nextcloud / server

settings/Controller/TwoFactorSettingsController.php

Indentation +17 added lines, -17 removed lines

@@ -34,27 +34,27 @@
 
 class TwoFactorSettingsController extends Controller {
 
-	/** @var MandatoryTwoFactor */
-	private $mandatoryTwoFactor;
+    /** @var MandatoryTwoFactor */
+    private $mandatoryTwoFactor;
 
-	public function __construct(string $appName,
-								IRequest $request,
-								MandatoryTwoFactor $mandatoryTwoFactor) {
-		parent::__construct($appName, $request);
+    public function __construct(string $appName,
+                                IRequest $request,
+                                MandatoryTwoFactor $mandatoryTwoFactor) {
+        parent::__construct($appName, $request);
 
-		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
-	}
+        $this->mandatoryTwoFactor = $mandatoryTwoFactor;
+    }
 
-	public function index(): JSONResponse {
-		return new JSONResponse($this->mandatoryTwoFactor->getState());
-	}
+    public function index(): JSONResponse {
+        return new JSONResponse($this->mandatoryTwoFactor->getState());
+    }
 
-	public function update(bool $enforced, array $enforcedGroups = [], array $excludedGroups = []): JSONResponse {
-		$this->mandatoryTwoFactor->setState(
-			new EnforcementState($enforced, $enforcedGroups, $excludedGroups)
-		);
+    public function update(bool $enforced, array $enforcedGroups = [], array $excludedGroups = []): JSONResponse {
+        $this->mandatoryTwoFactor->setState(
+            new EnforcementState($enforced, $enforcedGroups, $excludedGroups)
+        );
 
-		return new JSONResponse($this->mandatoryTwoFactor->getState());
-	}
+        return new JSONResponse($this->mandatoryTwoFactor->getState());
+    }
 
 }
\ No newline at end of file

lib/private/Authentication/TwoFactorAuth/EnforcementState.php

Indentation +45 added lines, -45 removed lines

@@ -29,57 +29,57 @@
 
 class EnforcementState implements JsonSerializable {
 
-	/** @var bool */
-	private $enforced;
+    /** @var bool */
+    private $enforced;
 
-	/** @var array */
-	private $enforcedGroups;
+    /** @var array */
+    private $enforcedGroups;
 
-	/** @var array */
-	private $excludedGroups;
+    /** @var array */
+    private $excludedGroups;
 
-	/**
-	 * EnforcementState constructor.
-	 *
-	 * @param bool $enforced
-	 * @param string[] $enforcedGroups
-	 * @param string[] $excludedGroups
-	 */
-	public function __construct(bool $enforced,
-								array $enforcedGroups = [],
-								array $excludedGroups = []) {
-		$this->enforced = $enforced;
-		$this->enforcedGroups = $enforcedGroups;
-		$this->excludedGroups = $excludedGroups;
-	}
+    /**
+     * EnforcementState constructor.
+     *
+     * @param bool $enforced
+     * @param string[] $enforcedGroups
+     * @param string[] $excludedGroups
+     */
+    public function __construct(bool $enforced,
+                                array $enforcedGroups = [],
+                                array $excludedGroups = []) {
+        $this->enforced = $enforced;
+        $this->enforcedGroups = $enforcedGroups;
+        $this->excludedGroups = $excludedGroups;
+    }
 
-	/**
-	 * @return string[]
-	 */
-	public function isEnforced(): bool {
-		return $this->enforced;
-	}
+    /**
+     * @return string[]
+     */
+    public function isEnforced(): bool {
+        return $this->enforced;
+    }
 
-	/**
-	 * @return string[]
-	 */
-	public function getEnforcedGroups(): array {
-		return $this->enforcedGroups;
-	}
+    /**
+     * @return string[]
+     */
+    public function getEnforcedGroups(): array {
+        return $this->enforcedGroups;
+    }
 
-	/**
-	 * @return string[]
-	 */
-	public function getExcludedGroups(): array {
-		return $this->excludedGroups;
-	}
+    /**
+     * @return string[]
+     */
+    public function getExcludedGroups(): array {
+        return $this->excludedGroups;
+    }
 
-	public function jsonSerialize(): array {
-		return [
-			'enforced' => $this->enforced,
-			'enforcedGroups' => $this->enforcedGroups,
-			'excludedGroups' => $this->excludedGroups,
-		];
-	}
+    public function jsonSerialize(): array {
+        return [
+            'enforced' => $this->enforced,
+            'enforcedGroups' => $this->enforcedGroups,
+            'excludedGroups' => $this->excludedGroups,
+        ];
+    }
 
 }

lib/private/Authentication/TwoFactorAuth/MandatoryTwoFactor.php

Indentation +75 added lines, -75 removed lines

@@ -32,84 +32,84 @@
 
 class MandatoryTwoFactor {
 
-	/** @var IConfig */
-	private $config;
-
-	/** @var IGroupManager */
-	private $groupManager;
-
-	public function __construct(IConfig $config, IGroupManager $groupManager) {
-		$this->config = $config;
-		$this->groupManager = $groupManager;
-	}
-
-	/**
-	 * Get the state of enforced two-factor auth
-	 */
-	public function getState(): EnforcementState {
-		return new EnforcementState(
-			$this->config->getSystemValue('twofactor_enforced', 'false') === 'true',
-			$this->config->getSystemValue('twofactor_enforced_groups', []),
-			$this->config->getSystemValue('twofactor_enforced_excluded_groups', [])
-		);
-	}
-
-	/**
-	 * Set the state of enforced two-factor auth
-	 */
-	public function setState(EnforcementState $state) {
-		$this->config->setSystemValue('twofactor_enforced', $state->isEnforced() ? 'true' : 'false');
-		$this->config->setSystemValue('twofactor_enforced_groups', $state->getEnforcedGroups());
-		$this->config->setSystemValue('twofactor_enforced_excluded_groups', $state->getExcludedGroups());
-	}
-
-	/**
-	 * Check if two-factor auth is enforced for a specific user
-	 *
-	 * The admin(s) can enforce two-factor auth system-wide, for certain groups only
-	 * and also have the option to exclude users of certain groups. This method will
-	 * check their membership of those groups.
-	 *
-	 * @param IUser $user
-	 *
-	 * @return bool
-	 */
-	public function isEnforcedFor(IUser $user): bool {
-		$state = $this->getState();
-		if (!$state->isEnforced()) {
-			return false;
-		}
-		$uid = $user->getUID();
-
-		/*
+    /** @var IConfig */
+    private $config;
+
+    /** @var IGroupManager */
+    private $groupManager;
+
+    public function __construct(IConfig $config, IGroupManager $groupManager) {
+        $this->config = $config;
+        $this->groupManager = $groupManager;
+    }
+
+    /**
+     * Get the state of enforced two-factor auth
+     */
+    public function getState(): EnforcementState {
+        return new EnforcementState(
+            $this->config->getSystemValue('twofactor_enforced', 'false') === 'true',
+            $this->config->getSystemValue('twofactor_enforced_groups', []),
+            $this->config->getSystemValue('twofactor_enforced_excluded_groups', [])
+        );
+    }
+
+    /**
+     * Set the state of enforced two-factor auth
+     */
+    public function setState(EnforcementState $state) {
+        $this->config->setSystemValue('twofactor_enforced', $state->isEnforced() ? 'true' : 'false');
+        $this->config->setSystemValue('twofactor_enforced_groups', $state->getEnforcedGroups());
+        $this->config->setSystemValue('twofactor_enforced_excluded_groups', $state->getExcludedGroups());
+    }
+
+    /**
+     * Check if two-factor auth is enforced for a specific user
+     *
+     * The admin(s) can enforce two-factor auth system-wide, for certain groups only
+     * and also have the option to exclude users of certain groups. This method will
+     * check their membership of those groups.
+     *
+     * @param IUser $user
+     *
+     * @return bool
+     */
+    public function isEnforcedFor(IUser $user): bool {
+        $state = $this->getState();
+        if (!$state->isEnforced()) {
+            return false;
+        }
+        $uid = $user->getUID();
+
+        /*
 		 * If there is a list of enforced groups, we only enforce 2FA for members of those groups.
 		 * For all the other users it is not enforced (overruling the excluded groups list).
 		 */
-		if (!empty($state->getEnforcedGroups())) {
-			foreach ($state->getEnforcedGroups() as $group) {
-				if ($this->groupManager->isInGroup($uid, $group)) {
-					return true;
-				}
-			}
-			// Not a member of any of these groups -> no 2FA enforced
-			return false;
-		}
-
-		/**
-		 * If the user is member of an excluded group, 2FA won't be enforced.
-		 */
-		foreach ($state->getExcludedGroups() as $group) {
-			if ($this->groupManager->isInGroup($uid, $group)) {
-				return false;
-			}
-		}
-
-		/**
-		 * No enforced groups configured and user not member of an excluded groups,
-		 * so 2FA is enforced.
-		 */
-		return true;
-	}
+        if (!empty($state->getEnforcedGroups())) {
+            foreach ($state->getEnforcedGroups() as $group) {
+                if ($this->groupManager->isInGroup($uid, $group)) {
+                    return true;
+                }
+            }
+            // Not a member of any of these groups -> no 2FA enforced
+            return false;
+        }
+
+        /**
+         * If the user is member of an excluded group, 2FA won't be enforced.
+         */
+        foreach ($state->getExcludedGroups() as $group) {
+            if ($this->groupManager->isInGroup($uid, $group)) {
+                return false;
+            }
+        }
+
+        /**
+         * No enforced groups configured and user not member of an excluded groups,
+         * so 2FA is enforced.
+         */
+        return true;
+    }
 
 
 }

lib/private/Authentication/TwoFactorAuth/Manager.php

Indentation +314 added lines, -314 removed lines

@@ -46,322 +46,322 @@
 
 class Manager {
 
-	const SESSION_UID_KEY = 'two_factor_auth_uid';
-	const SESSION_UID_DONE = 'two_factor_auth_passed';
-	const REMEMBER_LOGIN = 'two_factor_remember_login';
-	const BACKUP_CODES_PROVIDER_ID = 'backup_codes';
-
-	/** @var ProviderLoader */
-	private $providerLoader;
-
-	/** @var IRegistry */
-	private $providerRegistry;
-
-	/** @var MandatoryTwoFactor */
-	private $mandatoryTwoFactor;
-
-	/** @var ISession */
-	private $session;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var IManager */
-	private $activityManager;
-
-	/** @var ILogger */
-	private $logger;
-
-	/** @var TokenProvider */
-	private $tokenProvider;
-
-	/** @var ITimeFactory */
-	private $timeFactory;
-
-	/** @var EventDispatcherInterface */
-	private $dispatcher;
-
-	public function __construct(ProviderLoader $providerLoader,
-								IRegistry $providerRegistry,
-								MandatoryTwoFactor $mandatoryTwoFactor,
-								ISession $session, IConfig $config,
-								IManager $activityManager, ILogger $logger, TokenProvider $tokenProvider,
-								ITimeFactory $timeFactory, EventDispatcherInterface $eventDispatcher) {
-		$this->providerLoader = $providerLoader;
-		$this->providerRegistry = $providerRegistry;
-		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
-		$this->session = $session;
-		$this->config = $config;
-		$this->activityManager = $activityManager;
-		$this->logger = $logger;
-		$this->tokenProvider = $tokenProvider;
-		$this->timeFactory = $timeFactory;
-		$this->dispatcher = $eventDispatcher;
-	}
-
-	/**
-	 * Determine whether the user must provide a second factor challenge
-	 *
-	 * @param IUser $user
-	 * @return boolean
-	 */
-	public function isTwoFactorAuthenticated(IUser $user): bool {
-		if ($this->mandatoryTwoFactor->isEnforcedFor($user)) {
-			return true;
-		}
-
-		$providerStates = $this->providerRegistry->getProviderStates($user);
-		$providers = $this->providerLoader->getProviders($user);
-		$fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
-		$enabled = array_filter($fixedStates);
-		$providerIds = array_keys($enabled);
-		$providerIdsWithoutBackupCodes = array_diff($providerIds, [self::BACKUP_CODES_PROVIDER_ID]);
-
-		return !empty($providerIdsWithoutBackupCodes);
-	}
-
-	/**
-	 * Get a 2FA provider by its ID
-	 *
-	 * @param IUser $user
-	 * @param string $challengeProviderId
-	 * @return IProvider|null
-	 */
-	public function getProvider(IUser $user, string $challengeProviderId) {
-		$providers = $this->getProviderSet($user)->getProviders();
-		return $providers[$challengeProviderId] ?? null;
-	}
-
-	/**
-	 * Check if the persistant mapping of enabled/disabled state of each available
-	 * provider is missing an entry and add it to the registry in that case.
-	 *
-	 * @todo remove in Nextcloud 17 as by then all providers should have been updated
-	 *
-	 * @param string[] $providerStates
-	 * @param IProvider[] $providers
-	 * @param IUser $user
-	 * @return string[] the updated $providerStates variable
-	 */
-	private function fixMissingProviderStates(array $providerStates,
-		array $providers, IUser $user): array {
-
-		foreach ($providers as $provider) {
-			if (isset($providerStates[$provider->getId()])) {
-				// All good
-				continue;
-			}
-
-			$enabled = $provider->isTwoFactorAuthEnabledForUser($user);
-			if ($enabled) {
-				$this->providerRegistry->enableProviderFor($provider, $user);
-			} else {
-				$this->providerRegistry->disableProviderFor($provider, $user);
-			}
-			$providerStates[$provider->getId()] = $enabled;
-		}
-
-		return $providerStates;
-	}
-
-	/**
-	 * @param array $states
-	 * @param IProvider $providers
-	 */
-	private function isProviderMissing(array $states, array $providers): bool {
-		$indexed = [];
-		foreach ($providers as $provider) {
-			$indexed[$provider->getId()] = $provider;
-		}
-
-		$missing = [];
-		foreach ($states as $providerId => $enabled) {
-			if (!$enabled) {
-				// Don't care
-				continue;
-			}
-
-			if (!isset($indexed[$providerId])) {
-				$missing[] = $providerId;
-				$this->logger->alert("two-factor auth provider '$providerId' failed to load",
-					[
-					'app' => 'core',
-				]);
-			}
-		}
-
-		if (!empty($missing)) {
-			// There was at least one provider missing
-			$this->logger->alert(count($missing) . " two-factor auth providers failed to load", ['app' => 'core']);
-
-			return true;
-		}
-
-		// If we reach this, there was not a single provider missing
-		return false;
-	}
-
-	/**
-	 * Get the list of 2FA providers for the given user
-	 *
-	 * @param IUser $user
-	 * @throws Exception
-	 */
-	public function getProviderSet(IUser $user): ProviderSet {
-		$providerStates = $this->providerRegistry->getProviderStates($user);
-		$providers = $this->providerLoader->getProviders($user);
-
-		$fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
-		$isProviderMissing = $this->isProviderMissing($fixedStates, $providers);
-
-		$enabled = array_filter($providers, function (IProvider $provider) use ($fixedStates) {
-			return $fixedStates[$provider->getId()];
-		});
-		return new ProviderSet($enabled, $isProviderMissing);
-	}
-
-	/**
-	 * Verify the given challenge
-	 *
-	 * @param string $providerId
-	 * @param IUser $user
-	 * @param string $challenge
-	 * @return boolean
-	 */
-	public function verifyChallenge(string $providerId, IUser $user, string $challenge): bool {
-		$provider = $this->getProvider($user, $providerId);
-		if ($provider === null) {
-			return false;
-		}
-
-		$passed = $provider->verifyChallenge($user, $challenge);
-		if ($passed) {
-			if ($this->session->get(self::REMEMBER_LOGIN) === true) {
-				// TODO: resolve cyclic dependency and use DI
-				\OC::$server->getUserSession()->createRememberMeToken($user);
-			}
-			$this->session->remove(self::SESSION_UID_KEY);
-			$this->session->remove(self::REMEMBER_LOGIN);
-			$this->session->set(self::SESSION_UID_DONE, $user->getUID());
-
-			// Clear token from db
-			$sessionId = $this->session->getId();
-			$token = $this->tokenProvider->getToken($sessionId);
-			$tokenId = $token->getId();
-			$this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $tokenId);
-
-			$dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
-			$this->dispatcher->dispatch(IProvider::EVENT_SUCCESS, $dispatchEvent);
-
-			$this->publishEvent($user, 'twofactor_success', [
-				'provider' => $provider->getDisplayName(),
-			]);
-		} else {
-			$dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
-			$this->dispatcher->dispatch(IProvider::EVENT_FAILED, $dispatchEvent);
-
-			$this->publishEvent($user, 'twofactor_failed', [
-				'provider' => $provider->getDisplayName(),
-			]);
-		}
-		return $passed;
-	}
-
-	/**
-	 * Push a 2fa event the user's activity stream
-	 *
-	 * @param IUser $user
-	 * @param string $event
-	 * @param array $params
-	 */
-	private function publishEvent(IUser $user, string $event, array $params) {
-		$activity = $this->activityManager->generateEvent();
-		$activity->setApp('core')
-			->setType('security')
-			->setAuthor($user->getUID())
-			->setAffectedUser($user->getUID())
-			->setSubject($event, $params);
-		try {
-			$this->activityManager->publish($activity);
-		} catch (BadMethodCallException $e) {
-			$this->logger->warning('could not publish activity', ['app' => 'core']);
-			$this->logger->logException($e, ['app' => 'core']);
-		}
-	}
-
-	/**
-	 * Check if the currently logged in user needs to pass 2FA
-	 *
-	 * @param IUser $user the currently logged in user
-	 * @return boolean
-	 */
-	public function needsSecondFactor(IUser $user = null): bool {
-		if ($user === null) {
-			return false;
-		}
-
-		// If we are authenticated using an app password skip all this
-		if ($this->session->exists('app_password')) {
-			return false;
-		}
-
-		// First check if the session tells us we should do 2FA (99% case)
-		if (!$this->session->exists(self::SESSION_UID_KEY)) {
-
-			// Check if the session tells us it is 2FA authenticated already
-			if ($this->session->exists(self::SESSION_UID_DONE) &&
-				$this->session->get(self::SESSION_UID_DONE) === $user->getUID()) {
-				return false;
-			}
-
-			/*
+    const SESSION_UID_KEY = 'two_factor_auth_uid';
+    const SESSION_UID_DONE = 'two_factor_auth_passed';
+    const REMEMBER_LOGIN = 'two_factor_remember_login';
+    const BACKUP_CODES_PROVIDER_ID = 'backup_codes';
+
+    /** @var ProviderLoader */
+    private $providerLoader;
+
+    /** @var IRegistry */
+    private $providerRegistry;
+
+    /** @var MandatoryTwoFactor */
+    private $mandatoryTwoFactor;
+
+    /** @var ISession */
+    private $session;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var IManager */
+    private $activityManager;
+
+    /** @var ILogger */
+    private $logger;
+
+    /** @var TokenProvider */
+    private $tokenProvider;
+
+    /** @var ITimeFactory */
+    private $timeFactory;
+
+    /** @var EventDispatcherInterface */
+    private $dispatcher;
+
+    public function __construct(ProviderLoader $providerLoader,
+                                IRegistry $providerRegistry,
+                                MandatoryTwoFactor $mandatoryTwoFactor,
+                                ISession $session, IConfig $config,
+                                IManager $activityManager, ILogger $logger, TokenProvider $tokenProvider,
+                                ITimeFactory $timeFactory, EventDispatcherInterface $eventDispatcher) {
+        $this->providerLoader = $providerLoader;
+        $this->providerRegistry = $providerRegistry;
+        $this->mandatoryTwoFactor = $mandatoryTwoFactor;
+        $this->session = $session;
+        $this->config = $config;
+        $this->activityManager = $activityManager;
+        $this->logger = $logger;
+        $this->tokenProvider = $tokenProvider;
+        $this->timeFactory = $timeFactory;
+        $this->dispatcher = $eventDispatcher;
+    }
+
+    /**
+     * Determine whether the user must provide a second factor challenge
+     *
+     * @param IUser $user
+     * @return boolean
+     */
+    public function isTwoFactorAuthenticated(IUser $user): bool {
+        if ($this->mandatoryTwoFactor->isEnforcedFor($user)) {
+            return true;
+        }
+
+        $providerStates = $this->providerRegistry->getProviderStates($user);
+        $providers = $this->providerLoader->getProviders($user);
+        $fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
+        $enabled = array_filter($fixedStates);
+        $providerIds = array_keys($enabled);
+        $providerIdsWithoutBackupCodes = array_diff($providerIds, [self::BACKUP_CODES_PROVIDER_ID]);
+
+        return !empty($providerIdsWithoutBackupCodes);
+    }
+
+    /**
+     * Get a 2FA provider by its ID
+     *
+     * @param IUser $user
+     * @param string $challengeProviderId
+     * @return IProvider|null
+     */
+    public function getProvider(IUser $user, string $challengeProviderId) {
+        $providers = $this->getProviderSet($user)->getProviders();
+        return $providers[$challengeProviderId] ?? null;
+    }
+
+    /**
+     * Check if the persistant mapping of enabled/disabled state of each available
+     * provider is missing an entry and add it to the registry in that case.
+     *
+     * @todo remove in Nextcloud 17 as by then all providers should have been updated
+     *
+     * @param string[] $providerStates
+     * @param IProvider[] $providers
+     * @param IUser $user
+     * @return string[] the updated $providerStates variable
+     */
+    private function fixMissingProviderStates(array $providerStates,
+        array $providers, IUser $user): array {
+
+        foreach ($providers as $provider) {
+            if (isset($providerStates[$provider->getId()])) {
+                // All good
+                continue;
+            }
+
+            $enabled = $provider->isTwoFactorAuthEnabledForUser($user);
+            if ($enabled) {
+                $this->providerRegistry->enableProviderFor($provider, $user);
+            } else {
+                $this->providerRegistry->disableProviderFor($provider, $user);
+            }
+            $providerStates[$provider->getId()] = $enabled;
+        }
+
+        return $providerStates;
+    }
+
+    /**
+     * @param array $states
+     * @param IProvider $providers
+     */
+    private function isProviderMissing(array $states, array $providers): bool {
+        $indexed = [];
+        foreach ($providers as $provider) {
+            $indexed[$provider->getId()] = $provider;
+        }
+
+        $missing = [];
+        foreach ($states as $providerId => $enabled) {
+            if (!$enabled) {
+                // Don't care
+                continue;
+            }
+
+            if (!isset($indexed[$providerId])) {
+                $missing[] = $providerId;
+                $this->logger->alert("two-factor auth provider '$providerId' failed to load",
+                    [
+                    'app' => 'core',
+                ]);
+            }
+        }
+
+        if (!empty($missing)) {
+            // There was at least one provider missing
+            $this->logger->alert(count($missing) . " two-factor auth providers failed to load", ['app' => 'core']);
+
+            return true;
+        }
+
+        // If we reach this, there was not a single provider missing
+        return false;
+    }
+
+    /**
+     * Get the list of 2FA providers for the given user
+     *
+     * @param IUser $user
+     * @throws Exception
+     */
+    public function getProviderSet(IUser $user): ProviderSet {
+        $providerStates = $this->providerRegistry->getProviderStates($user);
+        $providers = $this->providerLoader->getProviders($user);
+
+        $fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
+        $isProviderMissing = $this->isProviderMissing($fixedStates, $providers);
+
+        $enabled = array_filter($providers, function (IProvider $provider) use ($fixedStates) {
+            return $fixedStates[$provider->getId()];
+        });
+        return new ProviderSet($enabled, $isProviderMissing);
+    }
+
+    /**
+     * Verify the given challenge
+     *
+     * @param string $providerId
+     * @param IUser $user
+     * @param string $challenge
+     * @return boolean
+     */
+    public function verifyChallenge(string $providerId, IUser $user, string $challenge): bool {
+        $provider = $this->getProvider($user, $providerId);
+        if ($provider === null) {
+            return false;
+        }
+
+        $passed = $provider->verifyChallenge($user, $challenge);
+        if ($passed) {
+            if ($this->session->get(self::REMEMBER_LOGIN) === true) {
+                // TODO: resolve cyclic dependency and use DI
+                \OC::$server->getUserSession()->createRememberMeToken($user);
+            }
+            $this->session->remove(self::SESSION_UID_KEY);
+            $this->session->remove(self::REMEMBER_LOGIN);
+            $this->session->set(self::SESSION_UID_DONE, $user->getUID());
+
+            // Clear token from db
+            $sessionId = $this->session->getId();
+            $token = $this->tokenProvider->getToken($sessionId);
+            $tokenId = $token->getId();
+            $this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $tokenId);
+
+            $dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
+            $this->dispatcher->dispatch(IProvider::EVENT_SUCCESS, $dispatchEvent);
+
+            $this->publishEvent($user, 'twofactor_success', [
+                'provider' => $provider->getDisplayName(),
+            ]);
+        } else {
+            $dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
+            $this->dispatcher->dispatch(IProvider::EVENT_FAILED, $dispatchEvent);
+
+            $this->publishEvent($user, 'twofactor_failed', [
+                'provider' => $provider->getDisplayName(),
+            ]);
+        }
+        return $passed;
+    }
+
+    /**
+     * Push a 2fa event the user's activity stream
+     *
+     * @param IUser $user
+     * @param string $event
+     * @param array $params
+     */
+    private function publishEvent(IUser $user, string $event, array $params) {
+        $activity = $this->activityManager->generateEvent();
+        $activity->setApp('core')
+            ->setType('security')
+            ->setAuthor($user->getUID())
+            ->setAffectedUser($user->getUID())
+            ->setSubject($event, $params);
+        try {
+            $this->activityManager->publish($activity);
+        } catch (BadMethodCallException $e) {
+            $this->logger->warning('could not publish activity', ['app' => 'core']);
+            $this->logger->logException($e, ['app' => 'core']);
+        }
+    }
+
+    /**
+     * Check if the currently logged in user needs to pass 2FA
+     *
+     * @param IUser $user the currently logged in user
+     * @return boolean
+     */
+    public function needsSecondFactor(IUser $user = null): bool {
+        if ($user === null) {
+            return false;
+        }
+
+        // If we are authenticated using an app password skip all this
+        if ($this->session->exists('app_password')) {
+            return false;
+        }
+
+        // First check if the session tells us we should do 2FA (99% case)
+        if (!$this->session->exists(self::SESSION_UID_KEY)) {
+
+            // Check if the session tells us it is 2FA authenticated already
+            if ($this->session->exists(self::SESSION_UID_DONE) &&
+                $this->session->get(self::SESSION_UID_DONE) === $user->getUID()) {
+                return false;
+            }
+
+            /*
 			 * If the session is expired check if we are not logged in by a token
 			 * that still needs 2FA auth
 			 */
-			try {
-				$sessionId = $this->session->getId();
-				$token = $this->tokenProvider->getToken($sessionId);
-				$tokenId = $token->getId();
-				$tokensNeeding2FA = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
-
-				if (!\in_array($tokenId, $tokensNeeding2FA, true)) {
-					$this->session->set(self::SESSION_UID_DONE, $user->getUID());
-					return false;
-				}
-			} catch (InvalidTokenException $e) {
-			}
-		}
-
-		if (!$this->isTwoFactorAuthenticated($user)) {
-			// There is no second factor any more -> let the user pass
-			//   This prevents infinite redirect loops when a user is about
-			//   to solve the 2FA challenge, and the provider app is
-			//   disabled the same time
-			$this->session->remove(self::SESSION_UID_KEY);
-
-			$keys = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
-			foreach ($keys as $key) {
-				$this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $key);
-			}
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * Prepare the 2FA login
-	 *
-	 * @param IUser $user
-	 * @param boolean $rememberMe
-	 */
-	public function prepareTwoFactorLogin(IUser $user, bool $rememberMe) {
-		$this->session->set(self::SESSION_UID_KEY, $user->getUID());
-		$this->session->set(self::REMEMBER_LOGIN, $rememberMe);
-
-		$id = $this->session->getId();
-		$token = $this->tokenProvider->getToken($id);
-		$this->config->setUserValue($user->getUID(), 'login_token_2fa', $token->getId(), $this->timeFactory->getTime());
-	}
+            try {
+                $sessionId = $this->session->getId();
+                $token = $this->tokenProvider->getToken($sessionId);
+                $tokenId = $token->getId();
+                $tokensNeeding2FA = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
+
+                if (!\in_array($tokenId, $tokensNeeding2FA, true)) {
+                    $this->session->set(self::SESSION_UID_DONE, $user->getUID());
+                    return false;
+                }
+            } catch (InvalidTokenException $e) {
+            }
+        }
+
+        if (!$this->isTwoFactorAuthenticated($user)) {
+            // There is no second factor any more -> let the user pass
+            //   This prevents infinite redirect loops when a user is about
+            //   to solve the 2FA challenge, and the provider app is
+            //   disabled the same time
+            $this->session->remove(self::SESSION_UID_KEY);
+
+            $keys = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
+            foreach ($keys as $key) {
+                $this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $key);
+            }
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Prepare the 2FA login
+     *
+     * @param IUser $user
+     * @param boolean $rememberMe
+     */
+    public function prepareTwoFactorLogin(IUser $user, bool $rememberMe) {
+        $this->session->set(self::SESSION_UID_KEY, $user->getUID());
+        $this->session->set(self::REMEMBER_LOGIN, $rememberMe);
+
+        $id = $this->session->getId();
+        $token = $this->tokenProvider->getToken($id);
+        $this->config->setUserValue($user->getUID(), 'login_token_2fa', $token->getId(), $this->timeFactory->getTime());
+    }
 
 }

core/Command/TwoFactorAuth/Enforce.php

Indentation +69 added lines, -69 removed lines

@@ -36,81 +36,81 @@
 
 class Enforce extends Command {
 
-	/** @var MandatoryTwoFactor */
-	private $mandatoryTwoFactor;
+    /** @var MandatoryTwoFactor */
+    private $mandatoryTwoFactor;
 
-	public function __construct(MandatoryTwoFactor $mandatoryTwoFactor) {
-		parent::__construct();
+    public function __construct(MandatoryTwoFactor $mandatoryTwoFactor) {
+        parent::__construct();
 
-		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
-	}
+        $this->mandatoryTwoFactor = $mandatoryTwoFactor;
+    }
 
-	protected function configure() {
-		$this->setName('twofactorauth:enforce');
-		$this->setDescription('Enabled/disable enforced two-factor authentication');
-		$this->addOption(
-			'on',
-			null,
-			InputOption::VALUE_NONE,
-			'enforce two-factor authentication'
-		);
-		$this->addOption(
-			'off',
-			null,
-			InputOption::VALUE_NONE,
-			'don\'t enforce two-factor authenticaton'
-		);
-		$this->addOption(
-			'group',
-			null,
-			InputOption::VALUE_OPTIONAL | InputOption::VALUE_IS_ARRAY,
-			'enforce only for the given group(s)'
-		);
-		$this->addOption(
-			'exclude',
-			null,
-			InputOption::VALUE_OPTIONAL | InputOption::VALUE_IS_ARRAY,
-			'exclude mandatory two-factor auth for the given group(s)'
-		);
-	}
+    protected function configure() {
+        $this->setName('twofactorauth:enforce');
+        $this->setDescription('Enabled/disable enforced two-factor authentication');
+        $this->addOption(
+            'on',
+            null,
+            InputOption::VALUE_NONE,
+            'enforce two-factor authentication'
+        );
+        $this->addOption(
+            'off',
+            null,
+            InputOption::VALUE_NONE,
+            'don\'t enforce two-factor authenticaton'
+        );
+        $this->addOption(
+            'group',
+            null,
+            InputOption::VALUE_OPTIONAL | InputOption::VALUE_IS_ARRAY,
+            'enforce only for the given group(s)'
+        );
+        $this->addOption(
+            'exclude',
+            null,
+            InputOption::VALUE_OPTIONAL | InputOption::VALUE_IS_ARRAY,
+            'exclude mandatory two-factor auth for the given group(s)'
+        );
+    }
 
-	protected function execute(InputInterface $input, OutputInterface $output) {
-		if ($input->getOption('on')) {
-			$enforcedGroups = $input->getOption('group');
-			$excludedGroups = $input->getOption('exclude');
-			$this->mandatoryTwoFactor->setState(new EnforcementState(true, $enforcedGroups, $excludedGroups));
-		} elseif ($input->getOption('off')) {
-			$this->mandatoryTwoFactor->setState(new EnforcementState(false));
-		}
+    protected function execute(InputInterface $input, OutputInterface $output) {
+        if ($input->getOption('on')) {
+            $enforcedGroups = $input->getOption('group');
+            $excludedGroups = $input->getOption('exclude');
+            $this->mandatoryTwoFactor->setState(new EnforcementState(true, $enforcedGroups, $excludedGroups));
+        } elseif ($input->getOption('off')) {
+            $this->mandatoryTwoFactor->setState(new EnforcementState(false));
+        }
 
-		$state = $this->mandatoryTwoFactor->getState();
-		if ($state->isEnforced()) {
-			$this->writeEnforced($output, $state);
-		} else {
-			$this->writeNotEnforced($output);
-		}
-	}
+        $state = $this->mandatoryTwoFactor->getState();
+        if ($state->isEnforced()) {
+            $this->writeEnforced($output, $state);
+        } else {
+            $this->writeNotEnforced($output);
+        }
+    }
 
-	/**
-	 * @param OutputInterface $output
-	 */
-	protected function writeEnforced(OutputInterface $output, EnforcementState $state) {
-		if (empty($state->getEnforcedGroups())) {
-			$message = 'Two-factor authentication is enforced for all users';
-		} else {
-			$message = 'Two-factor authentication is enforced for members of the group(s) ' . implode(', ', $state->getEnforcedGroups());
-		}
-		if (!empty($state->getExcludedGroups())) {
-			$message .= ', except members of ' . implode(', ', $state->getExcludedGroups());
-		}
-		$output->writeln($message);
-	}
+    /**
+     * @param OutputInterface $output
+     */
+    protected function writeEnforced(OutputInterface $output, EnforcementState $state) {
+        if (empty($state->getEnforcedGroups())) {
+            $message = 'Two-factor authentication is enforced for all users';
+        } else {
+            $message = 'Two-factor authentication is enforced for members of the group(s) ' . implode(', ', $state->getEnforcedGroups());
+        }
+        if (!empty($state->getExcludedGroups())) {
+            $message .= ', except members of ' . implode(', ', $state->getExcludedGroups());
+        }
+        $output->writeln($message);
+    }
 
-	/**
-	 * @param OutputInterface $output
-	 */
-	protected function writeNotEnforced(OutputInterface $output) {
-		$output->writeln('Two-factor authentication is not enforced');
-	}
+    /**
+     * @param OutputInterface $output
+     */
+    protected function writeNotEnforced(OutputInterface $output) {
+        $output->writeln('Two-factor authentication is not enforced');
+    }
 
 }

Spacing +2 added lines, -2 removed lines

@@ -98,10 +98,10 @@
 		if (empty($state->getEnforcedGroups())) {
 			$message = 'Two-factor authentication is enforced for all users';
 		} else {
-			$message = 'Two-factor authentication is enforced for members of the group(s) ' . implode(', ', $state->getEnforcedGroups());
+			$message = 'Two-factor authentication is enforced for members of the group(s) '.implode(', ', $state->getEnforcedGroups());
 		}
 		if (!empty($state->getExcludedGroups())) {
-			$message .= ', except members of ' . implode(', ', $state->getExcludedGroups());
+			$message .= ', except members of '.implode(', ', $state->getExcludedGroups());
 		}
 		$output->writeln($message);
 	}