Waca\Pages\UserAuth\MultiFactor\PageMultiFactor::enableU2F()

Complexity

Conditions	8
Paths	8

Size

Total Lines	108
Code Lines	56

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    protected function enableU2F() {
        $database = $this->getDatabase();
        $currentUser = User::getCurrent($database);

        $otpCredentialProvider = new U2FCredentialProvider($database, $this->getSiteConfiguration());

        if (WebRequest::wasPosted()) {
            $this->validateCSRFToken();

            // used for routing only, not security
            $stage = WebRequest::postString('stage');

            if ($stage === "auth") {
                $password = WebRequest::postString('password');

                $passwordCredentialProvider = new PasswordCredentialProvider($database,
                    $this->getSiteConfiguration());
                $result = $passwordCredentialProvider->authenticate($currentUser, $password);

                if ($result) {
                    $otpCredentialProvider->setCredential($currentUser, 2, null);
                    $this->assignCSRFToken();

                    list($data, $reqs) = $otpCredentialProvider->getRegistrationData();

                    $u2fRequest =json_encode($data);
                    $u2fSigns = json_encode($reqs);

                    $this->addJs('/vendor/yubico/u2flib-server/examples/assets/u2f-api.js');
                    $this->setTailScript($this->getCspManager()->getNonce(), <<<JS
var request = ${u2fRequest};
var signs = ${u2fSigns};

u2f.register([request], signs, function(data) {
	var form = document.getElementById('u2fEnroll');
	var reg = document.getElementById('u2fData');
	var req = document.getElementById('u2fRequest');

	if(data.errorCode && data.errorCode !== 0) {
		alert("registration failed with errror: " + data.errorCode);
		return;
	}

	reg.value=JSON.stringify(data);
	req.value=JSON.stringify(request);
	form.submit();
});
JS
                    );

                    $this->setTemplate('mfa/enableU2FEnroll.tpl');

                    return;
                }
                else {
                    SessionAlert::error('Error enabling TOTP - invalid credentials.');
                    $this->redirect('multiFactor');

                    return;
                }
            }

            if ($stage === "enroll") {
                // we *must* have a defined credential already here,
                if ($otpCredentialProvider->isPartiallyEnrolled($currentUser)) {

                    $request = json_decode(WebRequest::postString('u2fRequest'));
                    $u2fData = json_decode(WebRequest::postString('u2fData'));

                    $otpCredentialProvider->enable($currentUser, $request, $u2fData);

                    SessionAlert::success('Enabled U2F.');

                    $scratchProvider = new ScratchTokenCredentialProvider($database, $this->getSiteConfiguration());
                    if($scratchProvider->getRemaining($currentUser->getId()) < 3) {
                        $scratchProvider->setCredential($currentUser, 2, null);
                        $tokens = $scratchProvider->getTokens();
                        $this->assign('tokens', $tokens);
                        $this->setTemplate('mfa/regenScratchTokens.tpl');
                        return;
                    }

                    $this->redirect('multiFactor');
                    return;
                }
                else {
                    SessionAlert::error('Error enabling TOTP - no enrollment found or enrollment expired.');
                    $this->redirect('multiFactor');

                    return;
                }
            }

            // urgh, dunno what happened, but it's not something expected.
            throw new ApplicationLogicException();
        }
        else {
            if ($otpCredentialProvider->userIsEnrolled($currentUser->getId())) {
                // user is not enrolled, we shouldn't have got here.
                throw new ApplicationLogicException('User is already enrolled in the selected MFA mechanism');
            }

            $this->assignCSRFToken();

            $this->assign('alertmessage', 'To enable your multi-factor credentials, please prove you are who you say you are by providing the information below.');
            $this->assign('alertheader', 'Provide credentials');
            $this->assign('continueText', 'Verify password');
            $this->setTemplate('mfa/enableAuth.tpl');
        }