App\Entity\User

Complexity

Total Complexity

44

Size/Duplication

Total Lines	481
Duplicated Lines	0 %

Importance

Changes	3
Bugs	0	Features	1

39 Methods

Rating	Name	Duplication	Size	Complexity
A	setRoleDescription()	0	5	1
A	isPasswordChangeNeeded()	0	3	1
A	setBackupCodes()	0	6	1
A	getPassword()	0	3	1
A	invalidateBackupCode()	0	5	2
A	setDisabled()	0	4	1
A	setPasswordChangeNeeded()	0	4	1
A	setFirstName()	0	5	1
A	eraseCredentials()	0	4	1
A	isBackupCode()	0	8	2
A	__toString()	0	3	1
A	addRole()	0	6	1
A	setRoles()	0	5	1
A	getUsername()	0	3	1
A	isDisabled()	0	3	1
A	isGoogleAuthenticatorEnabled()	0	3	2
A	getFirstName()	0	3	1
A	getTrustedTokenVersion()	0	3	1
A	getGoogleAuthenticatorUsername()	0	3	1
A	setGoogleAuthenticatorSecret()	0	5	1
A	getBackupCodesDate()	0	3	1
A	getSalt()	0	4	1
A	getFullName()	0	10	3
A	setUsername()	0	5	1
A	getGoogleAuthenticatorSecret()	0	3	1
A	isTFAEnabled()	0	3	1
A	setPassword()	0	5	1
A	getRoles()	0	7	1
A	getEmail()	0	3	1
A	getUserIdentifier()	0	3	1
A	getBackupCodes()	0	3	1
A	setLastName()	0	5	1
A	invalidateTrustedDevices()	0	5	1
A	getLastName()	0	3	1
A	setPlainPassword()	0	5	1
A	getId()	0	3	1
A	getRoleDescription()	0	3	1
A	getPlainPassword()	0	3	1
A	setEmail()	0	5	1

<?php
/*
 * Copyright (C) 2020  Jan Böhmer
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published
 * by the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

namespace App\Entity;

use App\Entity\Contracts\DBElementInterface;
use App\Repository\UserRepository;
use App\Validator\NoLockout;
use DateTime;
use Doctrine\ORM\Mapping as ORM;
use Scheb\TwoFactorBundle\Model\BackupCodeInterface;
use Scheb\TwoFactorBundle\Model\Google\TwoFactorInterface;
use Scheb\TwoFactorBundle\Model\TrustedDeviceInterface;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Validator\Constraints as Assert;

/**
 * This entity describes a user that can login to the backend system (it needs an ROLE_ADMIN role however).
 * The login is done with the username and a user choosable password. It is possible to configure two factor authentication
 * methods for additional security.
 *
 * @ORM\Entity(repositoryClass=UserRepository::class)
 * @UniqueEntity(fields={"username"})
 * @NoLockout(groups={"perm_edit"})
 */
class User implements DBElementInterface, UserInterface, TwoFactorInterface, BackupCodeInterface, TrustedDeviceInterface, PasswordAuthenticatedUserInterface
{
    /**
     * @ORM\Id()
     * @ORM\GeneratedValue()
     * @ORM\Column(type="integer")
     */
    private $id;

    /**
     * @ORM\Column(type="string", length=180, unique=true)
     */
    private $username;

    /**
     * @var string
     * @ORM\Column(type="string")
     */
    private $role_description = '';

    /**
     * @var string
     * @Assert\Email()
     * @ORM\Column(type="string")
     */
    private $email = '';

    /**
     * @ORM\Column(type="json")
     */
    private $roles = ['ROLE_ADMIN'];

    /**
     * @ORM\Column(type="string")
     */
    private $first_name = '';

    /**
     * @ORM\Column(type="string")
     */
    private $last_name = '';

    /**
     * @var string The hashed password
     * @ORM\Column(type="string")
     */
    private $password;

    /**
     * @var string|null
     * @Assert\Length(min=6)
     */
    private $plain_password = null;

    /**
     * @ORM\Column(name="googleAuthenticatorSecret", type="string", nullable=true)
     */
    private $googleAuthenticatorSecret;

    /**
     * @ORM\Column(type="integer")
     */
    private $trustedVersion = 0;

    /**
     * @ORM\Column(type="json")
     */
    private $backupCodes = [];

    /**
     * @ORM\Column(type="datetime", nullable=true)
     */
    private $backupCodesDate;

    /**
     * @ORM\Column(type="boolean", nullable=false)
     * @var bool
     */
    private $disabled = false;

    /** @var bool
     *  @ORM\Column(type="boolean", nullable=false)
     */
    private $password_change_needed = true;

    public function getId(): ?int
    {
        return $this->id;
    }

    /**
     * The name that is used to internally identify this user. Also used as login name.
     * Must be unique for all users.
     */
    public function getUsername(): string
    {
        return (string) $this->username;
    }

    /**
     * Returns unique user identifier (the username)
     * @return string
     */
    public function getUserIdentifier(): string
    {
        return (string) $this->username;
    }

    /**
     * Sets the username for this user.
     *
     * @return $this
     */
    public function setUsername(string $username): self
    {
        $this->username = $username;

        return $this;
    }

    /**
     * Returns all roles for this user.
     * Every user has at least the ROLE_USER role.
     *
     * @return string[]
     *
     * @see UserInterface
     */
    public function getRoles(): array
    {
        $roles = $this->roles;
        // guarantee every user at least has ROLE_USER
        $roles[] = 'ROLE_USER';

        return array_unique($roles);
    }

    /**
     * Add the given role to this user.
     *
     * @return $this
     */
    public function addRole(string $new_role): self
    {
        $this->roles[] = $new_role;
        $this->roles = array_unique($this->roles);

        return $this;
    }

    /**
     * Sets all roles for this user.
     *
     * @param string[] $roles
     *
     * @return $this
     */
    public function setRoles(array $roles): self
    {
        $this->roles = $roles;

        return $this;
    }

    /**
     * Returns the (hashed) password for this user.
     *
     * @see UserInterface
     */
    public function getPassword(): string
    {
        return $this->password;
    }

    /**
     * Sets the (hashed) password for this user.
     * Should be generated with UserPasswordEncryptorInterface.
     *
     * @return $this
     */
    public function setPassword(string $password): self
    {
        $this->password = $password;

        return $this;
    }

    /**
     * Not used.
     *
     * @see UserInterface
     */
    public function getSalt(): ?string
    {
        // not needed when using the "bcrypt" algorithm in security.yaml
        return null;
    }

    /**
     * @see UserInterface
     */
    public function eraseCredentials()
    {
        // If you store any temporary, sensitive data on the user, clear it here
        $this->plain_password = null;
    }

    /**
     * Returns the description of what this user does or why he needs an account (the function of the user).
     */
    public function getRoleDescription(): string
    {
        return $this->role_description;
    }

    /**
     * Sets the description of what this user does or why he needs an account (the function of the user).
     */
    public function setRoleDescription(string $role_description): User
    {
        $this->role_description = $role_description;

        return $this;
    }

    /**
     * Returns the email of this user.
     */
    public function getEmail(): string
    {
        return $this->email;
    }

    /**
     * Sets the email of this user.
     */
    public function setEmail(string $email): User
    {
        $this->email = $email;

        return $this;
    }

    /**
     * Return the first name of this user.
     */
    public function getFirstName(): ?string
    {
        return $this->first_name;
    }

    /**
     * Sets the first name of this user.
     */
    public function setFirstName(string $first_name): User
    {
        $this->first_name = $first_name;

        return $this;
    }

    /**
     * Returns the last name of this user.
     */
    public function getLastName(): ?string
    {
        return $this->last_name;
    }

    /**
     * Sets the last name of this user.
     */
    public function setLastName(string $last_name): User
    {
        $this->last_name = $last_name;

        return $this;
    }

    /**
     * Returns the full name of this user (in the format "first_name last_name").
     */
    public function getFullName(): string
    {
        if (empty($this->getFirstName())) {
            return $this->getLastName();
        }
        if (empty($this->getLastName())) {
            return $this->getFirstName();
        }

        return $this->getFirstName().' '.$this->getLastName();
    }

    /**
     * Returns the temporary saved plain password. We need this to set a password via EasyAdmin interface.
     * A value is only available shortly after it was set via setPlainPassword() and is deleted by eraseCredentials().
     *
     * @return string
     */
    public function getPlainPassword(): ?string
    {
        return $this->plain_password;
    }

    /**
     * Sets the temporary saved plain password. We need this to set a password via EasyAdmin interface.
     * The value is deleted by eraseCredentials().
     *
     * @param string $plainPassword
     */
    public function setPlainPassword(?string $plainPassword): User
    {
        $this->plain_password = $plainPassword;

        return $this;
    }

    /**
     * Returns true if this user has any Two-Factor method enabled.
     */
    public function isTFAEnabled(): bool
    {
        return $this->isGoogleAuthenticatorEnabled();
    }

    /**
     * Returns true if this user has google authentication 2FA enabled.
     */
    public function isGoogleAuthenticatorEnabled(): bool
    {
        return $this->googleAuthenticatorSecret ? true : false;
    }

    /**
     * Returns the username that should be shown to the user for this service, when using google authenticator.
     * Here the standard username is used.
     */
    public function getGoogleAuthenticatorUsername(): string
    {
        return $this->username;
    }

    /**
     * Returns the secret used for google authenticator 2FA.
     */
    public function getGoogleAuthenticatorSecret(): ?string
    {
        return $this->googleAuthenticatorSecret;
    }

    /**
     * Sets the secred used for google authenticator 2FA.
     *
     * @return $this
     */
    public function setGoogleAuthenticatorSecret(?string $googleAuthenticatorSecret): self
    {
        $this->googleAuthenticatorSecret = $googleAuthenticatorSecret;

        return $this;
    }

    /**
     * Returns the trusted token version used to implement trusted device 2FA.
     */
    public function getTrustedTokenVersion(): int
    {
        return $this->trustedVersion;
    }

    /**
     * Invalidate all trusted devices used by this user.
     *
     * @return $this
     */
    public function invalidateTrustedDevices(): self
    {
        ++$this->trustedVersion;

        return $this;
    }

    /**
     * Check if it is a valid backup code.
     */
    public function isBackupCode(string $code): bool
    {
        //Don't check if no backup codes are defined.
        if (empty($this->backupCodes)) {
            return false;
        }

        return in_array($code, $this->backupCodes, true);
    }

    /**
     * Invalidate a backup code.
     */
    public function invalidateBackupCode(string $code): void
    {
        $key = array_search($code, $this->backupCodes, true);
        if (false !== $key) {
            unset($this->backupCodes[$key]);
        }
    }

    /**
     * Set all backup codes of this user. BackupCodeDate will be updated.
     *
     * @return $this
     */
    public function setBackupCodes(array $codes): self
    {
        $this->backupCodes = $codes;
        $this->backupCodesDate = new DateTime();

        return $this;
    }

    /**
     * Returns the date when the backup codes where generated.
     *
     * @return DateTime
     */
    public function getBackupCodesDate(): ?DateTime
    {
        return $this->backupCodesDate;
    }

    /**
     * Returns all backup codes of this user.
     */
    public function getBackupCodes(): array
    {
        return $this->backupCodes ?? [];
    }

    /**
     * Check if this user is disabled and can not log in
     * @return bool
     */
    public function isDisabled(): bool
    {
        return $this->disabled;
    }

    /**
     * Set if this user is disabled and can not log in
     * @param  bool  $disabled
     * @return User
     */
    public function setDisabled(bool $disabled): User
    {
        $this->disabled = $disabled;
        return $this;
    }

    /**
     * Check if this user needs to change his password.
     * @return bool
     */
    public function isPasswordChangeNeeded(): bool
    {
        return $this->password_change_needed;
    }

    /**
     * Sets if this user needs to change his password
     * @param  bool  $password_change_needed
     * @return User
     */
    public function setPasswordChangeNeeded(bool $password_change_needed): User
    {
        $this->password_change_needed = $password_change_needed;
        return $this;
    }

    public function __toString(): string
    {
        return $this->getFullName().' ('.$this->username.')';
    }
}