enwikipedia-acc / waca

includes/AuthUtility.php

Indentation +83 added lines, -83 removed lines

@@ -10,99 +10,99 @@
 
 class AuthUtility
 {
-    /**
-     * Test the specified data against the specified credentials
-     *
-     * @param string $password
-     * @param string $credentials
-     *
-     * @return bool
-     * @deprecated
-     */
-    public static function testCredentials($password, $credentials)
-    {
-        global $minimumPasswordVersion;
+	/**
+	 * Test the specified data against the specified credentials
+	 *
+	 * @param string $password
+	 * @param string $credentials
+	 *
+	 * @return bool
+	 * @deprecated
+	 */
+	public static function testCredentials($password, $credentials)
+	{
+		global $minimumPasswordVersion;
 
-        if (substr($credentials, 0, 1) != ":") {
-            return false;
-        }
+		if (substr($credentials, 0, 1) != ":") {
+			return false;
+		}
 
-        // determine password version
-        $data = explode(':', substr($credentials, 1));
+		// determine password version
+		$data = explode(':', substr($credentials, 1));
 
-        // call the encryptVersion function for the version that this password actually is.
-        // syntax: :1:SALT:HASH
-        // syntax: :2:x:HASH
+		// call the encryptVersion function for the version that this password actually is.
+		// syntax: :1:SALT:HASH
+		// syntax: :2:x:HASH
 
-        // check the version is one of the allowed ones:
-        if ($minimumPasswordVersion > $data[0]) {
-            return false;
-        }
+		// check the version is one of the allowed ones:
+		if ($minimumPasswordVersion > $data[0]) {
+			return false;
+		}
 
-        if ($data[0] == 1) {
-            return $credentials == self::encryptVersion1($password, $data[1]);
-        }
+		if ($data[0] == 1) {
+			return $credentials == self::encryptVersion1($password, $data[1]);
+		}
 
-        if ($data[0] == 2) {
-            return self::verifyVersion2($password, $data[2]);
-        }
+		if ($data[0] == 2) {
+			return self::verifyVersion2($password, $data[2]);
+		}
 
-        return false;
-    }
+		return false;
+	}
 
-    /**
-     * @param string $credentials
-     *
-     * @return bool
-     * @deprecated
-     */
-    public static function isCredentialVersionLatest($credentials)
-    {
-        return substr($credentials, 0, 3) === ":2:";
-    }
+	/**
+	 * @param string $credentials
+	 *
+	 * @return bool
+	 * @deprecated
+	 */
+	public static function isCredentialVersionLatest($credentials)
+	{
+		return substr($credentials, 0, 3) === ":2:";
+	}
 
-    /**
-     * Encrypts a user's password with the latest version of the hash algorithm
-     *
-     * @param string $password
-     *
-     * @return string
-     * @deprecated
-     */
-    public static function encryptPassword($password)
-    {
-        return self::encryptVersion2($password);
-    }
+	/**
+	 * Encrypts a user's password with the latest version of the hash algorithm
+	 *
+	 * @param string $password
+	 *
+	 * @return string
+	 * @deprecated
+	 */
+	public static function encryptPassword($password)
+	{
+		return self::encryptVersion2($password);
+	}
 
-    /**
-     * @param string $password
-     * @param string $salt
-     *
-     * @return string
-     */
-    private static function encryptVersion1($password, $salt)
-    {
-        return ':1:' . $salt . ':' . md5($salt . '-' . md5($password));
-    }
+	/**
+	 * @param string $password
+	 * @param string $salt
+	 *
+	 * @return string
+	 */
+	private static function encryptVersion1($password, $salt)
+	{
+		return ':1:' . $salt . ':' . md5($salt . '-' . md5($password));
+	}
 
-    /**
-     * @param string $password
-     *
-     * @return string
-     */
-    private static function encryptVersion2($password)
-    {
-        return ':2:x:' . password_hash($password, PASSWORD_BCRYPT);
-    }
+	/**
+	 * @param string $password
+	 *
+	 * @return string
+	 */
+	private static function encryptVersion2($password)
+	{
+		return ':2:x:' . password_hash($password, PASSWORD_BCRYPT);
+	}
 
-    /**
-     * @param string $password
-     * @param string $hash
-     *
-     * @return bool
-     */
-    private static function verifyVersion2($password, $hash)
-    {
-        return password_verify($password, $hash);
-    }
+	/**
+	 * @param string $password
+	 * @param string $hash
+	 *
+	 * @return bool
+	 */
+	private static function verifyVersion2($password, $hash)
+	{
+		return password_verify($password, $hash);
+	}
 }

includes/Security/AuthenticationManager.php

Indentation +51 added lines, -51 removed lines

@@ -19,62 +19,62 @@
 
 class AuthenticationManager
 {
-    const AUTH_OK = 1;
-    const AUTH_FAIL = 2;
-    const AUTH_REQUIRE_NEXT_STAGE = 3;
-    private $typeMap = array();
-    /**
-     * @var PdoDatabase
-     */
-    private $database;
+	const AUTH_OK = 1;
+	const AUTH_FAIL = 2;
+	const AUTH_REQUIRE_NEXT_STAGE = 3;
+	private $typeMap = array();
+	/**
+	 * @var PdoDatabase
+	 */
+	private $database;
 
-    /**
-     * AuthenticationManager constructor.
-     *
-     * @param PdoDatabase       $database
-     * @param SiteConfiguration $siteConfiguration
-     * @param HttpHelper        $httpHelper
-     */
-    public function __construct(PdoDatabase $database, SiteConfiguration $siteConfiguration, HttpHelper $httpHelper)
-    {
-        // setup providers
-        $this->typeMap['password'] = new PasswordCredentialProvider($database, $siteConfiguration);
-        $this->database = $database;
-    }
+	/**
+	 * AuthenticationManager constructor.
+	 *
+	 * @param PdoDatabase       $database
+	 * @param SiteConfiguration $siteConfiguration
+	 * @param HttpHelper        $httpHelper
+	 */
+	public function __construct(PdoDatabase $database, SiteConfiguration $siteConfiguration, HttpHelper $httpHelper)
+	{
+		// setup providers
+		$this->typeMap['password'] = new PasswordCredentialProvider($database, $siteConfiguration);
+		$this->database = $database;
+	}
 
-    public function authenticate(User $user, $data, $stage)
-    {
-        $sql = 'SELECT type FROM credential WHERE user = :user AND factor = :stage';
-        $statement = $this->database->prepare($sql);
-        $statement->execute(array(':user' => $user->getId(), ':stage' => $stage));
-        $options = $statement->fetchAll(PDO::FETCH_COLUMN);
+	public function authenticate(User $user, $data, $stage)
+	{
+		$sql = 'SELECT type FROM credential WHERE user = :user AND factor = :stage';
+		$statement = $this->database->prepare($sql);
+		$statement->execute(array(':user' => $user->getId(), ':stage' => $stage));
+		$options = $statement->fetchAll(PDO::FETCH_COLUMN);
 
-        $sql = 'SELECT count(DISTINCT factor) FROM credential WHERE user = :user AND factor > :stage';
-        $statement = $this->database->prepare($sql);
-        $statement->execute(array(':user' => $user->getId(), ':stage' => $stage));
-        $requiredFactors = $statement->fetchColumn();
+		$sql = 'SELECT count(DISTINCT factor) FROM credential WHERE user = :user AND factor > :stage';
+		$statement = $this->database->prepare($sql);
+		$statement->execute(array(':user' => $user->getId(), ':stage' => $stage));
+		$requiredFactors = $statement->fetchColumn();
 
-        // prep the correct OK response based on how many factors are ahead of this one
-        $success = self::AUTH_OK;
-        if ($requiredFactors > 0) {
-            $success = self::AUTH_REQUIRE_NEXT_STAGE;
-        }
+		// prep the correct OK response based on how many factors are ahead of this one
+		$success = self::AUTH_OK;
+		if ($requiredFactors > 0) {
+			$success = self::AUTH_REQUIRE_NEXT_STAGE;
+		}
 
-        foreach ($options as $type) {
-            if (!isset($this->typeMap[$type])) {
-                // does this type have a credentialProvider registered?
-                continue;
-            }
+		foreach ($options as $type) {
+			if (!isset($this->typeMap[$type])) {
+				// does this type have a credentialProvider registered?
+				continue;
+			}
 
-            /** @var ICredentialProvider $credentialProvider */
-            $credentialProvider = $this->typeMap[$type];
-            if ($credentialProvider->authenticate($user, $data)) {
-                return $success;
-            }
-        }
+			/** @var ICredentialProvider $credentialProvider */
+			$credentialProvider = $this->typeMap[$type];
+			if ($credentialProvider->authenticate($user, $data)) {
+				return $success;
+			}
+		}
 
-        // We've iterated over all the available providers for this stage.
-        // They all hate you.
-        return self::AUTH_FAIL;
-    }
+		// We've iterated over all the available providers for this stage.
+		// They all hate you.
+		return self::AUTH_FAIL;
+	}
 }
\ No newline at end of file

includes/Security/RoleConfiguration.php

Indentation +334 added lines, -334 removed lines

@@ -45,364 +45,364 @@
 
 class RoleConfiguration
 {
-    const ACCESS_ALLOW = 1;
-    const ACCESS_DENY = -1;
-    const ACCESS_DEFAULT = 0;
-    const MAIN = 'main';
-    const ALL = '*';
-    /**
-     * A map of roles to rights
-     *
-     * For example:
-     *
-     * array(
-     *   'myrole' => array(
-     *       PageMyPage::class => array(
-     *           'edit' => self::ACCESS_ALLOW,
-     *           'create' => self::ACCESS_DENY,
-     *       )
-     *   )
-     * )
-     *
-     * Note that DENY takes precedence over everything else when roles are combined, followed by ALLOW, followed by
-     * DEFAULT. Thus, if you have the following ([A]llow, [D]eny, [-] (default)) grants in different roles, this should
-     * be the expected result:
-     *
-     * - (-,-,-) = - (default because nothing to explicitly say allowed or denied equates to a denial)
-     * - (A,-,-) = A
-     * - (D,-,-) = D
-     * - (A,D,-) = D (deny takes precedence over allow)
-     * - (A,A,A) = A (repetition has no effect)
-     *
-     * The public role is special, and is applied to all users automatically. Avoid using deny on this role.
-     *
-     * @var array
-     */
-    private $roleConfig = array(
-        'public'            => array(
-            /*
+	const ACCESS_ALLOW = 1;
+	const ACCESS_DENY = -1;
+	const ACCESS_DEFAULT = 0;
+	const MAIN = 'main';
+	const ALL = '*';
+	/**
+	 * A map of roles to rights
+	 *
+	 * For example:
+	 *
+	 * array(
+	 *   'myrole' => array(
+	 *       PageMyPage::class => array(
+	 *           'edit' => self::ACCESS_ALLOW,
+	 *           'create' => self::ACCESS_DENY,
+	 *       )
+	 *   )
+	 * )
+	 *
+	 * Note that DENY takes precedence over everything else when roles are combined, followed by ALLOW, followed by
+	 * DEFAULT. Thus, if you have the following ([A]llow, [D]eny, [-] (default)) grants in different roles, this should
+	 * be the expected result:
+	 *
+	 * - (-,-,-) = - (default because nothing to explicitly say allowed or denied equates to a denial)
+	 * - (A,-,-) = A
+	 * - (D,-,-) = D
+	 * - (A,D,-) = D (deny takes precedence over allow)
+	 * - (A,A,A) = A (repetition has no effect)
+	 *
+	 * The public role is special, and is applied to all users automatically. Avoid using deny on this role.
+	 *
+	 * @var array
+	 */
+	private $roleConfig = array(
+		'public'            => array(
+			/*
              * THIS ROLE IS GRANTED TO ALL LOGGED *OUT* USERS IMPLICITLY.
              *
              * USERS IN THIS ROLE DO NOT HAVE TO BE IDENTIFIED TO GET THE RIGHTS CONFERRED HERE.
              * DO NOT ADD ANY SECURITY-SENSITIVE RIGHTS HERE.
              */
-            '_childRoles'   => array(
-                'publicStats',
-            ),
-            PageTeam::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'loggedIn'          => array(
-            /*
+			'_childRoles'   => array(
+				'publicStats',
+			),
+			PageTeam::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'loggedIn'          => array(
+			/*
              * THIS ROLE IS GRANTED TO ALL LOGGED IN USERS IMPLICITLY.
              *
              * USERS IN THIS ROLE DO NOT HAVE TO BE IDENTIFIED TO GET THE RIGHTS CONFERRED HERE.
              * DO NOT ADD ANY SECURITY-SENSITIVE RIGHTS HERE.
              */
-            '_childRoles'             => array(
-                'public',
-            ),
-            PagePreferences::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageChangePassword::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageOAuth::class          => array(
-                'attach' => self::ACCESS_ALLOW,
-                'detach' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'user'              => array(
-            '_description'                       => 'A standard tool user.',
-            '_editableBy'                        => array('admin', 'toolRoot'),
-            '_childRoles'                        => array(
-                'internalStats',
-            ),
-            PageMain::class                      => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageBan::class                       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageEditComment::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageEmailManagement::class           => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-            ),
-            PageExpandedRequestList::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageLog::class                       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageSearch::class                    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageWelcomeTemplateManagement::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'select'   => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-            ),
-            PageViewRequest::class               => array(
-                self::MAIN       => self::ACCESS_ALLOW,
-                'seeAllRequests' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'                        => array(
-                'seePrivateDataWhenReserved' => self::ACCESS_ALLOW,
-                'seePrivateDataWithHash'     => self::ACCESS_ALLOW,
-            ),
-            PageCustomClose::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageComment::class                   => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageCloseRequest::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageCreateRequest::class             => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageDeferRequest::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageDropRequest::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageReservation::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageSendToUser::class                => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageBreakReservation::class          => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageJobQueue::class                  => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-                'all'      => self::ACCESS_ALLOW,
-            ),
-            'RequestCreation'                    => array(
-                User::CREATION_MANUAL => self::ACCESS_ALLOW,
-                User::CREATION_OAUTH  => self::ACCESS_ALLOW,
-            ),
-        ),
-        'admin'             => array(
-            '_description'                       => 'A tool administrator.',
-            '_editableBy'                        => array('admin', 'toolRoot'),
-            '_childRoles'                        => array(
-                'user',
-                'requestAdminTools',
-            ),
-            PageEmailManagement::class           => array(
-                'edit'   => self::ACCESS_ALLOW,
-                'create' => self::ACCESS_ALLOW,
-            ),
-            PageSiteNotice::class                => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageUserManagement::class            => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-                'approve'   => self::ACCESS_ALLOW,
-                'decline'   => self::ACCESS_ALLOW,
-                'rename'    => self::ACCESS_ALLOW,
-                'editUser'  => self::ACCESS_ALLOW,
-                'suspend'   => self::ACCESS_ALLOW,
-                'editRoles' => self::ACCESS_ALLOW,
-            ),
-            PageWelcomeTemplateManagement::class => array(
-                'edit'   => self::ACCESS_ALLOW,
-                'delete' => self::ACCESS_ALLOW,
-                'add'    => self::ACCESS_ALLOW,
-            ),
-            PageJobQueue::class                  => array(
-                'acknowledge' => self::ACCESS_ALLOW,
-                'requeue'     => self::ACCESS_ALLOW,
-            ),
-        ),
-        'checkuser'         => array(
-            '_description'            => 'A user with CheckUser access',
-            '_editableBy'             => array('checkuser', 'toolRoot'),
-            '_childRoles'             => array(
-                'user',
-                'requestAdminTools',
-            ),
-            PageUserManagement::class => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-                'suspend'   => self::ACCESS_ALLOW,
-                'editRoles' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'             => array(
-                'seeUserAgentData' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'toolRoot'          => array(
-            '_description' => 'A user with shell access to the servers running the tool',
-            '_editableBy'  => array('toolRoot'),
-            '_childRoles'  => array(
-                'admin',
-                'checkuser',
-            ),
-        ),
-        'botCreation'       => array(
-            '_description'    => 'A user allowed to use the bot to perform account creations',
-            '_editableBy'     => array('admin', 'toolRoot'),
-            '_childRoles'     => array(),
-            'RequestCreation' => array(
-                User::CREATION_BOT => self::ACCESS_ALLOW,
-            ),
-        ),
+			'_childRoles'             => array(
+				'public',
+			),
+			PagePreferences::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageChangePassword::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageOAuth::class          => array(
+				'attach' => self::ACCESS_ALLOW,
+				'detach' => self::ACCESS_ALLOW,
+			),
+		),
+		'user'              => array(
+			'_description'                       => 'A standard tool user.',
+			'_editableBy'                        => array('admin', 'toolRoot'),
+			'_childRoles'                        => array(
+				'internalStats',
+			),
+			PageMain::class                      => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageBan::class                       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageEditComment::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageEmailManagement::class           => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+			),
+			PageExpandedRequestList::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageLog::class                       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageSearch::class                    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageWelcomeTemplateManagement::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'select'   => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+			),
+			PageViewRequest::class               => array(
+				self::MAIN       => self::ACCESS_ALLOW,
+				'seeAllRequests' => self::ACCESS_ALLOW,
+			),
+			'RequestData'                        => array(
+				'seePrivateDataWhenReserved' => self::ACCESS_ALLOW,
+				'seePrivateDataWithHash'     => self::ACCESS_ALLOW,
+			),
+			PageCustomClose::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageComment::class                   => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageCloseRequest::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageCreateRequest::class             => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageDeferRequest::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageDropRequest::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageReservation::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageSendToUser::class                => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageBreakReservation::class          => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageJobQueue::class                  => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+				'all'      => self::ACCESS_ALLOW,
+			),
+			'RequestCreation'                    => array(
+				User::CREATION_MANUAL => self::ACCESS_ALLOW,
+				User::CREATION_OAUTH  => self::ACCESS_ALLOW,
+			),
+		),
+		'admin'             => array(
+			'_description'                       => 'A tool administrator.',
+			'_editableBy'                        => array('admin', 'toolRoot'),
+			'_childRoles'                        => array(
+				'user',
+				'requestAdminTools',
+			),
+			PageEmailManagement::class           => array(
+				'edit'   => self::ACCESS_ALLOW,
+				'create' => self::ACCESS_ALLOW,
+			),
+			PageSiteNotice::class                => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageUserManagement::class            => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+				'approve'   => self::ACCESS_ALLOW,
+				'decline'   => self::ACCESS_ALLOW,
+				'rename'    => self::ACCESS_ALLOW,
+				'editUser'  => self::ACCESS_ALLOW,
+				'suspend'   => self::ACCESS_ALLOW,
+				'editRoles' => self::ACCESS_ALLOW,
+			),
+			PageWelcomeTemplateManagement::class => array(
+				'edit'   => self::ACCESS_ALLOW,
+				'delete' => self::ACCESS_ALLOW,
+				'add'    => self::ACCESS_ALLOW,
+			),
+			PageJobQueue::class                  => array(
+				'acknowledge' => self::ACCESS_ALLOW,
+				'requeue'     => self::ACCESS_ALLOW,
+			),
+		),
+		'checkuser'         => array(
+			'_description'            => 'A user with CheckUser access',
+			'_editableBy'             => array('checkuser', 'toolRoot'),
+			'_childRoles'             => array(
+				'user',
+				'requestAdminTools',
+			),
+			PageUserManagement::class => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+				'suspend'   => self::ACCESS_ALLOW,
+				'editRoles' => self::ACCESS_ALLOW,
+			),
+			'RequestData'             => array(
+				'seeUserAgentData' => self::ACCESS_ALLOW,
+			),
+		),
+		'toolRoot'          => array(
+			'_description' => 'A user with shell access to the servers running the tool',
+			'_editableBy'  => array('toolRoot'),
+			'_childRoles'  => array(
+				'admin',
+				'checkuser',
+			),
+		),
+		'botCreation'       => array(
+			'_description'    => 'A user allowed to use the bot to perform account creations',
+			'_editableBy'     => array('admin', 'toolRoot'),
+			'_childRoles'     => array(),
+			'RequestCreation' => array(
+				User::CREATION_BOT => self::ACCESS_ALLOW,
+			),
+		),
 
-        // Child roles go below this point
-        'publicStats'       => array(
-            '_hidden'               => true,
-            StatsUsers::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'detail'   => self::ACCESS_ALLOW,
-            ),
-            StatsTopCreators::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'internalStats'     => array(
-            '_hidden'                    => true,
-            StatsMain::class             => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsFastCloses::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsInactiveUsers::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsMonthlyStats::class     => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsReservedRequests::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsTemplateStats::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'requestAdminTools' => array(
-            '_hidden'                   => true,
-            PageBan::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'set'      => self::ACCESS_ALLOW,
-                'remove'   => self::ACCESS_ALLOW,
-            ),
-            PageEditComment::class      => array(
-                'editOthers' => self::ACCESS_ALLOW,
-            ),
-            PageBreakReservation::class => array(
-                'force' => self::ACCESS_ALLOW,
-            ),
-            PageCustomClose::class      => array(
-                'skipCcMailingList' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'               => array(
-                'reopenOldRequest'      => self::ACCESS_ALLOW,
-                'alwaysSeePrivateData'  => self::ACCESS_ALLOW,
-                'alwaysSeeHash'         => self::ACCESS_ALLOW,
-                'seeRestrictedComments' => self::ACCESS_ALLOW,
-            ),
-        ),
-    );
-    /** @var array
-     * List of roles which are *exempt* from the identification requirements
-     *
-     * Think twice about adding roles to this list.
-     *
-     * @category Security-Critical
-     */
-    private $identificationExempt = array('public', 'loggedIn');
+		// Child roles go below this point
+		'publicStats'       => array(
+			'_hidden'               => true,
+			StatsUsers::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'detail'   => self::ACCESS_ALLOW,
+			),
+			StatsTopCreators::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'internalStats'     => array(
+			'_hidden'                    => true,
+			StatsMain::class             => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsFastCloses::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsInactiveUsers::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsMonthlyStats::class     => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsReservedRequests::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsTemplateStats::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'requestAdminTools' => array(
+			'_hidden'                   => true,
+			PageBan::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'set'      => self::ACCESS_ALLOW,
+				'remove'   => self::ACCESS_ALLOW,
+			),
+			PageEditComment::class      => array(
+				'editOthers' => self::ACCESS_ALLOW,
+			),
+			PageBreakReservation::class => array(
+				'force' => self::ACCESS_ALLOW,
+			),
+			PageCustomClose::class      => array(
+				'skipCcMailingList' => self::ACCESS_ALLOW,
+			),
+			'RequestData'               => array(
+				'reopenOldRequest'      => self::ACCESS_ALLOW,
+				'alwaysSeePrivateData'  => self::ACCESS_ALLOW,
+				'alwaysSeeHash'         => self::ACCESS_ALLOW,
+				'seeRestrictedComments' => self::ACCESS_ALLOW,
+			),
+		),
+	);
+	/** @var array
+	 * List of roles which are *exempt* from the identification requirements
+	 *
+	 * Think twice about adding roles to this list.
+	 *
+	 * @category Security-Critical
+	 */
+	private $identificationExempt = array('public', 'loggedIn');
 
-    /**
-     * RoleConfiguration constructor.
-     *
-     * @param array $roleConfig           Set to non-null to override the default configuration.
-     * @param array $identificationExempt Set to non-null to override the default configuration.
-     */
-    public function __construct(array $roleConfig = null, array $identificationExempt = null)
-    {
-        if ($roleConfig !== null) {
-            $this->roleConfig = $roleConfig;
-        }
+	/**
+	 * RoleConfiguration constructor.
+	 *
+	 * @param array $roleConfig           Set to non-null to override the default configuration.
+	 * @param array $identificationExempt Set to non-null to override the default configuration.
+	 */
+	public function __construct(array $roleConfig = null, array $identificationExempt = null)
+	{
+		if ($roleConfig !== null) {
+			$this->roleConfig = $roleConfig;
+		}
 
-        if ($identificationExempt !== null) {
-            $this->identificationExempt = $identificationExempt;
-        }
-    }
+		if ($identificationExempt !== null) {
+			$this->identificationExempt = $identificationExempt;
+		}
+	}
 
-    /**
-     * @param array $roles The roles to check
-     *
-     * @return array
-     */
-    public function getApplicableRoles(array $roles)
-    {
-        $available = array();
+	/**
+	 * @param array $roles The roles to check
+	 *
+	 * @return array
+	 */
+	public function getApplicableRoles(array $roles)
+	{
+		$available = array();
 
-        foreach ($roles as $role) {
-            if (!isset($this->roleConfig[$role])) {
-                // wat
-                continue;
-            }
+		foreach ($roles as $role) {
+			if (!isset($this->roleConfig[$role])) {
+				// wat
+				continue;
+			}
 
-            $available[$role] = $this->roleConfig[$role];
+			$available[$role] = $this->roleConfig[$role];
 
-            if (isset($available[$role]['_childRoles'])) {
-                $childRoles = self::getApplicableRoles($available[$role]['_childRoles']);
-                $available = array_merge($available, $childRoles);
+			if (isset($available[$role]['_childRoles'])) {
+				$childRoles = self::getApplicableRoles($available[$role]['_childRoles']);
+				$available = array_merge($available, $childRoles);
 
-                unset($available[$role]['_childRoles']);
-            }
+				unset($available[$role]['_childRoles']);
+			}
 
-            foreach (array('_hidden', '_editableBy', '_description') as $item) {
-                if (isset($available[$role][$item])) {
-                    unset($available[$role][$item]);
-                }
-            }
-        }
+			foreach (array('_hidden', '_editableBy', '_description') as $item) {
+				if (isset($available[$role][$item])) {
+					unset($available[$role][$item]);
+				}
+			}
+		}
 
-        return $available;
-    }
+		return $available;
+	}
 
-    public function getAvailableRoles()
-    {
-        $possible = array_diff(array_keys($this->roleConfig), array('public', 'loggedIn'));
+	public function getAvailableRoles()
+	{
+		$possible = array_diff(array_keys($this->roleConfig), array('public', 'loggedIn'));
 
-        $actual = array();
+		$actual = array();
 
-        foreach ($possible as $role) {
-            if (!isset($this->roleConfig[$role]['_hidden'])) {
-                $actual[$role] = array(
-                    'description' => $this->roleConfig[$role]['_description'],
-                    'editableBy'  => $this->roleConfig[$role]['_editableBy'],
-                );
-            }
-        }
+		foreach ($possible as $role) {
+			if (!isset($this->roleConfig[$role]['_hidden'])) {
+				$actual[$role] = array(
+					'description' => $this->roleConfig[$role]['_description'],
+					'editableBy'  => $this->roleConfig[$role]['_editableBy'],
+				);
+			}
+		}
 
-        return $actual;
-    }
+		return $actual;
+	}
 
-    /**
-     * @param string $role
-     *
-     * @return bool
-     */
-    public function roleNeedsIdentification($role)
-    {
-        if (in_array($role, $this->identificationExempt)) {
-            return false;
-        }
+	/**
+	 * @param string $role
+	 *
+	 * @return bool
+	 */
+	public function roleNeedsIdentification($role)
+	{
+		if (in_array($role, $this->identificationExempt)) {
+			return false;
+		}
 
-        return true;
-    }
+		return true;
+	}
 }

includes/Security/CredentialProviders/ICredentialProvider.php

Indentation +15 added lines, -15 removed lines

@@ -12,20 +12,20 @@
 
 interface ICredentialProvider
 {
-    /**
-     * Validates a user-provided credential
-     *
-     * @param User $user The user to test the authentication against
-     * @param string $data The raw credential data to be validated
-     *
-     * @return bool
-     */
-    public function authenticate(User $user, $data);
+	/**
+	 * Validates a user-provided credential
+	 *
+	 * @param User $user The user to test the authentication against
+	 * @param string $data The raw credential data to be validated
+	 *
+	 * @return bool
+	 */
+	public function authenticate(User $user, $data);
 
-    /**
-     * @param User $user The user the credential belongs to
-     * @param int $factor The factor this credential provides
-     * @param string $data
-     */
-    public function setCredential(User $user, $factor, $data);
+	/**
+	 * @param User $user The user the credential belongs to
+	 * @param int $factor The factor this credential provides
+	 * @param string $data
+	 */
+	public function setCredential(User $user, $factor, $data);
 }
\ No newline at end of file

includes/Security/CredentialProviders/PasswordCredentialProvider.php

Indentation +46 added lines, -46 removed lines

@@ -14,50 +14,50 @@
 
 class PasswordCredentialProvider extends CredentialProviderBase
 {
-    const PASSWORD_COST = 10;
-
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
-    {
-        parent::__construct($database, $configuration, 'password');
-    }
-
-    public function authenticate(User $user, $data)
-    {
-        $storedData = $this->getCredentialData($user->getId());
-        if($storedData === null)
-        {
-            // No available credential matching these parameters
-            return false;
-        }
-
-        if($storedData->getVersion() !== 2) {
-            // Non-2 versions are not supported.
-            return false;
-        }
-
-        if(password_verify($data, $storedData->getData())) {
-            if(password_needs_rehash($storedData->getData(), PASSWORD_BCRYPT, array('cost' => self::PASSWORD_COST))){
-                $this->setCredential($user, $storedData->getFactor(), $data);
-            }
-
-            return true;
-        }
-
-        return false;
-    }
-
-    public function setCredential(User $user, $factor, $password)
-    {
-        $storedData = $this->getCredentialData($user->getId());
-
-        if($storedData === null){
-            $storedData = $this->createNewCredential($user);
-        }
-
-        $storedData->setData(password_hash($password, PASSWORD_BCRYPT, array('cost' => self::PASSWORD_COST)));
-        $storedData->setFactor($factor);
-        $storedData->setVersion(2);
-
-        $storedData->save();
-    }
+	const PASSWORD_COST = 10;
+
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
+	{
+		parent::__construct($database, $configuration, 'password');
+	}
+
+	public function authenticate(User $user, $data)
+	{
+		$storedData = $this->getCredentialData($user->getId());
+		if($storedData === null)
+		{
+			// No available credential matching these parameters
+			return false;
+		}
+
+		if($storedData->getVersion() !== 2) {
+			// Non-2 versions are not supported.
+			return false;
+		}
+
+		if(password_verify($data, $storedData->getData())) {
+			if(password_needs_rehash($storedData->getData(), PASSWORD_BCRYPT, array('cost' => self::PASSWORD_COST))){
+				$this->setCredential($user, $storedData->getFactor(), $data);
+			}
+
+			return true;
+		}
+
+		return false;
+	}
+
+	public function setCredential(User $user, $factor, $password)
+	{
+		$storedData = $this->getCredentialData($user->getId());
+
+		if($storedData === null){
+			$storedData = $this->createNewCredential($user);
+		}
+
+		$storedData->setData(password_hash($password, PASSWORD_BCRYPT, array('cost' => self::PASSWORD_COST)));
+		$storedData->setFactor($factor);
+		$storedData->setVersion(2);
+
+		$storedData->save();
+	}
 }
\ No newline at end of file

includes/Security/CredentialProviders/CredentialProviderBase.php

Indentation +69 added lines, -69 removed lines

@@ -15,85 +15,85 @@
 
 abstract class CredentialProviderBase implements ICredentialProvider
 {
-    /**
-     * @var PdoDatabase
-     */
-    private $database;
-    /**
-     * @var SiteConfiguration
-     */
-    private $configuration;
-    /** @var string */
-    private $type;
+	/**
+	 * @var PdoDatabase
+	 */
+	private $database;
+	/**
+	 * @var SiteConfiguration
+	 */
+	private $configuration;
+	/** @var string */
+	private $type;
 
-    /**
-     * CredentialProviderBase constructor.
-     *
-     * @param PdoDatabase       $database
-     * @param SiteConfiguration $configuration
-     * @param string            $type
-     */
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration, $type)
-    {
-        $this->database = $database;
-        $this->configuration = $configuration;
-        $this->type = $type;
-    }
+	/**
+	 * CredentialProviderBase constructor.
+	 *
+	 * @param PdoDatabase       $database
+	 * @param SiteConfiguration $configuration
+	 * @param string            $type
+	 */
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration, $type)
+	{
+		$this->database = $database;
+		$this->configuration = $configuration;
+		$this->type = $type;
+	}
 
-    /**
-     * @param int $userId
-     *
-     * @return Credential
-     */
-    protected function getCredentialData($userId)
-    {
-        $sql = 'SELECT * FROM credential WHERE type = :t AND user = :u AND disabled = 0';
+	/**
+	 * @param int $userId
+	 *
+	 * @return Credential
+	 */
+	protected function getCredentialData($userId)
+	{
+		$sql = 'SELECT * FROM credential WHERE type = :t AND user = :u AND disabled = 0';
 
-        $statement = $this->database->prepare($sql);
-        $statement->execute(array(':u' => $userId, ':t' => $this->type));
+		$statement = $this->database->prepare($sql);
+		$statement->execute(array(':u' => $userId, ':t' => $this->type));
 
-        /** @var Credential $obj */
-        $obj = $statement->fetchObject(Credential::class);
+		/** @var Credential $obj */
+		$obj = $statement->fetchObject(Credential::class);
 
-        if ($obj === false) {
-            return null;
-        }
+		if ($obj === false) {
+			return null;
+		}
 
-        $obj->setDatabase($this->database);
+		$obj->setDatabase($this->database);
 
-        $statement->closeCursor();
+		$statement->closeCursor();
 
-        return $obj;
-    }
+		return $obj;
+	}
 
-    /**
-     * @return PdoDatabase
-     */
-    public function getDatabase()
-    {
-        return $this->database;
-    }
+	/**
+	 * @return PdoDatabase
+	 */
+	public function getDatabase()
+	{
+		return $this->database;
+	}
 
-    /**
-     * @return SiteConfiguration
-     */
-    public function getConfiguration()
-    {
-        return $this->configuration;
-    }
+	/**
+	 * @return SiteConfiguration
+	 */
+	public function getConfiguration()
+	{
+		return $this->configuration;
+	}
 
-    /**
-     * @param User $user
-     *
-     * @return Credential
-     */
-    protected function createNewCredential(User $user)
-    {
-        $credential = new Credential();
-        $credential->setDatabase($this->getDatabase());
-        $credential->setUserId($user->getId());
-        $credential->setType($this->type);
+	/**
+	 * @param User $user
+	 *
+	 * @return Credential
+	 */
+	protected function createNewCredential(User $user)
+	{
+		$credential = new Credential();
+		$credential->setDatabase($this->getDatabase());
+		$credential->setUserId($user->getId());
+		$credential->setType($this->type);
 
-        return $credential;
-    }
+		return $credential;
+	}
 }
\ No newline at end of file

includes/API/Actions/StatsAction.php

Indentation +44 added lines, -44 removed lines

@@ -20,58 +20,58 @@
  */
 class StatsAction extends ApiPageBase implements IApiAction
 {
-    /**
-     * The target user
-     * @var User $user
-     */
-    private $user;
+	/**
+	 * The target user
+	 * @var User $user
+	 */
+	private $user;
 
-    /**
-     * Summary of execute
-     *
-     * @param \DOMElement $apiDocument
-     *
-     * @return \DOMElement
-     * @throws ApiException
-     * @throws \Exception
-     */
-    public function executeApiAction(\DOMElement $apiDocument)
-    {
-        $username = WebRequest::getString('user');
-        $wikiusername = WebRequest::getString('wikiuser');
+	/**
+	 * Summary of execute
+	 *
+	 * @param \DOMElement $apiDocument
+	 *
+	 * @return \DOMElement
+	 * @throws ApiException
+	 * @throws \Exception
+	 */
+	public function executeApiAction(\DOMElement $apiDocument)
+	{
+		$username = WebRequest::getString('user');
+		$wikiusername = WebRequest::getString('wikiuser');
 
-        if ($username === null && $wikiusername === null) {
-            throw new ApiException("Please specify a username using either user or wikiuser parameters.");
-        }
+		if ($username === null && $wikiusername === null) {
+			throw new ApiException("Please specify a username using either user or wikiuser parameters.");
+		}
 
-        $userElement = $this->document->createElement("user");
-        $apiDocument->appendChild($userElement);
+		$userElement = $this->document->createElement("user");
+		$apiDocument->appendChild($userElement);
 
-        if ($username !== null) {
-            $user = User::getByUsername($username, $this->getDatabase());
-        }
-        else {
-            $user = User::getByOnWikiUsername($wikiusername, $this->getDatabase());
-        }
+		if ($username !== null) {
+			$user = User::getByUsername($username, $this->getDatabase());
+		}
+		else {
+			$user = User::getByOnWikiUsername($wikiusername, $this->getDatabase());
+		}
 
-        if ($user === false) {
-            $userElement->setAttribute("missing", "true");
+		if ($user === false) {
+			$userElement->setAttribute("missing", "true");
 
-            return $apiDocument;
-        }
+			return $apiDocument;
+		}
 
-        $this->user = $user;
+		$this->user = $user;
 
-        $oauth = new OAuthUserHelper($user, $this->getDatabase(), $this->getOAuthProtocolHelper(),
-            $this->getSiteConfiguration());
+		$oauth = new OAuthUserHelper($user, $this->getDatabase(), $this->getOAuthProtocolHelper(),
+			$this->getSiteConfiguration());
 
-        $userElement->setAttribute("username", $this->user->getUsername());
-        $userElement->setAttribute("status", $this->user->getStatus());
-        $userElement->setAttribute("lastactive", $this->user->getLastActive());
-        $userElement->setAttribute("welcome_template", $this->user->getWelcomeTemplate());
-        $userElement->setAttribute("onwikiname", $this->user->getOnWikiName());
-        $userElement->setAttribute("oauth", $oauth->isFullyLinked() ? "true" : "false");
+		$userElement->setAttribute("username", $this->user->getUsername());
+		$userElement->setAttribute("status", $this->user->getStatus());
+		$userElement->setAttribute("lastactive", $this->user->getLastActive());
+		$userElement->setAttribute("welcome_template", $this->user->getWelcomeTemplate());
+		$userElement->setAttribute("onwikiname", $this->user->getOnWikiName());
+		$userElement->setAttribute("oauth", $oauth->isFullyLinked() ? "true" : "false");
 
-        return $apiDocument;
-    }
+		return $apiDocument;
+	}
 }

includes/Helpers/BotMediaWikiClient.php

Indentation +132 added lines, -132 removed lines

@@ -16,136 +16,136 @@
 
 class BotMediaWikiClient implements IMediaWikiClient
 {
-    /**
-     * @var HttpHelper
-     */
-    private $httpHelper;
-    /** @var string */
-    private $mediawikiWebServiceEndpoint;
-    /** @var string */
-    private $creationBotUsername;
-    /** @var string */
-    private $creationBotPassword;
-    /** @var bool */
-    private $knownLoggedIn = false;
-
-    /**
-     * BotMediaWikiClient constructor.
-     *
-     * @param SiteConfiguration $siteConfiguration
-     */
-    public function __construct(SiteConfiguration $siteConfiguration)
-    {
-        $this->mediawikiWebServiceEndpoint = $siteConfiguration->getMediawikiWebServiceEndpoint();
-
-        $this->creationBotUsername = $siteConfiguration->getCreationBotUsername();
-        $this->creationBotPassword = $siteConfiguration->getCreationBotPassword();
-
-        $this->httpHelper = new HttpHelper(
-            $siteConfiguration->getUserAgent(),
-            $siteConfiguration->getCurlDisableVerifyPeer(),
-            $siteConfiguration->getCurlCookieJar()
-        );
-    }
-
-    function doApiCall($apiParams, $method = 'GET')
-    {
-        $this->ensureLoggedIn();
-        $apiParams['assert'] = 'user';
-
-        return $this->callApi($apiParams, $method);
-    }
-
-    private function ensureLoggedIn()
-    {
-        if ($this->knownLoggedIn) {
-            return;
-        }
-
-        $userinfoResult = $this->callApi(array('action' => 'query', 'meta' => 'userinfo'), 'GET');
-        if (isset($userinfoResult->query->userinfo->anon)) {
-            // not logged in.
-            $this->logIn();
-
-            // retest
-            $userinfoResult = $this->callApi(array('action' => 'query', 'meta' => 'userinfo'), 'GET');
-            if (isset($userinfoResult->query->userinfo->anon)) {
-                throw new MediaWikiApiException('Unable to log in.');
-            }
-            else {
-                $this->knownLoggedIn = true;
-            }
-        }
-        else {
-            $this->knownLoggedIn = true;
-        }
-    }
-
-    /**
-     * @param $apiParams
-     * @param $method
-     *
-     * @return mixed
-     * @throws ApplicationLogicException
-     * @throws CurlException
-     */
-    private function callApi($apiParams, $method)
-    {
-        $apiParams['format'] = 'json';
-
-        if ($method == 'GET') {
-            $data = $this->httpHelper->get($this->mediawikiWebServiceEndpoint, $apiParams);
-        }
-        elseif ($method == 'POST') {
-            $data = $this->httpHelper->post($this->mediawikiWebServiceEndpoint, $apiParams);
-        }
-        else {
-            throw new ApplicationLogicException('Unsupported HTTP Method');
-        }
-
-        if ($data === false) {
-            throw new CurlException('Curl error: ' . $this->httpHelper->getError());
-        }
-
-        $result = json_decode($data);
-
-        return $result;
-    }
-
-    private function logIn()
-    {
-        // get token
-        $tokenParams = array(
-            'action' => 'query',
-            'meta'   => 'tokens',
-            'type'   => 'login',
-        );
-
-        $response = $this->callApi($tokenParams, 'POST');
-
-        if (isset($response->error)) {
-            throw new MediaWikiApiException($response->error->code . ': ' . $response->error->info);
-        }
-
-        $token = $response->query->tokens->logintoken;
-
-        if ($token === null) {
-            throw new MediaWikiApiException('Edit token could not be acquired');
-        }
-
-        $params = array(
-            'action' => 'login',
-            'lgname' => $this->creationBotUsername,
-            'lgpassword' => $this->creationBotPassword,
-            'lgtoken' => $token,
-        );
-
-        $loginResponse = $this->callApi($params, 'POST');
-
-        if($loginResponse->login->result == 'Success'){
-            return;
-        }
-
-        throw new ApplicationLogicException(json_encode($loginResponse));
-    }
+	/**
+	 * @var HttpHelper
+	 */
+	private $httpHelper;
+	/** @var string */
+	private $mediawikiWebServiceEndpoint;
+	/** @var string */
+	private $creationBotUsername;
+	/** @var string */
+	private $creationBotPassword;
+	/** @var bool */
+	private $knownLoggedIn = false;
+
+	/**
+	 * BotMediaWikiClient constructor.
+	 *
+	 * @param SiteConfiguration $siteConfiguration
+	 */
+	public function __construct(SiteConfiguration $siteConfiguration)
+	{
+		$this->mediawikiWebServiceEndpoint = $siteConfiguration->getMediawikiWebServiceEndpoint();
+
+		$this->creationBotUsername = $siteConfiguration->getCreationBotUsername();
+		$this->creationBotPassword = $siteConfiguration->getCreationBotPassword();
+
+		$this->httpHelper = new HttpHelper(
+			$siteConfiguration->getUserAgent(),
+			$siteConfiguration->getCurlDisableVerifyPeer(),
+			$siteConfiguration->getCurlCookieJar()
+		);
+	}
+
+	function doApiCall($apiParams, $method = 'GET')
+	{
+		$this->ensureLoggedIn();
+		$apiParams['assert'] = 'user';
+
+		return $this->callApi($apiParams, $method);
+	}
+
+	private function ensureLoggedIn()
+	{
+		if ($this->knownLoggedIn) {
+			return;
+		}
+
+		$userinfoResult = $this->callApi(array('action' => 'query', 'meta' => 'userinfo'), 'GET');
+		if (isset($userinfoResult->query->userinfo->anon)) {
+			// not logged in.
+			$this->logIn();
+
+			// retest
+			$userinfoResult = $this->callApi(array('action' => 'query', 'meta' => 'userinfo'), 'GET');
+			if (isset($userinfoResult->query->userinfo->anon)) {
+				throw new MediaWikiApiException('Unable to log in.');
+			}
+			else {
+				$this->knownLoggedIn = true;
+			}
+		}
+		else {
+			$this->knownLoggedIn = true;
+		}
+	}
+
+	/**
+	 * @param $apiParams
+	 * @param $method
+	 *
+	 * @return mixed
+	 * @throws ApplicationLogicException
+	 * @throws CurlException
+	 */
+	private function callApi($apiParams, $method)
+	{
+		$apiParams['format'] = 'json';
+
+		if ($method == 'GET') {
+			$data = $this->httpHelper->get($this->mediawikiWebServiceEndpoint, $apiParams);
+		}
+		elseif ($method == 'POST') {
+			$data = $this->httpHelper->post($this->mediawikiWebServiceEndpoint, $apiParams);
+		}
+		else {
+			throw new ApplicationLogicException('Unsupported HTTP Method');
+		}
+
+		if ($data === false) {
+			throw new CurlException('Curl error: ' . $this->httpHelper->getError());
+		}
+
+		$result = json_decode($data);
+
+		return $result;
+	}
+
+	private function logIn()
+	{
+		// get token
+		$tokenParams = array(
+			'action' => 'query',
+			'meta'   => 'tokens',
+			'type'   => 'login',
+		);
+
+		$response = $this->callApi($tokenParams, 'POST');
+
+		if (isset($response->error)) {
+			throw new MediaWikiApiException($response->error->code . ': ' . $response->error->info);
+		}
+
+		$token = $response->query->tokens->logintoken;
+
+		if ($token === null) {
+			throw new MediaWikiApiException('Edit token could not be acquired');
+		}
+
+		$params = array(
+			'action' => 'login',
+			'lgname' => $this->creationBotUsername,
+			'lgpassword' => $this->creationBotPassword,
+			'lgtoken' => $token,
+		);
+
+		$loginResponse = $this->callApi($params, 'POST');
+
+		if($loginResponse->login->result == 'Success'){
+			return;
+		}
+
+		throw new ApplicationLogicException(json_encode($loginResponse));
+	}
 }
\ No newline at end of file

includes/Helpers/OAuthUserHelper.php

Indentation +403 added lines, -403 removed lines

@@ -22,411 +22,411 @@
 
 class OAuthUserHelper implements IMediaWikiClient
 {
-    const TOKEN_REQUEST = 'request';
-    const TOKEN_ACCESS = 'access';
-    /** @var PDOStatement */
-    private static $tokenCountStatement = null;
-    /** @var PDOStatement */
-    private $getTokenStatement;
-    /**
-     * @var User
-     */
-    private $user;
-    /**
-     * @var PdoDatabase
-     */
-    private $database;
-    /**
-     * @var IOAuthProtocolHelper
-     */
-    private $oauthProtocolHelper;
-    /**
-     * @var bool|null Is the user linked to OAuth
-     */
-    private $linked;
-    private $partiallyLinked;
-    /** @var OAuthToken */
-    private $accessToken;
-    /** @var bool */
-    private $accessTokenLoaded = false;
-    /**
-     * @var OAuthIdentity
-     */
-    private $identity = null;
-    /**
-     * @var bool
-     */
-    private $identityLoaded = false;
-    /**
-     * @var SiteConfiguration
-     */
-    private $siteConfiguration;
-
-    #region Static methods
-    public static function findUserByRequestToken($requestToken, PdoDatabase $database)
-    {
-        $statement = $database->prepare(<<<'SQL'
+	const TOKEN_REQUEST = 'request';
+	const TOKEN_ACCESS = 'access';
+	/** @var PDOStatement */
+	private static $tokenCountStatement = null;
+	/** @var PDOStatement */
+	private $getTokenStatement;
+	/**
+	 * @var User
+	 */
+	private $user;
+	/**
+	 * @var PdoDatabase
+	 */
+	private $database;
+	/**
+	 * @var IOAuthProtocolHelper
+	 */
+	private $oauthProtocolHelper;
+	/**
+	 * @var bool|null Is the user linked to OAuth
+	 */
+	private $linked;
+	private $partiallyLinked;
+	/** @var OAuthToken */
+	private $accessToken;
+	/** @var bool */
+	private $accessTokenLoaded = false;
+	/**
+	 * @var OAuthIdentity
+	 */
+	private $identity = null;
+	/**
+	 * @var bool
+	 */
+	private $identityLoaded = false;
+	/**
+	 * @var SiteConfiguration
+	 */
+	private $siteConfiguration;
+
+	#region Static methods
+	public static function findUserByRequestToken($requestToken, PdoDatabase $database)
+	{
+		$statement = $database->prepare(<<<'SQL'
             SELECT u.* FROM user u 
             INNER JOIN oauthtoken t ON t.user = u.id 
             WHERE t.type = :type AND t.token = :token
 SQL
-        );
-        $statement->execute(array(':type' => self::TOKEN_REQUEST, ':token' => $requestToken));
-
-        /** @var User $user */
-        $user = $statement->fetchObject(User::class);
-        $statement->closeCursor();
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Token not found in store, please try again');
-        }
-
-        $user->setDatabase($database);
-
-        return $user;
-    }
-
-    public static function userIsFullyLinked(User $user, PdoDatabase $database = null)
-    {
-        if (self::$tokenCountStatement === null && $database === null) {
-            throw new ApplicationLogicException('Static link request without initialised statement');
-        }
-
-        return self::runTokenCount($user->getId(), $database, self::TOKEN_ACCESS);
-    }
-
-    public static function userIsPartiallyLinked(User $user, PdoDatabase $database = null)
-    {
-        if (self::$tokenCountStatement === null && $database === null) {
-            throw new ApplicationLogicException('Static link request without initialised statement');
-        }
-
-        if (self::userIsFullyLinked($user, $database)) {
-            return false;
-        }
-
-        return self::runTokenCount($user->getId(), $database, self::TOKEN_REQUEST)
-            || $user->getOnWikiName() == null;
-    }
-
-    /**
-     * @param PdoDatabase $database
-     */
-    public static function prepareTokenCountStatement(PdoDatabase $database)
-    {
-        if (self::$tokenCountStatement === null) {
-            self::$tokenCountStatement = $database->prepare('SELECT COUNT(*) FROM oauthtoken WHERE user = :user AND type = :type');
-        }
-    }
-
-    private static function runTokenCount($userId, $database, $tokenType)
-    {
-        if (self::$tokenCountStatement === null) {
-            self::prepareTokenCountStatement($database);
-        }
-
-        self::$tokenCountStatement->execute(array(
-            ':user' => $userId,
-            ':type' => $tokenType,
-        ));
-
-        $tokenCount = self::$tokenCountStatement->fetchColumn();
-        $linked = $tokenCount > 0;
-        self::$tokenCountStatement->closeCursor();
-
-        return $linked;
-    }
-
-    #endregion Static methods
-
-    /**
-     * OAuthUserHelper constructor.
-     *
-     * @param User                 $user
-     * @param PdoDatabase          $database
-     * @param IOAuthProtocolHelper $oauthProtocolHelper
-     * @param SiteConfiguration    $siteConfiguration
-     */
-    public function __construct(
-        User $user,
-        PdoDatabase $database,
-        IOAuthProtocolHelper $oauthProtocolHelper,
-        SiteConfiguration $siteConfiguration
-    ) {
-        $this->user = $user;
-        $this->database = $database;
-        $this->oauthProtocolHelper = $oauthProtocolHelper;
-
-        $this->linked = null;
-        $this->partiallyLinked = null;
-        $this->siteConfiguration = $siteConfiguration;
-
-        self::prepareTokenCountStatement($database);
-        $this->getTokenStatement = $this->database->prepare('SELECT * FROM oauthtoken WHERE user = :user AND type = :type');
-    }
-
-    /**
-     * Determines if the user is fully connected to OAuth.
-     *
-     * @return bool
-     */
-    public function isFullyLinked()
-    {
-        if ($this->linked === null) {
-            $this->linked = self::userIsFullyLinked($this->user, $this->database);
-        }
-
-        return $this->linked;
-    }
-
-    /**
-     * Attempts to figure out if a user is partially linked to OAuth, and therefore needs to complete the OAuth
-     * procedure before configuring.
-     * @return bool
-     */
-    public function isPartiallyLinked()
-    {
-        if ($this->partiallyLinked === null) {
-            $this->partiallyLinked = self::userIsPartiallyLinked($this->user, $this->database);
-        }
-
-        return $this->partiallyLinked;
-    }
-
-    /**
-     * @throws OAuthException
-     */
-    public function refreshIdentity()
-    {
-        $this->loadIdentity();
-
-        if ($this->identity === null) {
-            $this->identity = new OAuthIdentity();
-            $this->identity->setUserId($this->user->getId());
-            $this->identity->setDatabase($this->database);
-        }
-
-        $token = $this->loadAccessToken();
-
-        $rawTicket = $this->oauthProtocolHelper->getIdentityTicket($token->getToken(), $token->getSecret());
-
-        $this->identity->populate($rawTicket);
-
-        if (!$this->identityIsValid()) {
-            throw new OAuthException('Identity ticket is not valid!');
-        }
-
-        $this->identity->save();
-
-        $this->user->setOnWikiName($this->identity->getUsername());
-        $this->user->save();
-    }
-
-    public function getRequestToken()
-    {
-        $token = $this->oauthProtocolHelper->getRequestToken();
-
-        $this->partiallyLinked = true;
-        $this->linked = false;
-
-        $this->database
-            ->prepare('DELETE FROM oauthtoken WHERE user = :user AND type = :type')
-            ->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
-
-        $this->database
-            ->prepare('INSERT INTO oauthtoken (user, type, token, secret, expiry) VALUES (:user, :type, :token, :secret, DATE_ADD(NOW(), INTERVAL 1 DAY))')
-            ->execute(array(
-                ':user'   => $this->user->getId(),
-                ':type'   => self::TOKEN_REQUEST,
-                ':token'  => $token->key,
-                ':secret' => $token->secret,
-            ));
-
-        return $this->oauthProtocolHelper->getAuthoriseUrl($token->key);
-    }
-
-    public function completeHandshake($verificationToken)
-    {
-        $this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
-
-        /** @var OAuthToken $token */
-        $token = $this->getTokenStatement->fetchObject(OAuthToken::class);
-        $this->getTokenStatement->closeCursor();
-
-        if ($token === false) {
-            throw new ApplicationLogicException('Cannot find request token');
-        }
-
-        $token->setDatabase($this->database);
-
-        $accessToken = $this->oauthProtocolHelper->callbackCompleted($token->getToken(), $token->getSecret(),
-            $verificationToken);
-
-        $clearStatement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :u AND type = :t');
-        $clearStatement->execute(array(':u' => $this->user->getId(), ':t' => self::TOKEN_ACCESS));
-
-        $token->setToken($accessToken->key);
-        $token->setSecret($accessToken->secret);
-        $token->setType(self::TOKEN_ACCESS);
-        $token->setExpiry(null);
-        $token->save();
-
-        $this->partiallyLinked = false;
-        $this->linked = true;
-
-        $this->refreshIdentity();
-    }
-
-    public function detach()
-    {
-        $this->loadIdentity();
-
-        $this->identity->delete();
-        $statement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :user');
-        $statement->execute(array(':user' => $this->user->getId()));
-
-        $this->identity = null;
-        $this->linked = false;
-        $this->partiallyLinked = false;
-    }
-
-    /**
-     * @param bool $expiredOk
-     *
-     * @return OAuthIdentity
-     * @throws OAuthException
-     */
-    public function getIdentity($expiredOk = false)
-    {
-        $this->loadIdentity();
-
-        if (!$this->identityIsValid($expiredOk)) {
-            throw new OAuthException('Stored identity is not valid.');
-        }
-
-        return $this->identity;
-    }
-
-    public function doApiCall($params, $method)
-    {
-        // Ensure we're logged in
-        $params['assert'] = 'user';
-
-        $token = $this->loadAccessToken();
-        return $this->oauthProtocolHelper->apiCall($params, $token->getToken(), $token->getSecret(), $method);
-    }
-
-    /**
-     * @param bool $expiredOk
-     *
-     * @return bool
-     */
-    private function identityIsValid($expiredOk = false)
-    {
-        $this->loadIdentity();
-
-        if ($this->identity === null) {
-            return false;
-        }
-
-        if ($this->identity->getIssuedAtTime() === false
-            || $this->identity->getExpirationTime() === false
-            || $this->identity->getAudience() === false
-            || $this->identity->getIssuer() === false
-        ) {
-            // this isn't populated properly.
-            return false;
-        }
-
-        $issue = DateTimeImmutable::createFromFormat("U", $this->identity->getIssuedAtTime());
-        $now = new DateTimeImmutable();
-
-        if ($issue > $now) {
-            // wat.
-            return false;
-        }
-
-        if ($this->identityExpired() && !$expiredOk) {
-            // soz.
-            return false;
-        }
-
-        if ($this->identity->getAudience() !== $this->siteConfiguration->getOAuthConsumerToken()) {
-            // token not issued for us
-            return false;
-        }
-
-        if ($this->identity->getIssuer() !== $this->siteConfiguration->getOauthMediaWikiCanonicalServer()) {
-            // token not issued by the right person
-            return false;
-        }
-
-        // can't find a reason to not trust it
-        return true;
-    }
-
-    /**
-     * @return bool
-     */
-    public function identityExpired()
-    {
-        // allowed max age
-        $gracePeriod = $this->siteConfiguration->getOauthIdentityGraceTime();
-
-        $expiry = DateTimeImmutable::createFromFormat("U", $this->identity->getExpirationTime());
-        $graceExpiry = $expiry->modify($gracePeriod);
-        $now = new DateTimeImmutable();
-
-        return $graceExpiry < $now;
-    }
-
-    /**
-     * Loads the OAuth identity from the database for the current user.
-     */
-    private function loadIdentity()
-    {
-        if ($this->identityLoaded) {
-            return;
-        }
-
-        $statement = $this->database->prepare('SELECT * FROM oauthidentity WHERE user = :user');
-        $statement->execute(array(':user' => $this->user->getId()));
-        /** @var OAuthIdentity $obj */
-        $obj = $statement->fetchObject(OAuthIdentity::class);
-
-        if ($obj === false) {
-            // failed to load identity.
-            $this->identityLoaded = true;
-            $this->identity = null;
-
-            return;
-        }
-
-        $obj->setDatabase($this->database);
-        $this->identityLoaded = true;
-        $this->identity = $obj;
-    }
-
-    /**
-     * @return OAuthToken
-     * @throws OAuthException
-     */
-    private function loadAccessToken()
-    {
-        if (!$this->accessTokenLoaded) {
-            $this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_ACCESS));
-            /** @var OAuthToken $token */
-            $token = $this->getTokenStatement->fetchObject(OAuthToken::class);
-            $this->getTokenStatement->closeCursor();
-
-            if ($token === false) {
-                throw new OAuthException('Access token not found!');
-            }
-
-            $this->accessToken = $token;
-            $this->accessTokenLoaded = true;
-        }
-
-        return $this->accessToken;
-    }
+		);
+		$statement->execute(array(':type' => self::TOKEN_REQUEST, ':token' => $requestToken));
+
+		/** @var User $user */
+		$user = $statement->fetchObject(User::class);
+		$statement->closeCursor();
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Token not found in store, please try again');
+		}
+
+		$user->setDatabase($database);
+
+		return $user;
+	}
+
+	public static function userIsFullyLinked(User $user, PdoDatabase $database = null)
+	{
+		if (self::$tokenCountStatement === null && $database === null) {
+			throw new ApplicationLogicException('Static link request without initialised statement');
+		}
+
+		return self::runTokenCount($user->getId(), $database, self::TOKEN_ACCESS);
+	}
+
+	public static function userIsPartiallyLinked(User $user, PdoDatabase $database = null)
+	{
+		if (self::$tokenCountStatement === null && $database === null) {
+			throw new ApplicationLogicException('Static link request without initialised statement');
+		}
+
+		if (self::userIsFullyLinked($user, $database)) {
+			return false;
+		}
+
+		return self::runTokenCount($user->getId(), $database, self::TOKEN_REQUEST)
+			|| $user->getOnWikiName() == null;
+	}
+
+	/**
+	 * @param PdoDatabase $database
+	 */
+	public static function prepareTokenCountStatement(PdoDatabase $database)
+	{
+		if (self::$tokenCountStatement === null) {
+			self::$tokenCountStatement = $database->prepare('SELECT COUNT(*) FROM oauthtoken WHERE user = :user AND type = :type');
+		}
+	}
+
+	private static function runTokenCount($userId, $database, $tokenType)
+	{
+		if (self::$tokenCountStatement === null) {
+			self::prepareTokenCountStatement($database);
+		}
+
+		self::$tokenCountStatement->execute(array(
+			':user' => $userId,
+			':type' => $tokenType,
+		));
+
+		$tokenCount = self::$tokenCountStatement->fetchColumn();
+		$linked = $tokenCount > 0;
+		self::$tokenCountStatement->closeCursor();
+
+		return $linked;
+	}
+
+	#endregion Static methods
+
+	/**
+	 * OAuthUserHelper constructor.
+	 *
+	 * @param User                 $user
+	 * @param PdoDatabase          $database
+	 * @param IOAuthProtocolHelper $oauthProtocolHelper
+	 * @param SiteConfiguration    $siteConfiguration
+	 */
+	public function __construct(
+		User $user,
+		PdoDatabase $database,
+		IOAuthProtocolHelper $oauthProtocolHelper,
+		SiteConfiguration $siteConfiguration
+	) {
+		$this->user = $user;
+		$this->database = $database;
+		$this->oauthProtocolHelper = $oauthProtocolHelper;
+
+		$this->linked = null;
+		$this->partiallyLinked = null;
+		$this->siteConfiguration = $siteConfiguration;
+
+		self::prepareTokenCountStatement($database);
+		$this->getTokenStatement = $this->database->prepare('SELECT * FROM oauthtoken WHERE user = :user AND type = :type');
+	}
+
+	/**
+	 * Determines if the user is fully connected to OAuth.
+	 *
+	 * @return bool
+	 */
+	public function isFullyLinked()
+	{
+		if ($this->linked === null) {
+			$this->linked = self::userIsFullyLinked($this->user, $this->database);
+		}
+
+		return $this->linked;
+	}
+
+	/**
+	 * Attempts to figure out if a user is partially linked to OAuth, and therefore needs to complete the OAuth
+	 * procedure before configuring.
+	 * @return bool
+	 */
+	public function isPartiallyLinked()
+	{
+		if ($this->partiallyLinked === null) {
+			$this->partiallyLinked = self::userIsPartiallyLinked($this->user, $this->database);
+		}
+
+		return $this->partiallyLinked;
+	}
+
+	/**
+	 * @throws OAuthException
+	 */
+	public function refreshIdentity()
+	{
+		$this->loadIdentity();
+
+		if ($this->identity === null) {
+			$this->identity = new OAuthIdentity();
+			$this->identity->setUserId($this->user->getId());
+			$this->identity->setDatabase($this->database);
+		}
+
+		$token = $this->loadAccessToken();
+
+		$rawTicket = $this->oauthProtocolHelper->getIdentityTicket($token->getToken(), $token->getSecret());
+
+		$this->identity->populate($rawTicket);
+
+		if (!$this->identityIsValid()) {
+			throw new OAuthException('Identity ticket is not valid!');
+		}
+
+		$this->identity->save();
+
+		$this->user->setOnWikiName($this->identity->getUsername());
+		$this->user->save();
+	}
+
+	public function getRequestToken()
+	{
+		$token = $this->oauthProtocolHelper->getRequestToken();
+
+		$this->partiallyLinked = true;
+		$this->linked = false;
+
+		$this->database
+			->prepare('DELETE FROM oauthtoken WHERE user = :user AND type = :type')
+			->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
+
+		$this->database
+			->prepare('INSERT INTO oauthtoken (user, type, token, secret, expiry) VALUES (:user, :type, :token, :secret, DATE_ADD(NOW(), INTERVAL 1 DAY))')
+			->execute(array(
+				':user'   => $this->user->getId(),
+				':type'   => self::TOKEN_REQUEST,
+				':token'  => $token->key,
+				':secret' => $token->secret,
+			));
+
+		return $this->oauthProtocolHelper->getAuthoriseUrl($token->key);
+	}
+
+	public function completeHandshake($verificationToken)
+	{
+		$this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
+
+		/** @var OAuthToken $token */
+		$token = $this->getTokenStatement->fetchObject(OAuthToken::class);
+		$this->getTokenStatement->closeCursor();
+
+		if ($token === false) {
+			throw new ApplicationLogicException('Cannot find request token');
+		}
+
+		$token->setDatabase($this->database);
+
+		$accessToken = $this->oauthProtocolHelper->callbackCompleted($token->getToken(), $token->getSecret(),
+			$verificationToken);
+
+		$clearStatement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :u AND type = :t');
+		$clearStatement->execute(array(':u' => $this->user->getId(), ':t' => self::TOKEN_ACCESS));
+
+		$token->setToken($accessToken->key);
+		$token->setSecret($accessToken->secret);
+		$token->setType(self::TOKEN_ACCESS);
+		$token->setExpiry(null);
+		$token->save();
+
+		$this->partiallyLinked = false;
+		$this->linked = true;
+
+		$this->refreshIdentity();
+	}
+
+	public function detach()
+	{
+		$this->loadIdentity();
+
+		$this->identity->delete();
+		$statement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :user');
+		$statement->execute(array(':user' => $this->user->getId()));
+
+		$this->identity = null;
+		$this->linked = false;
+		$this->partiallyLinked = false;
+	}
+
+	/**
+	 * @param bool $expiredOk
+	 *
+	 * @return OAuthIdentity
+	 * @throws OAuthException
+	 */
+	public function getIdentity($expiredOk = false)
+	{
+		$this->loadIdentity();
+
+		if (!$this->identityIsValid($expiredOk)) {
+			throw new OAuthException('Stored identity is not valid.');
+		}
+
+		return $this->identity;
+	}
+
+	public function doApiCall($params, $method)
+	{
+		// Ensure we're logged in
+		$params['assert'] = 'user';
+
+		$token = $this->loadAccessToken();
+		return $this->oauthProtocolHelper->apiCall($params, $token->getToken(), $token->getSecret(), $method);
+	}
+
+	/**
+	 * @param bool $expiredOk
+	 *
+	 * @return bool
+	 */
+	private function identityIsValid($expiredOk = false)
+	{
+		$this->loadIdentity();
+
+		if ($this->identity === null) {
+			return false;
+		}
+
+		if ($this->identity->getIssuedAtTime() === false
+			|| $this->identity->getExpirationTime() === false
+			|| $this->identity->getAudience() === false
+			|| $this->identity->getIssuer() === false
+		) {
+			// this isn't populated properly.
+			return false;
+		}
+
+		$issue = DateTimeImmutable::createFromFormat("U", $this->identity->getIssuedAtTime());
+		$now = new DateTimeImmutable();
+
+		if ($issue > $now) {
+			// wat.
+			return false;
+		}
+
+		if ($this->identityExpired() && !$expiredOk) {
+			// soz.
+			return false;
+		}
+
+		if ($this->identity->getAudience() !== $this->siteConfiguration->getOAuthConsumerToken()) {
+			// token not issued for us
+			return false;
+		}
+
+		if ($this->identity->getIssuer() !== $this->siteConfiguration->getOauthMediaWikiCanonicalServer()) {
+			// token not issued by the right person
+			return false;
+		}
+
+		// can't find a reason to not trust it
+		return true;
+	}
+
+	/**
+	 * @return bool
+	 */
+	public function identityExpired()
+	{
+		// allowed max age
+		$gracePeriod = $this->siteConfiguration->getOauthIdentityGraceTime();
+
+		$expiry = DateTimeImmutable::createFromFormat("U", $this->identity->getExpirationTime());
+		$graceExpiry = $expiry->modify($gracePeriod);
+		$now = new DateTimeImmutable();
+
+		return $graceExpiry < $now;
+	}
+
+	/**
+	 * Loads the OAuth identity from the database for the current user.
+	 */
+	private function loadIdentity()
+	{
+		if ($this->identityLoaded) {
+			return;
+		}
+
+		$statement = $this->database->prepare('SELECT * FROM oauthidentity WHERE user = :user');
+		$statement->execute(array(':user' => $this->user->getId()));
+		/** @var OAuthIdentity $obj */
+		$obj = $statement->fetchObject(OAuthIdentity::class);
+
+		if ($obj === false) {
+			// failed to load identity.
+			$this->identityLoaded = true;
+			$this->identity = null;
+
+			return;
+		}
+
+		$obj->setDatabase($this->database);
+		$this->identityLoaded = true;
+		$this->identity = $obj;
+	}
+
+	/**
+	 * @return OAuthToken
+	 * @throws OAuthException
+	 */
+	private function loadAccessToken()
+	{
+		if (!$this->accessTokenLoaded) {
+			$this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_ACCESS));
+			/** @var OAuthToken $token */
+			$token = $this->getTokenStatement->fetchObject(OAuthToken::class);
+			$this->getTokenStatement->closeCursor();
+
+			if ($token === false) {
+				throw new OAuthException('Access token not found!');
+			}
+
+			$this->accessToken = $token;
+			$this->accessTokenLoaded = true;
+		}
+
+		return $this->accessToken;
+	}
 }
\ No newline at end of file