elliot-sawyer / totp-authenticator

src/Providers/TOTPProvider.php

<?php


namespace ElliotSawyer\TOTPAuthenticator;

use Firesphere\BootstrapMFA\Providers\BootstrapMFAProvider;
use Firesphere\BootstrapMFA\Providers\MFAProvider;
use lfkeitel\phptotp\Base32;
use lfkeitel\phptotp\Totp;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\ORM\ValidationException;
use SilverStripe\ORM\ValidationResult;
use SilverStripe\Security\Member;
use SilverStripe\Security\PasswordEncryptor_NotFoundException;
use ElliotSawyer\TOTPAuthenticator\TOTPAuthenticator;

/**
 * Class TOTPProvider
 * @package ElliotSawyer\TOTPAuthenticator
 */
class TOTPProvider extends BootstrapMFAProvider implements MFAProvider
{
    /**
     * @param string $token
     * @param null $result

Are you sure the doc-type for parameter $result is correct as it would always require null to be passed?

     * @return bool|Member
     * @throws ValidationException
     * @throws PasswordEncryptor_NotFoundException
     * @throws \Exception
     */
    public function verifyToken($token, &$result = null)
    {
        if (!$result) {

$result is of type null, thus it always evaluated to false.

            $result = Injector::inst()->get(ValidationResult::class);
        }
        $member = $this->getMember();
        if ($member && $member->ID) {
            if (!$token) {
                $result->addError(_t(self::class . '.INVALIDORMISSINGTOKEN', 'Invalid or missing second factor token'));
            } else {
                $secret = Base32::decode($member->TOTPSecret);
                $algorithm = TOTPAuthenticator::get_algorithm();

                $totp = new Totp($algorithm);
                $key = $totp->GenerateToken($secret);
                $user_submitted_key = $token;
                if ($user_submitted_key !== $key) {
                    $result->addError(
                        _t(self::class . '.INVALIDORMISSINGTOKEN', 'Invalid or missing second factor token')
                    );
                } else {
                    return $this->member;
                }
            }
        }

        return parent::verifyToken($token, $result);
    }
}