KleijnWeb\JwtBundle\Authenticator\JwtKey

Complexity

Total Complexity

38

Size/Duplication

Total Lines	189
Duplicated Lines	7.94 %

Coupling/Cohesion

Components	1
Dependencies	4

Importance

Changes	2
Bugs	0	Features	0

7 Methods

Rating	Name	Duplication	Size	Complexity
C	__construct()	0	29	7
A	getId()	0	4	1
A	validateToken()	0	11	2
A	validateHeader()	0	12	4
D	validateClaims()	15	36	21
A	getSignatureValidator()	0	8	2
A	__sleep()	0	4	1

<?php
/*
 * This file is part of the KleijnWeb\JwtBundle package.
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace KleijnWeb\JwtBundle\Authenticator;

use KleijnWeb\JwtBundle\Authenticator\SignatureValidator\SignatureValidator;
use KleijnWeb\JwtBundle\Authenticator\SignatureValidator\HmacValidator;
use KleijnWeb\JwtBundle\Authenticator\SignatureValidator\RsaValidator;

/**
 * @author John Kleijn <john@kleijnweb.nl>
 */
class JwtKey
{
    const TYPE_HMAC = 'HS256';
    const TYPE_RSA = 'RS256';

    /**
     * @var string
     */
    private $id;

    /**
     * @var string
     */
    private $issuer;

    /**
     * @var string
     */
    private $type = self::TYPE_HMAC;

    /**
     * @var string
     */
    private $audience;

    /**
     * @var int
     */
    private $minIssueTime;

    /**
     * @var array
     */
    private $requiredClaims = [];

    /**
     * @var int
     */
    private $issuerTimeLeeway;

    /**
     * @var string
     */
    private $secret;

    /**
     * @var SecretLoader
     */
    private $secretLoader;

    /**
     * @param array $options
     */
    public function __construct(array $options)
    {
        if (!isset($options['secret']) && !isset($options['loader'])) {
            throw new \InvalidArgumentException("Need a secret or a loader to verify tokens");
        }
        if (isset($options['secret']) && isset($options['loader'])) {
            throw new \InvalidArgumentException("Cannot configure both secret and loader");
        }
        $defaults = [
            'kid'          => null,
            'issuer'       => null,
            'audience'     => null,
            'minIssueTime' => null,
            'leeway'       => 0,
            'type'         => $this->type,
            'require'      => $this->requiredClaims,
        ];

        $options                = array_merge($defaults, $options);
        $this->issuer           = $options['issuer'];
        $this->audience         = $options['audience'];
        $this->type             = $options['type'];
        $this->minIssueTime     = $options['minIssueTime'];
        $this->requiredClaims   = $options['require'];
        $this->issuerTimeLeeway = $options['leeway'];
        $this->id               = $options['kid'];
        $this->secret           = isset($options['secret']) ? $options['secret'] : null;
        $this->secretLoader     = isset($options['loader']) ? $options['loader'] : null;
    }

    /**
     * @return string
     */
    public function getId()
    {
        return $this->id;
    }

    /**
     * @param JwtToken $token
     *
     * @throws \InvalidArgumentException
     */
    public function validateToken(JwtToken $token)
    {
        $this->validateHeader($token->getHeader());
        $this->validateClaims($token->getClaims());

        if (!$this->secretLoader) {
            $token->validateSignature($this->secret, $this->getSignatureValidator());
            return;
        }
        $token->validateSignature($this->secretLoader->load($token), $this->getSignatureValidator());
    }

    /**
     * @param array $header
     *
     * @throws \InvalidArgumentException
     */
    public function validateHeader(array $header)
    {
        if (!isset($header['alg'])) {
            throw new \InvalidArgumentException("Missing 'alg' in header");
        }
        if (!isset($header['typ'])) {
            throw new \InvalidArgumentException("Missing 'typ' in header");
        }
        if ($this->type !== $header['alg']) {
            throw new \InvalidArgumentException("Algorithm mismatch");
        }
    }

    /**
     * @param array $claims
     *
     * @throws \InvalidArgumentException
     */
    public function validateClaims(array $claims)
    {
        if ($this->requiredClaims) {

The expression $this->requiredClaims of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

            $missing = array_diff_key(array_flip($this->requiredClaims), $claims);
            if (count($missing)) {
                throw new \InvalidArgumentException("Missing claims: " . implode(', ', $missing));
            }
        }
        if ($this->issuer && !isset($claims['iss'])) {
            throw new \InvalidArgumentException("Claim 'iss' is required");
        }
        if ($this->minIssueTime && !isset($claims['iat'])) {
            throw new \InvalidArgumentException("Claim 'iat' is required");
        }
        if ($this->audience && !isset($claims['aud'])) {
            throw new \InvalidArgumentException("Claim 'aud' is required");
        }
        if (!isset($claims['prn']) || empty($claims['prn'])) {
            throw new \InvalidArgumentException("Missing principle claim");
        }
        if (isset($claims['exp']) && $claims['exp'] < time()) {

This code seems to be duplicated across your project.

            throw new \InvalidArgumentException("Token is expired by 'exp'");
        }
        if (isset($claims['iat']) && $claims['iat'] < $this->minIssueTime) {

This code seems to be duplicated across your project.

            throw new \InvalidArgumentException("Server deemed your token too old");
        }
        if (isset($claims['nbf']) && $claims['nbf'] > time()) {

This code seems to be duplicated across your project.

            throw new \InvalidArgumentException("Token not valid yet");
        }
        if (isset($claims['iss']) && $claims['iss'] !== $this->issuer) {

This code seems to be duplicated across your project.

            throw new \InvalidArgumentException("Issuer mismatch");
        }
        if (isset($claims['aud']) && $claims['aud'] !== $this->audience) {

This code seems to be duplicated across your project.

            throw new \InvalidArgumentException("Audience mismatch");
        }
    }


    /**
     * @return SignatureValidator
     */
    public function getSignatureValidator()
    {
        if ($this->type == self::TYPE_RSA) {
            return new RsaValidator();
        }

        return new HmacValidator();
    }

    /**
     * Prevent accidental persistence of secret
     */
    final public function __sleep()
    {
        return [];
    }
}