
|
|
|
public function getSignKeyPair() : \ncryptf\Keypair |
125
|
|
|
{ |
126
|
|
|
return new \ncryptf\Keypair( |
127
|
|
|
\base64_decode($this->signing_secret), |
128
|
|
|
\base64_decode($this->signing_public) |
129
|
|
|
); |
130
|
|
|
} |
131
|
|
|
|
132
|
|
|
/** |
133
|
|
|
* Returns `true` if the key is ephemeral |
134
|
|
|
* |
135
|
|
|
* @return boolean |
136
|
|
|
*/ |
137
|
|
|
public function isEphemeral() : bool |
138
|
|
|
{ |
139
|
|
|
return $this->ephemeral; |
140
|
|
|
} |
141
|
|
|
|
142
|
|
|
/** |
143
|
|
|
* Retrieves the public key expiration time |
144
|
|
|
* |
145
|
|
|
* @return integer |
146
|
|
|
*/ |
147
|
|
|
public function getPublicKeyExpiration() : int |
148
|
|
|
{ |
149
|
|
|
return $this->expires_at; |
150
|
|
|
} |
151
|
|
|
|
152
|
|
|
/** |
153
|
|
|
* Generates a new EncryptionKeyInterface |
154
|
|
|
* |
155
|
|
|
* @param boolean $ephemeral |
156
|
|
|
* @return EncryptionKeyInterface |
157
|
|
|
*/ |
158
|
|
|
public static function generate($ephemeral = false) : \ncryptf\middleware\EncryptionKeyInterface |
159
|
|
|
{ |
160
|
|
|
$key = Utils::generateKeyPair(); |
161
|
|
|
$signingKey = Utils::generateSigningKeypair(); |
162
|
|
|
|
163
|
|
|
$obj = new static; |
164
|
|
|
$obj->secret = \base64_encode($key->getSecretKey()); |
165
|
|
|
$obj->public = \base64_encode($key->getPublicKey()); |
166
|
|
|
$obj->signing_secret = \base64_encode($signingKey->getSecretKey()); |
167
|
|
|
$obj->signing_public = \base64_encode($signingKey->getPublicKey()); |
168
|
|
|
try { |
169
|
|
|
$uuid = Uuid::uuid1(); |
170
|
|
|
$obj->hash = $uuid->toString(); |
171
|
|
|
} catch (UnsatisfiedDependencyException $e) { |
172
|
|
|
throw new \yii\base\Exception(Yii::t('yrc', 'Failed to securely generate security token')); |
173
|
|
|
} |
174
|
|
|
|
175
|
|
|
$obj->expires_at = \strtotime(static::OBJECT_EXPIRATION_TIME); |
176
|
|
|
$obj->ephemeral = $ephemeral; |
177
|
|
|
if ($obj->save()) { |
178
|
|
|
return $obj; |
179
|
|
|
} |
180
|
|
|
|
181
|
|
|
throw new \yii\base\Exception(Yii::t('yrc', 'Failed to generate security tokens')); |
182
|
|
|
} |
183
|
|
|
} |
184
|
|
|
|
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"]
, you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths