SecurityManager::getAvailableRoles() - Code Metrics - Inspection of "Move isIdentified() call from User to SecurityMana..." - enwikipedia-acc/waca - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( c3ec55...6fe0c7 )

by Simon

created 2024-12-27 01:15 UTC

SecurityManager::getAvailableRoles() A

↳ Parent: SecurityManager

Complexity

Conditions	1
Paths	1

Size

Total Lines	3
Code Lines	1

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	2

Importance

Changes

Metric	Value
eloc	1
dl	0
loc	3
ccs	0
cts	0
cp	0
rs	10
c	0
b	0
f	0
cc	1
nc	1
nop	0
crap	2

<?php
/******************************************************************************
 * Wikipedia Account Creation Assistance tool                                 *
 * ACC Development Team. Please see team.json for a list of contributors.     *
 *                                                                            *
 * This is free and unencumbered software released into the public domain.    *
 * Please see LICENSE.md for the full licencing statement.                    *
 ******************************************************************************/

namespace Waca\Security;

use Waca\DataObjects\Domain;
use Waca\DataObjects\User;
use Waca\DataObjects\UserRole;
use Waca\IIdentificationVerifier;

final class SecurityManager implements ISecurityManager
{
    private IIdentificationVerifier $identificationVerifier;
    private RoleConfigurationBase $roleConfiguration;

    private array $cache = [];
    private IUserAccessLoader $userAccessLoader;

    public function __construct(
        IIdentificationVerifier $identificationVerifier,
        RoleConfigurationBase $roleConfiguration,
        IUserAccessLoader $userAccessLoader
    ) {
        $this->identificationVerifier = $identificationVerifier;
        $this->roleConfiguration = $roleConfiguration;
        $this->userAccessLoader = $userAccessLoader;
    }

    /**
     * Tests if a user is allowed to perform an action.
     *
     * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
     * that a user should have access to something.
     *
     * @category Security-Critical
     */
    public function allows(string $page, string $route, User $user): int
    {
        $this->getCachedActiveRoles($user, $activeRoles, $inactiveRoles);

        $availableRights = $this->roleConfiguration->getResultantRole($activeRoles);
        $testResult = $this->findResult($availableRights, $page, $route);

        if ($testResult !== null) {
            // We got a firm result here, so just return it.
            return $testResult;
        }

        // No firm result yet, so continue testing the inactive roles so we can give a better error.
        $inactiveRights = $this->roleConfiguration->getResultantRole($inactiveRoles);
        $testResult = $this->findResult($inactiveRights, $page, $route);

        if ($testResult === self::ALLOWED) {
            // The user is allowed to access this, but their role is inactive.
            return self::ERROR_NOT_IDENTIFIED;
        }

        // Other options from the secondary test are denied and inconclusive, which at this point defaults to denied.
        return self::ERROR_DENIED;
    }

    public function getActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles)
    {
        // Default to the community user here, because the main user is logged out
        $identified = false;
        $userRoles = array('public');

        // if we're not the community user, get our real rights.
        if (!$user->isCommunityUser()) {
            // Check the user's status - only active users are allowed the effects of roles

            $userRoles[] = 'loggedIn';

            if ($user->isActive()) {
                // All active users get +user
                $userRoles[] = 'user';

                $loadedRoles = $this->userAccessLoader->loadRolesForUser($user);

                // NOTE: public is still in this array.
                $userRoles = array_merge($userRoles, $loadedRoles);

                $identified = $this->userIsIdentified($user);
            }
        }

        $activeRoles = array();
        $inactiveRoles = array();

        foreach ($userRoles as $v) {
            if ($this->roleConfiguration->roleNeedsIdentification($v)) {
                if ($identified) {
                    $activeRoles[] = $v;
                }
                else {
                    $inactiveRoles[] = $v;
                }
            }
            else {
                $activeRoles[] = $v;
            }
        }
    }

    public function getCachedActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles): void
    {
        if (!array_key_exists($user->getId(), $this->cache)) {
            $this->getActiveRoles($user, $retrievedActiveRoles, $retrievedInactiveRoles);
            $this->cache[$user->getId()] = ['active' => $retrievedActiveRoles, 'inactive' => $retrievedInactiveRoles];
        }

        $activeRoles = $this->cache[$user->getId()]['active'];
        $inactiveRoles = $this->cache[$user->getId()]['inactive'];
    }

    public function getAvailableRoles(): array
    {
        return $this->roleConfiguration->getAvailableRoles();
    }

    /**
     * Tests a role for an ACL decision on a specific page/route
     *
     * @param array  $pseudoRole The role (flattened) to check
     * @param string $page       The page class to check
     * @param string $route      The page route to check
     *
     * @return int|null
     */
    private function findResult($pseudoRole, $page, $route)
    {
        if (isset($pseudoRole[$page])) {
            // check for deny on catch-all route
            if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
                if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_DENY) {
                    return self::ERROR_DENIED;
                }
            }

            // check normal route
            if (isset($pseudoRole[$page][$route])) {
                if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_DENY) {
                    return self::ERROR_DENIED;
                }

                if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_ALLOW) {
                    return self::ALLOWED;
                }
            }

            // check for allowed on catch-all route
            if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
                if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_ALLOW) {
                    return self::ALLOWED;
                }
            }
        }

        // return indeterminate result
        return null;
    }

    private function userIsIdentified(User $user): bool
    {
        if ($user->getForceIdentified() === false) {
            // User forced to be unidentified in the database.
            return false;
        }

        if ($user->getForceIdentified() === true) {

            // User forced to be identified in the database.
            return true;
        }

        // User not forced to any particular identified status; consult IdentificationVerifier
        return $this->identificationVerifier->isUserIdentified($user->getOnWikiName());
    }
}


1		<?php
2		/******************************************************************************
3		* Wikipedia Account Creation Assistance tool *
4		* ACC Development Team. Please see team.json for a list of contributors. *
5		* *
6		* This is free and unencumbered software released into the public domain. *
7		* Please see LICENSE.md for the full licencing statement. *
8		******************************************************************************/
9
10		namespace Waca\Security;
11
12		use Waca\DataObjects\Domain;
13		use Waca\DataObjects\User;
14		use Waca\DataObjects\UserRole;
15		use Waca\IIdentificationVerifier;
16
17		final class SecurityManager implements ISecurityManager
18		{
19		private IIdentificationVerifier $identificationVerifier;
20		private RoleConfigurationBase $roleConfiguration;
21
22		private array $cache = [];
23		private IUserAccessLoader $userAccessLoader;
24
25		public function __construct(
26		IIdentificationVerifier $identificationVerifier,
27		RoleConfigurationBase $roleConfiguration,
28		IUserAccessLoader $userAccessLoader
29		) {
30		$this->identificationVerifier = $identificationVerifier;
31		$this->roleConfiguration = $roleConfiguration;
32		$this->userAccessLoader = $userAccessLoader;
33		}
34
35	2	/**
36		* Tests if a user is allowed to perform an action.
37		*
38		* This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
39	2	* that a user should have access to something.
40	2	*
41		* @category Security-Critical
42		*/
43		public function allows(string $page, string $route, User $user): int
44		{
45		$this->getCachedActiveRoles($user, $activeRoles, $inactiveRoles);
46
47		$availableRights = $this->roleConfiguration->getResultantRole($activeRoles);
48		$testResult = $this->findResult($availableRights, $page, $route);
49
50		if ($testResult !== null) {
51		// We got a firm result here, so just return it.
52		return $testResult;
53		}
54
55		// No firm result yet, so continue testing the inactive roles so we can give a better error.
56		$inactiveRights = $this->roleConfiguration->getResultantRole($inactiveRoles);
57	2	$testResult = $this->findResult($inactiveRights, $page, $route);
58
59	2	if ($testResult === self::ALLOWED) {
60		// The user is allowed to access this, but their role is inactive.
61	2	return self::ERROR_NOT_IDENTIFIED;
62	2	}
63
64	2	// Other options from the secondary test are denied and inconclusive, which at this point defaults to denied.
65		return self::ERROR_DENIED;
66	2	}
67
68		public function getActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles)
69		{
70		// Default to the community user here, because the main user is logged out
71		$identified = false;
72		$userRoles = array('public');
73
74		// if we're not the community user, get our real rights.
75		if (!$user->isCommunityUser()) {
76		// Check the user's status - only active users are allowed the effects of roles
77
78		$userRoles[] = 'loggedIn';
79
80		if ($user->isActive()) {
81		// All active users get +user
82		$userRoles[] = 'user';
83
84		$loadedRoles = $this->userAccessLoader->loadRolesForUser($user);
85
86		// NOTE: public is still in this array.
87		$userRoles = array_merge($userRoles, $loadedRoles);
88
89	2	$identified = $this->userIsIdentified($user);
90		}
91	2	}
92
93	2	$activeRoles = array();
94	2	$inactiveRoles = array();
95	1
96		foreach ($userRoles as $v) {
97		if ($this->roleConfiguration->roleNeedsIdentification($v)) {
98		if ($identified) {
99		$activeRoles[] = $v;
100	1	}
101		else {
102		$inactiveRoles[] = $v;
103		}
104		}
105		else {
106		$activeRoles[] = $v;
107		}
108		}
109		}
110
111	1	public function getCachedActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles): void
112	1	{
113	1	if (!array_key_exists($user->getId(), $this->cache)) {
114		$this->getActiveRoles($user, $retrievedActiveRoles, $retrievedInactiveRoles);
115		$this->cache[$user->getId()] = ['active' => $retrievedActiveRoles, 'inactive' => $retrievedInactiveRoles];
116		}
117
118		$activeRoles = $this->cache[$user->getId()]['active'];
119		$inactiveRoles = $this->cache[$user->getId()]['inactive'];
120		}
121
122		public function getAvailableRoles(): array
123		{
124		return $this->roleConfiguration->getAvailableRoles();
125		}
126
127		/**
128		* Tests a role for an ACL decision on a specific page/route
129	2	*
130		* @param array $pseudoRole The role (flattened) to check
131	2	* @param string $page The page class to check
132		* @param string $route The page route to check
133	2	*
134		* @return int\|null
135		*/
136	2	private function findResult($pseudoRole, $page, $route)
137	2	{
138		if (isset($pseudoRole[$page])) {
139	2	// check for deny on catch-all route
140	2	if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
141		if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_DENY) {
142		return self::ERROR_DENIED;
143	2	}
144		}
145	2
146		// check normal route
147		if (isset($pseudoRole[$page][$route])) {
148		if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_DENY) {
149		return self::ERROR_DENIED;
150		}
151	2
152		if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_ALLOW) {
153		return self::ALLOWED;
154		}
155		}
156	2
157		// check for allowed on catch-all route
158		if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
159		if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_ALLOW) {
160		return self::ALLOWED;
161	2	}
162		}
163		}
164
165		// return indeterminate result
166		return null;
167		}
168
169	2	private function userIsIdentified(User $user): bool
170		{
171		if ($user->getForceIdentified() === false) {
172	2	// User forced to be unidentified in the database.
173	2	return false;
174		}
175
176	2	if ($user->getForceIdentified() === true) {
		0 ignored issues – show introduced 2023-10-04 00:01 UTC by Report Bug Copy Issue Report The condition `$user->getForceIdentified() === true` is always `true`. Loading history...
177		// User forced to be identified in the database.
178		return true;
179		}
180
181		// User not forced to any particular identified status; consult IdentificationVerifier
182		return $this->identificationVerifier->isUserIdentified($user->getOnWikiName());
183		}
184		}
185

enwikipedia-acc / waca

Push — master ( c3ec55...6fe0c7 )

SecurityManager::getAvailableRoles() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like