Neomerx\Cors\Strategies\Settings

Complexity

Total Complexity

36

Size/Duplication

Total Lines	461
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	2

Test Coverage

Coverage

100%

Importance

Changes	10
Bugs	0	Features	0

26 Methods

Rating	Name	Duplication	Size	Complexity
A	getSettings()	0	4	1
A	setSettings()	0	4	1
A	getServerOrigin()	0	4	1
A	setServerOrigin()	0	6	2
A	isPreFlightCanBeCached()	0	4	1
A	getPreFlightCacheMaxAge()	0	4	1
A	setPreFlightCacheMaxAge()	0	6	1
A	isForceAddAllowedMethodsToPreFlightResponse()	0	4	1
A	setForceAddAllowedMethodsToPreFlightResponse()	0	6	1
A	isForceAddAllowedHeadersToPreFlightResponse()	0	4	1
A	setForceAddAllowedHeadersToPreFlightResponse()	0	6	1
A	isRequestCredentialsSupported()	0	4	1
A	setRequestCredentialsSupported()	0	6	1
A	isRequestOriginAllowed()	0	13	2
A	setRequestAllowedOrigins()	0	10	2
A	isRequestMethodSupported()	0	6	1
B	isRequestAllHeadersSupported()	0	22	4
A	getRequestAllowedMethods()	0	4	1
A	setRequestAllowedMethods()	0	9	2
A	getRequestAllowedHeaders()	0	4	1
A	setRequestAllowedHeaders()	0	10	2
A	getResponseExposedHeaders()	0	4	1
A	setResponseExposedHeaders()	0	6	1
A	isCheckHost()	0	4	1
A	setCheckHost()	0	6	1
A	getEnabledItems()	0	12	3

<?php namespace Neomerx\Cors\Strategies;

/**
 * Copyright 2015 info@neomerx.com (www.neomerx.com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

use \Psr\Http\Message\RequestInterface;
use \Neomerx\Cors\Log\LoggerAwareTrait;
use \Neomerx\Cors\Contracts\Http\ParsedUrlInterface;
use \Neomerx\Cors\Contracts\Constants\CorsResponseHeaders;
use \Neomerx\Cors\Contracts\Strategies\SettingsStrategyInterface;

/**
 * Implements strategy as a simple set of setting identical for all resources and requests.
 *
 * @package Neomerx\Cors
 */
class Settings implements SettingsStrategyInterface
{
    use LoggerAwareTrait;

    /**
     * 'All' value for allowed origins.
     */
    const VALUE_ALLOW_ORIGIN_ALL = CorsResponseHeaders::VALUE_ALLOW_ORIGIN_ALL;

    /**
     * 'All' values for allowed headers.
     */
    const VALUE_ALLOW_ALL_HEADERS = '*';

    /** Settings key */
    const KEY_SERVER_ORIGIN = 0;

    /** Settings key */
    const KEY_SERVER_ORIGIN_SCHEMA = 0;

    /** Settings key */
    const KEY_SERVER_ORIGIN_HOST = 1;

    /** Settings key */
    const KEY_SERVER_ORIGIN_PORT = 2;

    /** Settings key */
    const KEY_ALLOWED_ORIGINS = 1;

    /** Settings key */
    const KEY_ALLOWED_METHODS = 2;

    /** Settings key */
    const KEY_ALLOWED_HEADERS = 3;

    /** Settings key */
    const KEY_EXPOSED_HEADERS = 4;

    /** Settings key */
    const KEY_IS_USING_CREDENTIALS = 5;

    /** Settings key */
    const KEY_FLIGHT_CACHE_MAX_AGE = 6;

    /** Settings key */
    const KEY_IS_FORCE_ADD_METHODS = 7;

    /** Settings key */
    const KEY_IS_FORCE_ADD_HEADERS = 8;

    /** Settings key */
    const KEY_IS_CHECK_HOST = 9;

    /**
     * @var array
     */
    private $settings = [
        /**
         * Array should be in parse_url() result format.
         *
         * @see http://php.net/manual/function.parse-url.php
         */
        self::KEY_SERVER_ORIGIN        => [
            self::KEY_SERVER_ORIGIN_SCHEMA => '',
            self::KEY_SERVER_ORIGIN_HOST   => ParsedUrlInterface::DEFAULT_PORT,
            self::KEY_SERVER_ORIGIN_PORT   => '',
        ],

        /**
         * A list of allowed request origins (lower-cased, no trail slashes).
         * Value `true` enables and value `null` disables origin.
         * If all origins '*' are enabled all settings for other origins are ignored.
         *
         * For example,
         *
         * [
         *     'http://example.com:123'     => true,
         *     'http://evil.com'            => null,
         *     self::VALUE_ALLOW_ORIGIN_ALL => null,
         * ];
         */
        self::KEY_ALLOWED_ORIGINS => [],

        /**
         * A list of allowed request methods (case sensitive). Value `true` enables and value `null` disables method.
         *
         * For example,
         *
         * [
         *     'GET'    => true,
         *     'PATCH'  => true,
         *     'POST'   => true,
         *     'PUT'    => null,
         *     'DELETE' => true,
         * ];
         *
         * Security Note: you have to remember CORS is not access control system and you should not expect all
         * cross-origin requests will have pre-flights. For so-called 'simple' methods with so-called 'simple'
         * headers request will be made without pre-flight. Thus you can not restrict such requests with CORS
         * and should use other means.
         * For example method 'GET' without any headers or with only 'simple' headers will not have pre-flight
         * request so disabling it will not restrict access to resource(s).
         *
         * You can read more on 'simple' methods at http://www.w3.org/TR/cors/#simple-method
         */
        self::KEY_ALLOWED_METHODS => [],

        /**
         * A list of allowed request headers (lower-cased). Value `true` enables and value `null` disables header.
         *
         * For example,
         *
         * $allowedHeaders = [
         *     'content-type'                => true,
         *     'x-custom-request-header'     => null,
         *     self::VALUE_ALLOW_ALL_HEADERS => null,
         * ];
         *
         * Security Note: you have to remember CORS is not access control system and you should not expect all
         * cross-origin requests will have pre-flights. For so-called 'simple' methods with so-called 'simple'
         * headers request will be made without pre-flight. Thus you can not restrict such requests with CORS
         * and should use other means.
         * For example method 'GET' without any headers or with only 'simple' headers will not have pre-flight
         * request so disabling it will not restrict access to resource(s).
         *
         * You can read more on 'simple' headers at http://www.w3.org/TR/cors/#simple-header
         */
        self::KEY_ALLOWED_HEADERS             => [],

        /**
         * A list of headers (case insensitive) which will be made accessible to user agent (browser) in response.
         * Value `true` enables and value `null` disables header.
         *
         * For example,
         *
         * [
         *     'Content-Type'             => true,
         *     'X-Custom-Response-Header' => true,
         *     'X-Disabled-Header'        => null,
         * ];
         */
        self::KEY_EXPOSED_HEADERS      => [],

        /**
         * If access with credentials is supported by the resource.
         */
        self::KEY_IS_USING_CREDENTIALS => false,

        /**
         * Pre-flight response cache max period in seconds.
         *
         * @var int
         */
        self::KEY_FLIGHT_CACHE_MAX_AGE => 0,

        /**
         * If allowed methods should be added to pre-flight response when
         * 'simple' method is requested (see #6.2.9 CORS).
         *
         * @see http://www.w3.org/TR/cors/#resource-preflight-requests
         */
        self::KEY_IS_FORCE_ADD_METHODS => false,

        /**
         * If allowed headers should be added when request headers are 'simple' and
         * non of them is 'Content-Type' (see #6.2.10 CORS).
         *
         * @see http://www.w3.org/TR/cors/#resource-preflight-requests
         *
         * @var bool
         */
        self::KEY_IS_FORCE_ADD_HEADERS => false,

        /**
         * If request 'Host' header should be checked against server's origin.
         *
         * @var bool
         */
        self::KEY_IS_CHECK_HOST => false,
    ];

    /**
     * @inheritdoc
     */
    public function getSettings()
    {
        return $this->settings;
    }

    /**
     * @inheritdoc
     */
    public function setSettings(array $settings)
    {
        $this->settings = $settings;
    }

    /**
     * @inheritdoc
     */
    public function getServerOrigin()
    {
        return $this->settings[self::KEY_SERVER_ORIGIN];
    }

    /**
     * @inheritdoc
     */
    public function setServerOrigin($origin)
    {
        $this->settings[self::KEY_SERVER_ORIGIN] = is_string($origin) === true ? parse_url($origin) : $origin;

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isPreFlightCanBeCached(RequestInterface $request)
    {
        return $this->getPreFlightCacheMaxAge($request) > 0;
    }

    /**
     * @inheritdoc
     */
    public function getPreFlightCacheMaxAge(RequestInterface $request)
    {
        return $this->settings[self::KEY_FLIGHT_CACHE_MAX_AGE];
    }

    /**
     * @inheritdoc
     */
    public function setPreFlightCacheMaxAge($cacheMaxAge)
    {
        $this->settings[self::KEY_FLIGHT_CACHE_MAX_AGE] = $cacheMaxAge;

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isForceAddAllowedMethodsToPreFlightResponse()
    {
        return $this->settings[self::KEY_IS_FORCE_ADD_METHODS];
    }

    /**
     * @inheritdoc
     */
    public function setForceAddAllowedMethodsToPreFlightResponse($forceFlag)
    {
        $this->settings[self::KEY_IS_FORCE_ADD_METHODS] = $forceFlag;

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isForceAddAllowedHeadersToPreFlightResponse()
    {
        return $this->settings[self::KEY_IS_FORCE_ADD_HEADERS];
    }

    /**
     * @inheritdoc
     */
    public function setForceAddAllowedHeadersToPreFlightResponse($forceFlag)
    {
        $this->settings[self::KEY_IS_FORCE_ADD_HEADERS] = $forceFlag;

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isRequestCredentialsSupported(RequestInterface $request)
    {
        return $this->settings[self::KEY_IS_USING_CREDENTIALS];
    }

    /**
     * @inheritdoc
     */
    public function setRequestCredentialsSupported($isSupported)
    {
        $this->settings[self::KEY_IS_USING_CREDENTIALS] = $isSupported;

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isRequestOriginAllowed(ParsedUrlInterface $requestOrigin)
    {
        // check if all origins are allowed with '*'
        $isAllowed =
            isset($this->settings[self::KEY_ALLOWED_ORIGINS][CorsResponseHeaders::VALUE_ALLOW_ORIGIN_ALL]);

        if ($isAllowed === false) {
            $requestOriginStr = strtolower($requestOrigin->getOrigin());
            $isAllowed        = isset($this->settings[self::KEY_ALLOWED_ORIGINS][$requestOriginStr]);
        }

        return $isAllowed;
    }

    /**
     * @inheritdoc
     */
    public function setRequestAllowedOrigins(array $origins)
    {
        $this->settings[self::KEY_ALLOWED_ORIGINS] = [];
        foreach ($origins as $origin => $enabled) {
            $lcOrigin                                             = strtolower($origin);
            $this->settings[self::KEY_ALLOWED_ORIGINS][$lcOrigin] = $enabled;
        }

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isRequestMethodSupported($method)
    {
        $isAllowed = isset($this->settings[self::KEY_ALLOWED_METHODS][$method]);

        return $isAllowed;
    }

    /**
     * @inheritdoc
     */
    public function isRequestAllHeadersSupported($headers)
    {
        $allSupported = true;

        if (isset($this->settings[self::KEY_ALLOWED_HEADERS][self::VALUE_ALLOW_ALL_HEADERS]) === true) {
            return $allSupported;
        }

        foreach ($headers as $header) {
            $lcHeader = strtolower($header);
            if (isset($this->settings[self::KEY_ALLOWED_HEADERS][$lcHeader]) === false) {
                $allSupported = false;
                $this->logInfo(
                    'Request header is not allowed. Check config settings for Allowed Headers.',
                    ['header' => $header]
                );
                break;
            }
        }

        return $allSupported;
    }

    /**
     * @inheritdoc
     */
    public function getRequestAllowedMethods(RequestInterface $request, $requestMethod)
    {
        return implode(', ', $this->getEnabledItems($this->settings[self::KEY_ALLOWED_METHODS]));
    }

    /**
     * @inheritdoc
     */
    public function setRequestAllowedMethods(array $methods)
    {
        $this->settings[self::KEY_ALLOWED_METHODS] = [];
        foreach ($methods as $method => $enabled) {
            $this->settings[self::KEY_ALLOWED_METHODS][$method] = $enabled;
        }

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function getRequestAllowedHeaders(RequestInterface $request, array $requestHeaders)
    {
        return implode(', ', $this->getEnabledItems($this->settings[self::KEY_ALLOWED_HEADERS]));
    }

    /**
     * @inheritdoc
     */
    public function setRequestAllowedHeaders(array $headers)
    {
        $this->settings[self::KEY_ALLOWED_HEADERS] = [];
        foreach ($headers as $header => $enabled) {
            $lcHeader                                             = strtolower($header);
            $this->settings[self::KEY_ALLOWED_HEADERS][$lcHeader] = $enabled;
        }

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function getResponseExposedHeaders(RequestInterface $request)
    {
        return $this->getEnabledItems($this->settings[self::KEY_EXPOSED_HEADERS]);
    }

    /**
     * @inheritdoc
     */
    public function setResponseExposedHeaders(array $headers)
    {
        $this->settings[self::KEY_EXPOSED_HEADERS] = $headers;

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function isCheckHost()
    {
        return $this->settings[self::KEY_IS_CHECK_HOST];
    }

    /**
     * @inheritdoc
     */
    public function setCheckHost($checkFlag)
    {
        $this->settings[self::KEY_IS_CHECK_HOST] = $checkFlag;

        return $this;
    }

    /**
     * Select only enabled items from $list.
     *
     * @param array $list
     *
     * @return array
     */
    protected function getEnabledItems(array $list)
    {
        $items = [];

        foreach ($list as $item => $enabled) {
            if ($enabled === true) {
                $items[] = $item;
            }
        }

        return $items;
    }
}