Charcoal\User\AbstractUser

Complexity

Total Complexity

69

Size/Duplication

Total Lines	551
Duplicated Lines	14.52 %

Coupling/Cohesion

Components	1
Dependencies	6

Importance

Changes	18
Bugs	5	Features	1

29 Methods

Rating	Name	Duplication	Size	Complexity
A	key()	0	4	1
A	setUsername()	0	10	2
A	username()	0	4	1
A	setEmail()	0	10	2
A	email()	0	4	1
A	setPassword()	0	14	3
A	password()	0	4	1
A	setActive()	0	5	1
A	active()	0	4	1
B	setLastLoginDate()	23	23	5
A	lastLoginDate()	0	4	1
A	setLastLoginIp()	17	17	4
A	lastLoginIp()	0	4	1
B	setLastPasswordDate()	23	23	5
A	lastPasswordDate()	0	4	1
A	setLastPasswordIp()	17	17	4
A	lastPasswordIp()	0	4	1
A	setLoginToken()	0	10	2
A	loginToken()	0	4	1
C	authenticate()	0	38	7
A	saveToSession()	0	10	2
A	login()	0	17	4
A	logLogin()	0	5	1
A	loginFailed()	0	8	1
A	logLoginFailed()	0	5	1
A	logout()	0	12	2
B	resetPassword()	0	23	5
B	getAuthenticated()	0	25	6
A	createConfig()	0	8	2

<?php

namespace Charcoal\User;

// Dependencies from `PHP`
use \DateTime;
use \DateTimeInterface;
use \Exception;
use \InvalidArgumentException;

// Module `charcoal-core` dependencies
use \Charcoal\Config\ConfigurableInterface;
use \Charcoal\Config\ConfigurableTrait;

// Module `charcoal-base` dependencies
use \Charcoal\Object\Content;

// Local namespace (charcoal-base) dependencies
use \Charcoal\User\UserConfig;
use \Charcoal\User\UserInterface;
use \Charcoal\User\AuthenticatableInterface;
use \Charcoal\User\AuthorizableInterface;
use \Charcoal\User\AuthorizableTrait;
use \Charcoal\User\GroupableInterface;
use \Charcoal\User\GroupableTrait;

/**
 * Full implementation, as abstract class, of the `UserInterface`.
 */
abstract class AbstractUser extends Content implements
    UserInterface,
    AuthenticatableInterface,
    AuthorizableInterface,
    GroupableInterface,
    ConfigurableInterface
{
    use AuthorizableTrait;
    use GroupableTrait;
    use ConfigurableTrait;

    /**
     * The username should be unique and mandatory.
     * @var string $username
     */
    private $username = '';

    /**
     * The password is stored encrypted in the database.
     * @var string $password
     */
    private $password;

    /**
     * @var string $email
     */
    private $email;

    /**
     * @var boolean $active
     */
    private $active = true;

Consider using a different property name as you override a private property of the parent class.

    /**
     * The date of the latest (successful) login
     * @var DateTime|null $lastLoginDate
     */
    private $lastLoginDate;

    /**
     * @var string $lastLoginIp
     */
    private $lastLoginIp;

    /**
     * The date of the latest password change
     * @var DateTime|null
     */
    private $lastPasswordDate;

    /**
     * @var string $lastPasswordIp
     */
    private $lastPasswordIp;

    /**
     * If the login token is set (not empty), then the user should be prompted to
     * reset his password after login / enter the token to continue
     * @var string $loginToken
     */
    private $loginToken = '';

    /**
     * IndexableTrait > key()
     *
     * @return string
     */
    public function key()
    {
        return 'username';
    }

    /**
     * Force a lowercase username
     *
     * @param string $username The username (also the login name).
     * @throws InvalidArgumentException If the username is not a string.
     * @return User Chainable
     */
    public function setUsername($username)
    {
        if (!is_string($username)) {
            throw new InvalidArgumentException(
                'Set user username: Username must be a string'
            );
        }
        $this->username = mb_strtolower($username);
        return $this;
    }

    /**
     * @return string
     */
    public function username()
    {
        return $this->username;
    }

    /**
     * @param string $email The user email.
     * @throws InvalidArgumentException If the email is not a string.
     * @return User Chainable
     */
    public function setEmail($email)
    {
        if (!is_string($email)) {
            throw new InvalidArgumentException(
                'Set user email: Email must be a string'
            );
        }
        $this->email = $email;
        return $this;
    }

    /**
     * @return string
     */
    public function email()
    {
        return $this->email;
    }

    /**
     * @param string|null $password The user password. Encrypted in storage.
     * @throws InvalidArgumentException If the password is not a string (or null, to reset).
     * @return UserInterface Chainable
     */
    public function setPassword($password)
    {
        if ($password === null) {
            $this->password = $password;
        } elseif (is_string($password)) {
            $this->password = $password;
        } else {
            throw new InvalidArgumentException(
                'Set user password: Password must be a string'
            );
        }

        return $this;
    }

    /**
     * @return string
     */
    public function password()
    {
        return $this->password;
    }

    /**
     * @param boolean $active The active flag.
     * @return UserInterface Chainable
     */
    public function setActive($active)
    {
        $this->active = !!$active;
        return $this;
    }
    /**
     * @return boolean
     */
    public function active()
    {
        return $this->active;
    }

    /**
     * @param string|DateTime|null $lastLoginDate The last login date.
     * @throws InvalidArgumentException If the ts is not a valid date/time.
     * @return AbstractUser Chainable
     */
    public function setLastLoginDate($lastLoginDate)

This method seems to be duplicated in your project.

    {
        if ($lastLoginDate === null) {
            $this->lastLoginDate = null;
            return $this;
        }
        if (is_string($lastLoginDate)) {
            try {
                $lastLoginDate = new DateTime($lastLoginDate);
            } catch (Exception $e) {
                throw new InvalidArgumentException(
                    sprintf('Invalid login date (%s)', $e->getMessage())
                );
            }
        }
        if (!($lastLoginDate instanceof DateTimeInterface)) {
            throw new InvalidArgumentException(
                'Invalid "Last Login Date" value. Must be a date/time string or a DateTime object.'
            );
        }
        $this->lastLoginDate = $lastLoginDate;
        return $this;
    }

    /**
     * @return DateTime|null
     */
    public function lastLoginDate()
    {
        return $this->lastLoginDate;

The expression $this->lastLoginDate; of type DateTime|null adds the type DateTime to the return on line 231 which is incompatible with the return type declared by the interface Charcoal\User\UserInterface::lastLoginDate of type Charcoal\User\DateTime.

    }

    /**
     * @param string|integer|null $ip The last login IP address.
     * @throws InvalidArgumentException If the IP is not an IP string, an integer, or null.
     * @return UserInterface Chainable
     */
    public function setLastLoginIp($ip)

This method seems to be duplicated in your project.

    {
        if ($ip === null) {
            $this->lastLoginIp = null;
            return $this;
        }
        if (is_int($ip)) {
            $ip = long2ip($ip);
        }
        if (!is_string($ip)) {
            throw new InvalidArgumentException(
                'Invalid IP address'
            );
        }
        $this->lastLoginIp = $ip;
        return $this;
    }
    /**
     * Get the last login IP in x.x.x.x format
     * @return string
     */
    public function lastLoginIp()
    {
        return $this->lastLoginIp;
    }

    /**
     * @param string|DateTime|null $lastPasswordDate The last password date.
     * @throws InvalidArgumentException If the passsword date is not a valid DateTime.
     * @return UserInterface Chainable
     */
    public function setLastPasswordDate($lastPasswordDate)

This method seems to be duplicated in your project.

    {
        if ($lastPasswordDate === null) {
            $this->lastPasswordDate = null;
            return $this;
        }
        if (is_string($lastPasswordDate)) {
            try {
                $lastPasswordDate = new DateTime($lastPasswordDate);
            } catch (Exception $e) {
                throw new InvalidArgumentException(
                    sprintf('Invalid last password date (%s)', $e->getMessage())
                );
            }
        }
        if (!($lastPasswordDate instanceof DateTimeInterface)) {
            throw new InvalidArgumentException(
                'Invalid "Last Password Date" value. Must be a date/time string or a DateTime object.'
            );
        }
        $this->lastPasswordDate = $lastPasswordDate;
        return $this;
    }

    /**
     * @return DateTime
     */
    public function lastPasswordDate()
    {
        return $this->lastPasswordDate;

The expression $this->lastPasswordDate; of type DateTime|null adds the type DateTime to the return on line 299 which is incompatible with the return type declared by the interface Charcoal\User\UserInterface::lastPasswordDate of type Charcoal\User\DateTime.

    }

    /**
     * @param integer|string|null $ip The last password IP.
     * @throws InvalidArgumentException If the IP is not null, an integer or an IP string.
     * @return UserInterface Chainable
     */
    public function setLastPasswordIp($ip)

This method seems to be duplicated in your project.

    {
        if ($ip === null) {
            $this->lastPasswordIp = null;
            return $this;
        }
        if (is_int($ip)) {
            $ip = long2ip($ip);
        }
        if (!is_string($ip)) {
            throw new InvalidArgumentException(
                'Invalid IP address'
            );
        }
        $this->lastPasswordIp = $ip;
        return $this;
    }
    /**
     * Get the last password change IP in x.x.x.x format
     *
     * @return string
     */
    public function lastPasswordIp()
    {
        return $this->lastPasswordIp;
    }

    /**
     * @param string $token The login token.
     * @throws InvalidArgumentException If the token is not a string.
     * @return UserInterface Chainable
     */
    public function setLoginToken($token)
    {
        if (!is_string($token)) {
            throw new InvalidArgumentException(
                'Login Token must be a string'
            );
        }
        $this->loginToken = $token;
        return $this;
    }

    /**
     * @return string
     */
    public function loginToken()
    {
        return $this->loginToken;
    }

    /**
     * Attempt to log in a user with a username + password.
     *
     * @param string $username Username.
     * @param string $password Password.
     * @throws InvalidArgumentException If username or password is not a string.
     * @return boolean Login success / failure.
     */
    public function authenticate($username, $password)
    {
        if (!is_string($username) || !is_string($password)) {
            throw new InvalidArgumentException(
                'Username and password must be strings'
            );
        }

        // Force lowercase
        $username = mb_strtolower($username);

        // Load the user by username
        $this->load($username);

        if ($this->username() != $username) {
            $this->loginFailed($username);
            return false;
        }
        if ($this->active() === false) {
            $this->loginFailed($username);
            return false;
        }

        // Validate password
        if (password_verify($password, $this->password())) {
            if (password_needs_rehash($this->password(), PASSWORD_DEFAULT)) {
                $hash = password_hash($password, PASSWORD_DEFAULT);

$hash is not used, you could remove the assignment.

                // @todo Update user with new hash
                $this->update(['password']);
            }

            $this->login();
            return true;
        } else {
            $this->loginFailed($username);
            return false;
        }
    }

    /**
     * @throws Exception If trying to save a user to session without a ID.
     * @return UserInterface Chainable
     */
    public function saveToSession()

saveToSession uses the super-global variable $_SESSION which is generally not recommended.

    {
        if (!$this->id()) {
            throw new Exception(
                'Can not set auth user; no user ID'
            );
        }
        $_SESSION[static::sessionKey()] = $this->id();
        return $this;
    }

    /**
     * Log in the user (in session)
     *
     * Called when the authentication is successful.
     *
     * @return boolean Success / Failure
     */
    public function login()

login uses the super-global variable $_SERVER which is generally not recommended.

    {
        if (!$this->id()) {
            return false;
        }

        $this->setLastLoginDate('now');
        $ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
        if ($ip) {
            $this->setLastLoginIp($ip);
        }
        $this->update(['last_login_ip', 'last_login_date']);

        $this->saveToSession();

        return true;
    }

    /**
     * @return boolean
     */
    public function logLogin()
    {
        // @todo
        return true;
    }

    /**
     * Failed authentication callback
     *
     * @param string $username The failed username.
     * @return void
     */
    public function loginFailed($username)
    {
        $this->setUsername('');
        $this->setPermissions([]);
        $this->setGroups([]);

        $this->logLoginFailed($username);

The call to the method Charcoal\User\AbstractUser::logLoginFailed() seems un-needed as the method has no side-effects.

    }

    /**
     * @param string $username The username to log failure.
     * @return boolean
     */
    public function logLoginFailed($username)

The parameter $username is not used and could be removed.

    {
        // @todo
        return true;
    }

    /**
     * Empties the session var associated to the session key.
     *
     * @return boolean Logged out or not.
     */
    public function logout()

logout uses the super-global variable $_SESSION which is generally not recommended.

    {
        // Irrelevant call...
        if (!$this->id()) {
            return false;
        }

        $_SESSION[static::sessionKey()] = null;
        unset($_SESSION[static::sessionKey()]);

        return true;
    }

    /**
     * Reset the password.
     *
     * Encrypt the password and re-save the object in the database.
     * Also updates the last password date & ip.
     *
     * @param string $plainPassword The plain (non-encrypted) password to reset to.
     * @throws InvalidArgumentException If the plain password is not a string.
     * @return UserInterface Chainable
     */
    public function resetPassword($plainPassword)

resetPassword uses the super-global variable $_SERVER which is generally not recommended.

    {
        if (!is_string($plainPassword)) {
            throw new InvalidArgumentException(
                'Can not change password: password is not a string.'
            );
        }

        $hash = password_hash($plainPassword, PASSWORD_DEFAULT);
        $this->setPassword($hash);

        $this->setLastPasswordDate('now');
        $ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
        if ($ip) {
            $this->setLastPasswordIp($ip);
        }

        if ($this->id()) {
            $this->update(['password', 'last_password_date', 'last_password_ip']);
        }

        return $this;
    }

    /**
     * Get the currently authenticated user (from session)
     *
     * Return null if there is no current user in logged into
     *
     * @param boolean $reinit Optional. Whether to reload user data from source.
     * @throws Exception If the user from session is invalid.
     * @return UserInterface|null
     */
    public static function getAuthenticated($reinit = true)

getAuthenticated uses the super-global variable $_SESSION which is generally not recommended.

    {
        if (!isset($_SESSION[static::sessionKey()])) {
            return null;
        }

        $userId = $_SESSION[static::sessionKey()];
        if (!$userId) {
            return null;
        }

        $user_class = get_called_class();
        $user = new $user_class([
            'logger'=> new \Psr\Log\NullLogger()
        ]);
        $user->load($userId);

        // Inactive users can not authenticate
        if (!$user->id() || !$user->username() || !$user->active()) {
            // @todo log error
            return null;
        }

        return $user;
    }

    /**
     * ConfigurableInterface > create_config()
     *
     * @param array $data Optional. Configuration data.
     * @return UserConfig
     */
    public function createConfig(array $data = null)
    {
        $config = new UserConfig();
        if (is_array($data)) {
            $config->merge($data);

The call to the method Charcoal\User\UserConfig::merge() seems un-needed as the method has no side-effects.

        }
        return $config;
    }
}