ConnectionsModule::verifyConnection() - Code Metrics - Inspection of "implement user notifications" - eduVPN/vpn-server-api - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( fee13a...c03827 )

by François

created 2016-12-13 10:49 UTC

ConnectionsModule::verifyConnection() B

↳ Parent: ConnectionsModule

Complexity

Conditions	4
Paths	4

Size

Total Lines	24
Code Lines	12

Duplication

Lines	12
Ratio	50 %

Importance

Changes

Metric	Value
dl	12
loc	24
rs	8.6845
c	0
b	0
f	0
cc	4
eloc	12
nc	4
nop	2

<?php
/**
 *  Copyright (C) 2016 SURFnet.
 *
 *  This program is free software: you can redistribute it and/or modify
 *  it under the terms of the GNU Affero General Public License as
 *  published by the Free Software Foundation, either version 3 of the
 *  License, or (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU Affero General Public License for more details.
 *
 *  You should have received a copy of the GNU Affero General Public License
 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

namespace SURFnet\VPN\Server\Api;

use DateTime;
use SURFnet\VPN\Common\Config;
use SURFnet\VPN\Common\Http\ApiErrorResponse;
use SURFnet\VPN\Common\Http\ApiResponse;
use SURFnet\VPN\Common\Http\AuthUtils;
use SURFnet\VPN\Common\Http\InputValidation;
use SURFnet\VPN\Common\Http\Request;
use SURFnet\VPN\Common\Http\Service;
use SURFnet\VPN\Common\Http\ServiceModuleInterface;
use SURFnet\VPN\Common\ProfileConfig;
use SURFnet\VPN\Server\Exception\TwoFactorException;
use SURFnet\VPN\Server\Storage;
use SURFnet\VPN\Server\TwoFactor;

class ConnectionsModule implements ServiceModuleInterface
{
    /** @var \SURFnet\VPN\Common\Config */
    private $config;

    /** @var \SURFnet\VPN\Server\Storage */
    private $storage;

    /** @var array */
    private $groupProviders;

    public function __construct(Config $config, Storage $storage, array $groupProviders)
    {
        $this->config = $config;
        $this->storage = $storage;
        $this->groupProviders = $groupProviders;
    }

    public function init(Service $service)
    {
        $service->post(
            '/connect',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->connect($request);
            }
        );

        $service->post(
            '/disconnect',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->disconnect($request);
            }
        );

        $service->post(
            '/verify_otp',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->verifyOtp($request);
            }
        );
    }

    public function connect(Request $request)
    {
        $profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
        $ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
        $connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));

        if (true !== $response = $this->verifyConnection($profileId, $commonName)) {
            return $response;
        }

        // XXX is this still relevant?
        if (false == $this->storage->clientConnect($profileId, $commonName, $ip4, $ip6, $connectedAt)) {

            return new ApiErrorResponse('connect', 'unable to write connect event to log');
        }

        return new ApiResponse('connect');
    }

    public function disconnect(Request $request)
    {
        $profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
        $ip6 = InputValidation::ip6($request->getPostParameter('ip6'));

        $connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
        $disconnectedAt = InputValidation::disconnectedAt($request->getPostParameter('disconnected_at'));
        $bytesTransferred = InputValidation::bytesTransferred($request->getPostParameter('bytes_transferred'));

        if (false === $this->storage->clientDisconnect($profileId, $commonName, $ip4, $ip6, $connectedAt, $disconnectedAt, $bytesTransferred)) {
            return new ApiErrorResponse('disconnect', 'unable to write disconnect event to log');
        }

        return new ApiResponse('disconnect');
    }

    public function verifyOtp(Request $request)

    {
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        // we do not need 'otp_type', as only 'totp' is supported at the moment
        InputValidation::otpType($request->getPostParameter('otp_type'));
        $totpKey = InputValidation::totpKey($request->getPostParameter('totp_key'));

        $certInfo = $this->storage->getUserCertificateInfo($commonName);
        $userId = $certInfo['user_id'];

        $twoFactor = new TwoFactor($this->storage, new DateTime('now'));
        try {
            $twoFactor->verifyTotp($userId, $totpKey);
        } catch (TwoFactorException $e) {
            return new ApiErrorResponse('verify_otp', $e->getMessage());
        }

        return new ApiResponse('verify_otp');
    }

    private function verifyConnection($profileId, $commonName)
    {
        // verify status of certificate/user
        if (false === $result = $this->storage->getUserCertificateInfo($commonName)) {
            // if a certificate does no longer exist, we cannot figure out the user
            return new ApiErrorResponse('connect', 'user or certificate does not exist');
        }

        if ($result['user_is_disabled']) {

            $msg = 'unable to connect, user account is disabled';
            $this->storage->addUserMessage($result['user_id'], 'error', $msg, new DateTime('now'));

            return new ApiErrorResponse('connect', $msg);
        }

        if ($result['certificate_is_disabled']) {

            $msg = sprintf('unable to connect, certificate "%s" is disabled', $result['display_name']);
            $this->storage->addUserMessage($result['user_id'], 'error', $msg, new DateTime('now'));

            return new ApiErrorResponse('connect', $msg);
        }

        return $this->verifyAcl($profileId, $result['user_id']);
    }

    private function verifyAcl($profileId, $externalUserId)
    {
        // verify ACL
        $profileConfig = new ProfileConfig($this->config->v('vpnProfiles', $profileId));
        if ($profileConfig->v('enableAcl')) {
            // ACL enabled
            $userGroups = [];
            foreach ($this->groupProviders as $groupProvider) {
                $userGroups = array_merge($userGroups, $groupProvider->getGroups($externalUserId));
            }

            if (false === self::isMember($userGroups, $profileConfig->v('aclGroupList'))) {
                $msg = 'unable to connect, user not in ACL';
                $this->storage->addUserMessage($externalUserId, 'error', $msg, new DateTime('now'));

                return new ApiErrorResponse('connect', $msg);
            }
        }

        return true;
    }

    private static function isMember(array $memberOf, array $aclGroupList)
    {
        // one of the groups must be listed in the profile ACL list
        foreach ($memberOf as $memberGroup) {
            if (in_array($memberGroup['id'], $aclGroupList)) {
                return true;
            }
        }

        return false;
    }
}


1		<?php
2		/**
3		* Copyright (C) 2016 SURFnet.
4		*
5		* This program is free software: you can redistribute it and/or modify
6		* it under the terms of the GNU Affero General Public License as
7		* published by the Free Software Foundation, either version 3 of the
8		* License, or (at your option) any later version.
9		*
10		* This program is distributed in the hope that it will be useful,
11		* but WITHOUT ANY WARRANTY; without even the implied warranty of
12		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13		* GNU Affero General Public License for more details.
14		*
15		* You should have received a copy of the GNU Affero General Public License
16		* along with this program. If not, see <http://www.gnu.org/licenses/>.
17		*/
18
19		namespace SURFnet\VPN\Server\Api;
20
21		use DateTime;
22		use SURFnet\VPN\Common\Config;
23		use SURFnet\VPN\Common\Http\ApiErrorResponse;
24		use SURFnet\VPN\Common\Http\ApiResponse;
25		use SURFnet\VPN\Common\Http\AuthUtils;
26		use SURFnet\VPN\Common\Http\InputValidation;
27		use SURFnet\VPN\Common\Http\Request;
28		use SURFnet\VPN\Common\Http\Service;
29		use SURFnet\VPN\Common\Http\ServiceModuleInterface;
30		use SURFnet\VPN\Common\ProfileConfig;
31		use SURFnet\VPN\Server\Exception\TwoFactorException;
32		use SURFnet\VPN\Server\Storage;
33		use SURFnet\VPN\Server\TwoFactor;
34
35		class ConnectionsModule implements ServiceModuleInterface
36		{
37		/** @var \SURFnet\VPN\Common\Config */
38		private $config;
39
40		/** @var \SURFnet\VPN\Server\Storage */
41		private $storage;
42
43		/** @var array */
44		private $groupProviders;
45
46		public function __construct(Config $config, Storage $storage, array $groupProviders)
47		{
48		$this->config = $config;
49		$this->storage = $storage;
50		$this->groupProviders = $groupProviders;
51		}
52
53		public function init(Service $service)
54		{
55		$service->post(
56		'/connect',
57		function (Request $request, array $hookData) {
58		AuthUtils::requireUser($hookData, ['vpn-server-node']);
59
60		return $this->connect($request);
61		}
62		);
63
64		$service->post(
65		'/disconnect',
66		function (Request $request, array $hookData) {
67		AuthUtils::requireUser($hookData, ['vpn-server-node']);
68
69		return $this->disconnect($request);
70		}
71		);
72
73		$service->post(
74		'/verify_otp',
75		function (Request $request, array $hookData) {
76		AuthUtils::requireUser($hookData, ['vpn-server-node']);
77
78		return $this->verifyOtp($request);
79		}
80		);
81		}
82
83		public function connect(Request $request)
84		{
85		$profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
86		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
87		$ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
88		$ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
89		$connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
90
91		if (true !== $response = $this->verifyConnection($profileId, $commonName)) {
92		return $response;
93		}
94
95		// XXX is this still relevant?
96		if (false == $this->storage->clientConnect($profileId, $commonName, $ip4, $ip6, $connectedAt)) {
		0 ignored issues – show Coding Style Best Practice introduced 2016-10-26 14:01 UTC by Report Bug Copy Issue Report It seems like you are loosely comparing two booleans. Considering using the strict comparison `===` instead. When comparing two booleans, it is generally considered safer to use the strict comparison operator. Loading history...
97		return new ApiErrorResponse('connect', 'unable to write connect event to log');
98		}
99
100		return new ApiResponse('connect');
101		}
102
103		public function disconnect(Request $request)
104		{
105		$profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
106		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
107		$ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
108		$ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
109
110		$connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
111		$disconnectedAt = InputValidation::disconnectedAt($request->getPostParameter('disconnected_at'));
112		$bytesTransferred = InputValidation::bytesTransferred($request->getPostParameter('bytes_transferred'));
113
114		if (false === $this->storage->clientDisconnect($profileId, $commonName, $ip4, $ip6, $connectedAt, $disconnectedAt, $bytesTransferred)) {
115		return new ApiErrorResponse('disconnect', 'unable to write disconnect event to log');
116		}
117
118		return new ApiResponse('disconnect');
119		}
120
121	View Code Duplication	public function verifyOtp(Request $request)
		0 ignored issues – show Duplication introduced 2016-12-07 09:50 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
122		{
123		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
124		// we do not need 'otp_type', as only 'totp' is supported at the moment
125		InputValidation::otpType($request->getPostParameter('otp_type'));
126		$totpKey = InputValidation::totpKey($request->getPostParameter('totp_key'));
127
128		$certInfo = $this->storage->getUserCertificateInfo($commonName);
129		$userId = $certInfo['user_id'];
130
131		$twoFactor = new TwoFactor($this->storage, new DateTime('now'));
132		try {
133		$twoFactor->verifyTotp($userId, $totpKey);
134		} catch (TwoFactorException $e) {
135		return new ApiErrorResponse('verify_otp', $e->getMessage());
136		}
137
138		return new ApiResponse('verify_otp');
139		}
140
141		private function verifyConnection($profileId, $commonName)
142		{
143		// verify status of certificate/user
144		if (false === $result = $this->storage->getUserCertificateInfo($commonName)) {
145		// if a certificate does no longer exist, we cannot figure out the user
146		return new ApiErrorResponse('connect', 'user or certificate does not exist');
147		}
148
149	View Code Duplication	if ($result['user_is_disabled']) {
		0 ignored issues – show Duplication introduced 2016-11-29 22:01 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
150		$msg = 'unable to connect, user account is disabled';
151		$this->storage->addUserMessage($result['user_id'], 'error', $msg, new DateTime('now'));
152
153		return new ApiErrorResponse('connect', $msg);
154		}
155
156	View Code Duplication	if ($result['certificate_is_disabled']) {
		0 ignored issues – show Duplication introduced 2016-11-29 22:01 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
157		$msg = sprintf('unable to connect, certificate "%s" is disabled', $result['display_name']);
158		$this->storage->addUserMessage($result['user_id'], 'error', $msg, new DateTime('now'));
159
160		return new ApiErrorResponse('connect', $msg);
161		}
162
163		return $this->verifyAcl($profileId, $result['user_id']);
164		}
165
166		private function verifyAcl($profileId, $externalUserId)
167		{
168		// verify ACL
169		$profileConfig = new ProfileConfig($this->config->v('vpnProfiles', $profileId));
170		if ($profileConfig->v('enableAcl')) {
171		// ACL enabled
172		$userGroups = [];
173		foreach ($this->groupProviders as $groupProvider) {
174		$userGroups = array_merge($userGroups, $groupProvider->getGroups($externalUserId));
175		}
176
177		if (false === self::isMember($userGroups, $profileConfig->v('aclGroupList'))) {
178		$msg = 'unable to connect, user not in ACL';
179		$this->storage->addUserMessage($externalUserId, 'error', $msg, new DateTime('now'));
180
181		return new ApiErrorResponse('connect', $msg);
182		}
183		}
184
185		return true;
186		}
187
188		private static function isMember(array $memberOf, array $aclGroupList)
189		{
190		// one of the groups must be listed in the profile ACL list
191		foreach ($memberOf as $memberGroup) {
192		if (in_array($memberGroup['id'], $aclGroupList)) {
193		return true;
194		}
195		}
196
197		return false;
198		}
199		}
200

eduVPN / vpn-server-api

GitHub Access Token became invalid

Push — master ( fee13a...c03827 )

ConnectionsModule::verifyConnection() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like