Oidc - Code Metrics - gyselroth/micro - Measure and Improve Code Quality continuously with Scrutinizer

Oidc A
last analyzed 2017-12-11 11:42 UTC

↳ Parent: Project

Complexity

Total Complexity

Size/Duplication

Total Lines	290
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	3

Importance

Changes

Metric	Value
wmc	26
lcom	1
cbo	3
dl	0
loc	290
rs	10
c	0
b	0
f	0

7 Methods

Rating	Name	Size	Complexity
A	__construct()	5	1
B	setOptions()	19	6
B	authenticate()	27	3
A	getDiscoveryUrl()	4	1
B	getDiscoveryDocument()	39	5
B	verifyToken()	56	6
B	getAttributes()	40	4

<?php
declare(strict_types = 1);

/**
 * Micro
 *
 * @author    Raffael Sahli <[email protected]>
 * @copyright Copyright (c) 2017 gyselroth GmbH (https://gyselroth.com)
 * @license   MIT https://opensource.org/licenses/MIT
 */

namespace Micro\Auth\Adapter;

use \Psr\Log\LoggerInterface;
use \Micro\Auth\Exception;

class Oidc extends AbstractAdapter
{
    /**
     * OpenID-connect discovery path
     */
    CONST DISCOVERY_PATH = '/.well-known/openid-configuration';


    /**
     * OpenID-connect provider url
     *
     * @var string
     */
    protected $provider_url = 'https://oidc.example.org';


    /**
     * Token validation endpoint (rfc7662)
     *
     * @var string
     */
    protected $token_validation_url;


    /**
     * Identity attribute
     *
     * @var string
     */
    protected $identity_attribute = 'preferred_username';


    /**
     * Attributes
     *
     * @var array
     */
    protected $attributes = [];


    /**
     * Access token
     *
     * @var string
     */
    private $access_token;


    /**
     * Init adapter
     *
     * @param   LoggerInterface $logger
     * @param   Iterable $config
     * @return  void

     */
    public function __construct(LoggerInterface $logger, ?Iterable $config=null)
    {
        $this->logger = $logger;
        $this->setOptions($config);
    }


    /**
     * Set options
     *
     * @param   Iterable $config
     * @return  AdapterInterface
     */
    public function setOptions(? Iterable $config = null) : AdapterInterface
    {
        if ($config === null) {
            return $this;
        }

        foreach($config as $option => $value) {
            switch($option) {
                case 'provider_url':
switch ($expr) {
    case "A": { //wrong
        doSomething();
        break;
    }
    case "B"; //wrong
        doSomething();
        break;
    case "C": //right
        doSomething();
        break;
}
                case 'token_validation_url':
                case 'identity_attribute':
                    $this->{$option} = (string)$value;
                    unset($config[$option]);
                break;
            }
        }

        return  parent::setOptions($config);
    }


    /**
     * Authenticate
     *
     * @return bool
     */
    public function authenticate(): bool
    {
        if (!isset($_SERVER['HTTP_AUTHORIZATION'])) {
            $this->logger->debug('skip auth adapter ['.get_class($this).'], no http authorization header or access_token param found', [
                'category' => get_class($this)
            ]);

            return false;
        } else {
            $header = $_SERVER['HTTP_AUTHORIZATION'];
            $parts  = explode(' ', $header);

            if ($parts[0] == 'Bearer') {
                $this->logger->debug('found http bearer authorization header', [
                    'category' => get_class($this)
                ]);

                return $this->verifyToken($parts[1]);
            } else {
                $this->logger->debug('http authorization header contains no bearer string or invalid authentication string', [
                    'category' => get_class($this)
                ]);

                return false;
            }
        }
    }


    /**
     * Get discovery url
     *
     * @return string
     */
    public function getDiscoveryUrl(): string
    {
        return $this->provider_url.self::DISCOVERY_PATH;
    }


    /**
     * Get discovery document
     *
     * @return array
     */
    public function getDiscoveryDocument(): array
    {
        if ($apc = extension_loaded('apc') && apc_exists($this->provider_url)) {

            return apc_get($this->provider_url);
        } else {
            $ch = curl_init();
            $url = $this->getDiscoveryUrl();
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

            $this->logger->debug('fetch openid-connect discovery document from ['.$url.']', [
                'category' => get_class($this)
            ]);

            $result = curl_exec($ch);
            $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);

            if($code === 200) {
                $discovery = json_decode($result, true);
                $this->logger->debug('received openid-connect discovery document from ['.$url.']', [
                    'category' => get_class($this),
                    'discovery'=> $discovery
                ]);

                if ($apc === true) {
                    apc_store($this->provider_url, $discovery);
                }

                return $discovery;
            } else {
                $this->logger->error('failed to receive openid-connect discovery document from ['.$url.'], request ended with status ['.$code.']', [
                    'category' => get_class($this),
                ]);

                throw new Exception('failed to get openid-connect discovery document');
            }
        }
    }


    /**
     * Token verification
     *
     * @param   string $token
     * @return  bool
     */
    protected function verifyToken(string $token): bool
    {
        if($this->token_validation_url) {
            $this->logger->debug('validate oauth2 token via rfc7662 token validation endpoint ['.$this->token_validation_url.']', [
               'category' => get_class($this),
            ]);

            $url = str_replace('{token}', $token, $this->token_validation_url);
        } else {
            $discovery = $this->getDiscoveryDocument();
            if (!(isset($discovery['userinfo_endpoint']))) {
                throw new Exception('userinfo_endpoint could not be determained');
            }

            $this->logger->debug('validate token via openid-connect userinfo_endpoint ['.$discovery['userinfo_endpoint'].']', [
               'category' => get_class($this),
            ]);

            $url = $discovery['userinfo_endpoint'].'?access_token='.$token;
        }

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $result = curl_exec($ch);
        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        $response = json_decode($result, true);
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

        if($code === 200) {
            $attributes = json_decode($result, true);
            $this->logger->debug('successfully verified oauth2 access token via authorization server', [
               'category' => get_class($this),
            ]);

            if(!isset($attributes[$this->identity_attribute])) {
                throw new Exception('identity attribute '.$this->identity_attribute.' not found in oauth2 response');
            }

            $this->identifier = $attributes['preferred_username'];

            if($this->token_validation_url) {
                $this->attributes = $attributes;
            } else {
                $this->access_token = $token;
            }

            return true;
        } else {
            $this->logger->error('failed verify oauth2 access token via authorization server, received status ['.$code.']', [
               'category' => get_class($this),
            ]);

            throw new Exception('failed verify oauth2 access token via authorization server');
        }
    }


    /**
     * Get attributes
     *
     * @return array
     */
    public function getAttributes(): array
    {
        if(count($this->attributes) !== 0) {
            return $this->attributes;
        }

        $discovery = $this->getDiscoveryDocument();
        if (!(isset($discovery['authorization_endpoint']))) {
            throw new Exception('authorization_endpoint could not be determained');
        }

        $this->logger->debug('fetch user attributes from userinfo_endpoint ['.$discovery['userinfo_endpoint'].']', [
           'category' => get_class($this),
        ]);

        $url = $discovery['userinfo_endpoint'].'?access_token='.$this->access_token;
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $result = curl_exec($ch);
        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        $response = json_decode($result, true);
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

        if($code === 200) {
            $attributes = json_decode($result, true);
            $this->logger->debug('successfully requested user attributes from userinfo_endpoint', [
               'category' => get_class($this),
            ]);

            return $this->attributes = $attributes;
        } else {
            $this->logger->error('failed requesting user attributes from userinfo_endpoint, status code ['.$code.']', [
               'category' => get_class($this),
            ]);

            throw new Exception('failed requesting user attribute from userinfo_endpoint');
        }

    }
}


1			<?php
2			declare(strict_types = 1);
3
4			/**
5			* Micro
6			*
7			* @author Raffael Sahli <[email protected]>
8			* @copyright Copyright (c) 2017 gyselroth GmbH (https://gyselroth.com)
9			* @license MIT https://opensource.org/licenses/MIT
10			*/
11
12			namespace Micro\Auth\Adapter;
13
14			use \Psr\Log\LoggerInterface;
15			use \Micro\Auth\Exception;
16
17			class Oidc extends AbstractAdapter
18			{
19			/**
20			* OpenID-connect discovery path
21			*/
22			CONST DISCOVERY_PATH = '/.well-known/openid-configuration';
23
24
25			/**
26			* OpenID-connect provider url
27			*
28			* @var string
29			*/
30			protected $provider_url = 'https://oidc.example.org';
31
32
33			/**
34			* Token validation endpoint (rfc7662)
35			*
36			* @var string
37			*/
38			protected $token_validation_url;
39
40
41			/**
42			* Identity attribute
43			*
44			* @var string
45			*/
46			protected $identity_attribute = 'preferred_username';
47
48
49			/**
50			* Attributes
51			*
52			* @var array
53			*/
54			protected $attributes = [];
55
56
57			/**
58			* Access token
59			*
60			* @var string
61			*/
62			private $access_token;
63
64
65			/**
66			* Init adapter
67			*
68			* @param LoggerInterface $logger
69			* @param Iterable $config
70			* @return void
			0 ignored issues – show Comprehensibility Best Practice introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Adding a `@return` annotation to constructors is generally not recommended as a constructor does not have a meaningful return value. Adding a `@return` annotation to a constructor is not recommended, since a constructor does not have a meaningful return value. Please refer to the PHP core documentation on constructors. Loading history...
71			*/
72			public function __construct(LoggerInterface $logger, ?Iterable $config=null)
73			{
74			$this->logger = $logger;
75			$this->setOptions($config);
76			}
77
78
79			/**
80			* Set options
81			*
82			* @param Iterable $config
83			* @return AdapterInterface
84			*/
85			public function setOptions(? Iterable $config = null) : AdapterInterface
86			{
87			if ($config === null) {
88			return $this;
89			}
90
91			foreach($config as $option => $value) {
92			switch($option) {
93			case 'provider_url':
			0 ignored issues – show Coding Style introduced 2017-10-19 15:32 UTC by Report Bug Copy Issue Report `case` statements should be defined using a colon. As per the PSR-2 coding standard, case statements should not be wrapped in curly braces. There is no need for braces, since each case is terminated by the next `break`. There is also the option to use a semicolon instead of a colon, this is discouraged because many programmers do not even know it works and the colon is universal between programming languages. switch ($expr) { case "A": { //wrong doSomething(); break; } case "B"; //wrong doSomething(); break; case "C": //right doSomething(); break; } To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. Loading history...
94			case 'token_validation_url':
95			case 'identity_attribute':
96			$this->{$option} = (string)$value;
97			unset($config[$option]);
98			break;
99			}
100			}
101
102			return parent::setOptions($config);
103			}
104
105
106			/**
107			* Authenticate
108			*
109			* @return bool
110			*/
111			public function authenticate(): bool
112			{
113			if (!isset($_SERVER['HTTP_AUTHORIZATION'])) {
114			$this->logger->debug('skip auth adapter ['.get_class($this).'], no http authorization header or access_token param found', [
115			'category' => get_class($this)
116			]);
117
118			return false;
119			} else {
120			$header = $_SERVER['HTTP_AUTHORIZATION'];
121			$parts = explode(' ', $header);
122
123			if ($parts[0] == 'Bearer') {
124			$this->logger->debug('found http bearer authorization header', [
125			'category' => get_class($this)
126			]);
127
128			return $this->verifyToken($parts[1]);
129			} else {
130			$this->logger->debug('http authorization header contains no bearer string or invalid authentication string', [
131			'category' => get_class($this)
132			]);
133
134			return false;
135			}
136			}
137			}
138
139
140			/**
141			* Get discovery url
142			*
143			* @return string
144			*/
145			public function getDiscoveryUrl(): string
146			{
147			return $this->provider_url.self::DISCOVERY_PATH;
148			}
149
150
151			/**
152			* Get discovery document
153			*
154			* @return array
155			*/
156			public function getDiscoveryDocument(): array
157			{
158			if ($apc = extension_loaded('apc') && apc_exists($this->provider_url)) {
			0 ignored issues – show Comprehensibility introduced 2017-08-10 14:48 UTC by Report Bug Copy Issue Report Consider adding parentheses for clarity. Current Interpretation: `$apc = (extension_loaded...s($this->provider_url))`, Probably Intended Meaning: `($apc = extension_loaded...ts($this->provider_url)` Loading history...
159			return apc_get($this->provider_url);
160			} else {
161			$ch = curl_init();
162			$url = $this->getDiscoveryUrl();
163			curl_setopt($ch, CURLOPT_URL, $url);
164			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
165
166			$this->logger->debug('fetch openid-connect discovery document from ['.$url.']', [
167			'category' => get_class($this)
168			]);
169
170			$result = curl_exec($ch);
171			$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
172			curl_close($ch);
173
174			if($code === 200) {
175			$discovery = json_decode($result, true);
176			$this->logger->debug('received openid-connect discovery document from ['.$url.']', [
177			'category' => get_class($this),
178			'discovery'=> $discovery
179			]);
180
181			if ($apc === true) {
182			apc_store($this->provider_url, $discovery);
183			}
184
185			return $discovery;
186			} else {
187			$this->logger->error('failed to receive openid-connect discovery document from ['.$url.'], request ended with status ['.$code.']', [
188			'category' => get_class($this),
189			]);
190
191			throw new Exception('failed to get openid-connect discovery document');
192			}
193			}
194			}
195
196
197			/**
198			* Token verification
199			*
200			* @param string $token
201			* @return bool
202			*/
203			protected function verifyToken(string $token): bool
204			{
205			if($this->token_validation_url) {
206			$this->logger->debug('validate oauth2 token via rfc7662 token validation endpoint ['.$this->token_validation_url.']', [
207			'category' => get_class($this),
208			]);
209
210			$url = str_replace('{token}', $token, $this->token_validation_url);
211			} else {
212			$discovery = $this->getDiscoveryDocument();
213			if (!(isset($discovery['userinfo_endpoint']))) {
214			throw new Exception('userinfo_endpoint could not be determained');
215			}
216
217			$this->logger->debug('validate token via openid-connect userinfo_endpoint ['.$discovery['userinfo_endpoint'].']', [
218			'category' => get_class($this),
219			]);
220
221			$url = $discovery['userinfo_endpoint'].'?access_token='.$token;
222			}
223
224			$ch = curl_init();
225			curl_setopt($ch, CURLOPT_URL, $url);
226			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
227			$result = curl_exec($ch);
228			$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
229			curl_close($ch);
230			$response = json_decode($result, true);
			0 ignored issues – show Unused Code introduced 2017-08-30 10:22 UTC by Report Bug Copy Issue Report `$response` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
231
232			if($code === 200) {
233			$attributes = json_decode($result, true);
234			$this->logger->debug('successfully verified oauth2 access token via authorization server', [
235			'category' => get_class($this),
236			]);
237
238			if(!isset($attributes[$this->identity_attribute])) {
239			throw new Exception('identity attribute '.$this->identity_attribute.' not found in oauth2 response');
240			}
241
242			$this->identifier = $attributes['preferred_username'];
243
244			if($this->token_validation_url) {
245			$this->attributes = $attributes;
246			} else {
247			$this->access_token = $token;
248			}
249
250			return true;
251			} else {
252			$this->logger->error('failed verify oauth2 access token via authorization server, received status ['.$code.']', [
253			'category' => get_class($this),
254			]);
255
256			throw new Exception('failed verify oauth2 access token via authorization server');
257			}
258			}
259
260
261			/**
262			* Get attributes
263			*
264			* @return array
265			*/
266			public function getAttributes(): array
267			{
268			if(count($this->attributes) !== 0) {
269			return $this->attributes;
270			}
271
272			$discovery = $this->getDiscoveryDocument();
273			if (!(isset($discovery['authorization_endpoint']))) {
274			throw new Exception('authorization_endpoint could not be determained');
275			}
276
277			$this->logger->debug('fetch user attributes from userinfo_endpoint ['.$discovery['userinfo_endpoint'].']', [
278			'category' => get_class($this),
279			]);
280
281			$url = $discovery['userinfo_endpoint'].'?access_token='.$this->access_token;
282			$ch = curl_init();
283			curl_setopt($ch, CURLOPT_URL, $url);
284			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
285			$result = curl_exec($ch);
286			$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
287			curl_close($ch);
288			$response = json_decode($result, true);
			0 ignored issues – show Unused Code introduced 2017-08-30 10:22 UTC by Report Bug Copy Issue Report `$response` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
289
290			if($code === 200) {
291			$attributes = json_decode($result, true);
292			$this->logger->debug('successfully requested user attributes from userinfo_endpoint', [
293			'category' => get_class($this),
294			]);
295
296			return $this->attributes = $attributes;
297			} else {
298			$this->logger->error('failed requesting user attributes from userinfo_endpoint, status code ['.$code.']', [
299			'category' => get_class($this),
300			]);
301
302			throw new Exception('failed requesting user attribute from userinfo_endpoint');
303			}
304
305			}
306			}
307

gyselroth / micro

Oidc A last analyzed 2017-12-11 11:42 UTC

Complexity

Size/Duplication

Coupling/Cohesion

Importance

7 Methods

Duplication Side-by-Side

Filter issues like

Oidc A
last analyzed 2017-12-11 11:42 UTC