nextcloud / server

lib/private/Authentication/Token/PublicKeyTokenMapper.php

Indentation +199 added lines, -199 removed lines

@@ -36,224 +36,224 @@
  * @template-extends QBMapper<PublicKeyToken>
  */
 class PublicKeyTokenMapper extends QBMapper {
-	public function __construct(IDBConnection $db) {
-		parent::__construct($db, 'authtoken');
-	}
+    public function __construct(IDBConnection $db) {
+        parent::__construct($db, 'authtoken');
+    }
 
-	/**
-	 * Invalidate (delete) a given token
-	 *
-	 * @param string $token
-	 */
-	public function invalidate(string $token) {
-		/* @var $qb IQueryBuilder */
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete($this->tableName)
-			->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
-			->execute();
-	}
+    /**
+     * Invalidate (delete) a given token
+     *
+     * @param string $token
+     */
+    public function invalidate(string $token) {
+        /* @var $qb IQueryBuilder */
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete($this->tableName)
+            ->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
+            ->execute();
+    }
 
-	/**
-	 * @param int $olderThan
-	 * @param int $remember
-	 */
-	public function invalidateOld(int $olderThan, int $remember = IToken::DO_NOT_REMEMBER) {
-		/* @var $qb IQueryBuilder */
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete($this->tableName)
-			->where($qb->expr()->lt('last_activity', $qb->createNamedParameter($olderThan, IQueryBuilder::PARAM_INT)))
-			->andWhere($qb->expr()->eq('type', $qb->createNamedParameter(IToken::TEMPORARY_TOKEN, IQueryBuilder::PARAM_INT)))
-			->andWhere($qb->expr()->eq('remember', $qb->createNamedParameter($remember, IQueryBuilder::PARAM_INT)))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
-			->execute();
-	}
+    /**
+     * @param int $olderThan
+     * @param int $remember
+     */
+    public function invalidateOld(int $olderThan, int $remember = IToken::DO_NOT_REMEMBER) {
+        /* @var $qb IQueryBuilder */
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete($this->tableName)
+            ->where($qb->expr()->lt('last_activity', $qb->createNamedParameter($olderThan, IQueryBuilder::PARAM_INT)))
+            ->andWhere($qb->expr()->eq('type', $qb->createNamedParameter(IToken::TEMPORARY_TOKEN, IQueryBuilder::PARAM_INT)))
+            ->andWhere($qb->expr()->eq('remember', $qb->createNamedParameter($remember, IQueryBuilder::PARAM_INT)))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
+            ->execute();
+    }
 
-	/**
-	 * Get the user UID for the given token
-	 *
-	 * @throws DoesNotExistException
-	 */
-	public function getToken(string $token): PublicKeyToken {
-		/* @var $qb IQueryBuilder */
-		$qb = $this->db->getQueryBuilder();
-		$result = $qb->select('*')
-			->from($this->tableName)
-			->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
-			->execute();
+    /**
+     * Get the user UID for the given token
+     *
+     * @throws DoesNotExistException
+     */
+    public function getToken(string $token): PublicKeyToken {
+        /* @var $qb IQueryBuilder */
+        $qb = $this->db->getQueryBuilder();
+        $result = $qb->select('*')
+            ->from($this->tableName)
+            ->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
+            ->execute();
 
-		$data = $result->fetch();
-		$result->closeCursor();
-		if ($data === false) {
-			throw new DoesNotExistException('token does not exist');
-		}
-		return PublicKeyToken::fromRow($data);
-	}
+        $data = $result->fetch();
+        $result->closeCursor();
+        if ($data === false) {
+            throw new DoesNotExistException('token does not exist');
+        }
+        return PublicKeyToken::fromRow($data);
+    }
 
-	/**
-	 * Get the token for $id
-	 *
-	 * @throws DoesNotExistException
-	 */
-	public function getTokenById(int $id): PublicKeyToken {
-		/* @var $qb IQueryBuilder */
-		$qb = $this->db->getQueryBuilder();
-		$result = $qb->select('*')
-			->from($this->tableName)
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
-			->execute();
+    /**
+     * Get the token for $id
+     *
+     * @throws DoesNotExistException
+     */
+    public function getTokenById(int $id): PublicKeyToken {
+        /* @var $qb IQueryBuilder */
+        $qb = $this->db->getQueryBuilder();
+        $result = $qb->select('*')
+            ->from($this->tableName)
+            ->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
+            ->execute();
 
-		$data = $result->fetch();
-		$result->closeCursor();
-		if ($data === false) {
-			throw new DoesNotExistException('token does not exist');
-		}
-		return PublicKeyToken::fromRow($data);
-	}
+        $data = $result->fetch();
+        $result->closeCursor();
+        if ($data === false) {
+            throw new DoesNotExistException('token does not exist');
+        }
+        return PublicKeyToken::fromRow($data);
+    }
 
-	/**
-	 * Get all tokens of a user
-	 *
-	 * The provider may limit the number of result rows in case of an abuse
-	 * where a high number of (session) tokens is generated
-	 *
-	 * @param string $uid
-	 * @return PublicKeyToken[]
-	 */
-	public function getTokenByUser(string $uid): array {
-		/* @var $qb IQueryBuilder */
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')
-			->from($this->tableName)
-			->where($qb->expr()->eq('uid', $qb->createNamedParameter($uid)))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
-			->setMaxResults(1000);
-		$result = $qb->execute();
-		$data = $result->fetchAll();
-		$result->closeCursor();
+    /**
+     * Get all tokens of a user
+     *
+     * The provider may limit the number of result rows in case of an abuse
+     * where a high number of (session) tokens is generated
+     *
+     * @param string $uid
+     * @return PublicKeyToken[]
+     */
+    public function getTokenByUser(string $uid): array {
+        /* @var $qb IQueryBuilder */
+        $qb = $this->db->getQueryBuilder();
+        $qb->select('*')
+            ->from($this->tableName)
+            ->where($qb->expr()->eq('uid', $qb->createNamedParameter($uid)))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)))
+            ->setMaxResults(1000);
+        $result = $qb->execute();
+        $data = $result->fetchAll();
+        $result->closeCursor();
 
-		$entities = array_map(function ($row) {
-			return PublicKeyToken::fromRow($row);
-		}, $data);
+        $entities = array_map(function ($row) {
+            return PublicKeyToken::fromRow($row);
+        }, $data);
 
-		return $entities;
-	}
+        return $entities;
+    }
 
-	public function deleteById(string $uid, int $id) {
-		/* @var $qb IQueryBuilder */
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete($this->tableName)
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
-			->andWhere($qb->expr()->eq('uid', $qb->createNamedParameter($uid)))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
-		$qb->execute();
-	}
+    public function deleteById(string $uid, int $id) {
+        /* @var $qb IQueryBuilder */
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete($this->tableName)
+            ->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
+            ->andWhere($qb->expr()->eq('uid', $qb->createNamedParameter($uid)))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
+        $qb->execute();
+    }
 
-	/**
-	 * delete all auth token which belong to a specific client if the client was deleted
-	 *
-	 * @param string $name
-	 */
-	public function deleteByName(string $name) {
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete($this->tableName)
-			->where($qb->expr()->eq('name', $qb->createNamedParameter($name), IQueryBuilder::PARAM_STR))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
-		$qb->execute();
-	}
+    /**
+     * delete all auth token which belong to a specific client if the client was deleted
+     *
+     * @param string $name
+     */
+    public function deleteByName(string $name) {
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete($this->tableName)
+            ->where($qb->expr()->eq('name', $qb->createNamedParameter($name), IQueryBuilder::PARAM_STR))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
+        $qb->execute();
+    }
 
-	public function deleteTempToken(PublicKeyToken $except) {
-		$qb = $this->db->getQueryBuilder();
+    public function deleteTempToken(PublicKeyToken $except) {
+        $qb = $this->db->getQueryBuilder();
 
-		$qb->delete($this->tableName)
-			->where($qb->expr()->eq('uid', $qb->createNamedParameter($except->getUID())))
-			->andWhere($qb->expr()->eq('type', $qb->createNamedParameter(IToken::TEMPORARY_TOKEN)))
-			->andWhere($qb->expr()->neq('id', $qb->createNamedParameter($except->getId())))
-			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
+        $qb->delete($this->tableName)
+            ->where($qb->expr()->eq('uid', $qb->createNamedParameter($except->getUID())))
+            ->andWhere($qb->expr()->eq('type', $qb->createNamedParameter(IToken::TEMPORARY_TOKEN)))
+            ->andWhere($qb->expr()->neq('id', $qb->createNamedParameter($except->getId())))
+            ->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
 
-		$qb->execute();
-	}
+        $qb->execute();
+    }
 
-	public function hasExpiredTokens(string $uid): bool {
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')
-			->from($this->tableName)
-			->where($qb->expr()->eq('uid', $qb->createNamedParameter($uid)))
-			->andWhere($qb->expr()->eq('password_invalid', $qb->createNamedParameter(true), IQueryBuilder::PARAM_BOOL))
-			->setMaxResults(1);
+    public function hasExpiredTokens(string $uid): bool {
+        $qb = $this->db->getQueryBuilder();
+        $qb->select('*')
+            ->from($this->tableName)
+            ->where($qb->expr()->eq('uid', $qb->createNamedParameter($uid)))
+            ->andWhere($qb->expr()->eq('password_invalid', $qb->createNamedParameter(true), IQueryBuilder::PARAM_BOOL))
+            ->setMaxResults(1);
 
-		$cursor = $qb->execute();
-		$data = $cursor->fetchAll();
-		$cursor->closeCursor();
+        $cursor = $qb->execute();
+        $data = $cursor->fetchAll();
+        $cursor->closeCursor();
 
-		return count($data) === 1;
-	}
+        return count($data) === 1;
+    }
 
-	/**
-	 * Update the last activity timestamp
-	 *
-	 * In highly concurrent setups it can happen that two parallel processes
-	 * trigger the update at (nearly) the same time. In that special case it's
-	 * not necessary to hit the database with two actual updates. Therefore the
-	 * target last activity is included in the WHERE clause with a few seconds
-	 * of tolerance.
-	 *
-	 * Example:
-	 * - process 1 (P1) reads the token at timestamp 1500
-	 * - process 1 (P2) reads the token at timestamp 1501
-	 * - activity update interval is 100
-	 *
-	 * This means
-	 *
-	 * - P1 will see a last_activity smaller than the current time and update
-	 *   the token row
-	 * - If P2 reads after P1 had written, it will see 1600 as last activity
-	 *   and the comparison on last_activity won't be truthy. This means no rows
-	 *   need to be updated a second time
-	 * - If P2 reads before P1 had written, it will see 1501 as last activity,
-	 *   but the comparison on last_activity will still not be truthy and the
-	 *   token row is not updated a second time
-	 *
-	 * @param IToken $token
-	 * @param int $now
-	 */
-	public function updateActivity(IToken $token, int $now): void {
-		$qb = $this->db->getQueryBuilder();
-		$update = $qb->update($this->getTableName())
-			->set('last_activity', $qb->createNamedParameter($now, IQueryBuilder::PARAM_INT))
-			->where(
-				$qb->expr()->eq('id', $qb->createNamedParameter($token->getId(), IQueryBuilder::PARAM_INT), IQueryBuilder::PARAM_INT),
-				$qb->expr()->lt('last_activity', $qb->createNamedParameter($now - 15, IQueryBuilder::PARAM_INT), IQueryBuilder::PARAM_INT)
-			);
-		$update->executeStatement();
-	}
+    /**
+     * Update the last activity timestamp
+     *
+     * In highly concurrent setups it can happen that two parallel processes
+     * trigger the update at (nearly) the same time. In that special case it's
+     * not necessary to hit the database with two actual updates. Therefore the
+     * target last activity is included in the WHERE clause with a few seconds
+     * of tolerance.
+     *
+     * Example:
+     * - process 1 (P1) reads the token at timestamp 1500
+     * - process 1 (P2) reads the token at timestamp 1501
+     * - activity update interval is 100
+     *
+     * This means
+     *
+     * - P1 will see a last_activity smaller than the current time and update
+     *   the token row
+     * - If P2 reads after P1 had written, it will see 1600 as last activity
+     *   and the comparison on last_activity won't be truthy. This means no rows
+     *   need to be updated a second time
+     * - If P2 reads before P1 had written, it will see 1501 as last activity,
+     *   but the comparison on last_activity will still not be truthy and the
+     *   token row is not updated a second time
+     *
+     * @param IToken $token
+     * @param int $now
+     */
+    public function updateActivity(IToken $token, int $now): void {
+        $qb = $this->db->getQueryBuilder();
+        $update = $qb->update($this->getTableName())
+            ->set('last_activity', $qb->createNamedParameter($now, IQueryBuilder::PARAM_INT))
+            ->where(
+                $qb->expr()->eq('id', $qb->createNamedParameter($token->getId(), IQueryBuilder::PARAM_INT), IQueryBuilder::PARAM_INT),
+                $qb->expr()->lt('last_activity', $qb->createNamedParameter($now - 15, IQueryBuilder::PARAM_INT), IQueryBuilder::PARAM_INT)
+            );
+        $update->executeStatement();
+    }
 
-	public function updateHashesForUser(string $userId, string $passwordHash): void {
-		$qb = $this->db->getQueryBuilder();
-		$update = $qb->update($this->getTableName())
-			->set('password_hash', $qb->createNamedParameter($passwordHash))
-			->where(
-				$qb->expr()->eq('uid', $qb->createNamedParameter($userId))
-			);
-		$update->executeStatement();
-	}
+    public function updateHashesForUser(string $userId, string $passwordHash): void {
+        $qb = $this->db->getQueryBuilder();
+        $update = $qb->update($this->getTableName())
+            ->set('password_hash', $qb->createNamedParameter($passwordHash))
+            ->where(
+                $qb->expr()->eq('uid', $qb->createNamedParameter($userId))
+            );
+        $update->executeStatement();
+    }
 
-	public function getFirstTokenForUser(string $userId): ?PublicKeyToken {
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')
-			->from($this->getTableName())
-			->where($qb->expr()->eq('uid', $qb->createNamedParameter($userId)))
-			->setMaxResults(1)
-			->orderBy('id');
-		$result = $qb->executeQuery();
+    public function getFirstTokenForUser(string $userId): ?PublicKeyToken {
+        $qb = $this->db->getQueryBuilder();
+        $qb->select('*')
+            ->from($this->getTableName())
+            ->where($qb->expr()->eq('uid', $qb->createNamedParameter($userId)))
+            ->setMaxResults(1)
+            ->orderBy('id');
+        $result = $qb->executeQuery();
 
-		$data = $result->fetch();
-		$result->closeCursor();
-		if ($data === false) {
-			return null;
-		}
-		return PublicKeyToken::fromRow($data);
-	}
+        $data = $result->fetch();
+        $result->closeCursor();
+        if ($data === false) {
+            return null;
+        }
+        return PublicKeyToken::fromRow($data);
+    }
 }

lib/private/Authentication/Token/PublicKeyTokenProvider.php

Indentation +466 added lines, -466 removed lines

@@ -46,470 +46,470 @@
 use Psr\Log\LoggerInterface;
 
 class PublicKeyTokenProvider implements IProvider {
-	use TTransactional;
-
-	/** @var PublicKeyTokenMapper */
-	private $mapper;
-
-	/** @var ICrypto */
-	private $crypto;
-
-	/** @var IConfig */
-	private $config;
-
-	private IDBConnection $db;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var ITimeFactory */
-	private $time;
-
-	/** @var CappedMemoryCache */
-	private $cache;
-
-	private IHasher $hasher;
-
-	public function __construct(PublicKeyTokenMapper $mapper,
-								ICrypto $crypto,
-								IConfig $config,
-								IDBConnection $db,
-								LoggerInterface $logger,
-								ITimeFactory $time,
-								IHasher $hasher) {
-		$this->mapper = $mapper;
-		$this->crypto = $crypto;
-		$this->config = $config;
-		$this->db = $db;
-		$this->logger = $logger;
-		$this->time = $time;
-
-		$this->cache = new CappedMemoryCache();
-		$this->hasher = $hasher;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function generateToken(string $token,
-								  string $uid,
-								  string $loginName,
-								  ?string $password,
-								  string $name,
-								  int $type = IToken::TEMPORARY_TOKEN,
-								  int $remember = IToken::DO_NOT_REMEMBER): IToken {
-		if (mb_strlen($name) > 128) {
-			$name = mb_substr($name, 0, 120) . '…';
-		}
-
-		// We need to check against one old token to see if there is a password
-		// hash that we can reuse for detecting outdated passwords
-		$randomOldToken = $this->mapper->getFirstTokenForUser($uid);
-		$oldTokenMatches = $randomOldToken && $this->hasher->verify(sha1($password) . $password, $randomOldToken->getPasswordHash());
-
-		$dbToken = $this->newToken($token, $uid, $loginName, $password, $name, $type, $remember);
-
-		if ($oldTokenMatches) {
-			$dbToken->setPasswordHash($randomOldToken->getPasswordHash());
-		}
-
-		$this->mapper->insert($dbToken);
-
-		if (!$oldTokenMatches && $password !== null) {
-			$this->updatePasswords($uid, $password);
-		}
-
-		// Add the token to the cache
-		$this->cache[$dbToken->getToken()] = $dbToken;
-
-		return $dbToken;
-	}
-
-	public function getToken(string $tokenId): IToken {
-		$tokenHash = $this->hashToken($tokenId);
-
-		if (isset($this->cache[$tokenHash])) {
-			if ($this->cache[$tokenHash] instanceof DoesNotExistException) {
-				$ex = $this->cache[$tokenHash];
-				throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
-			}
-			$token = $this->cache[$tokenHash];
-		} else {
-			try {
-				$token = $this->mapper->getToken($this->hashToken($tokenId));
-				$this->cache[$token->getToken()] = $token;
-			} catch (DoesNotExistException $ex) {
-				try {
-					$token = $this->mapper->getToken($this->hashTokenWithEmptySecret($tokenId));
-					$this->cache[$token->getToken()] = $token;
-					$this->rotate($token, $tokenId, $tokenId);
-				} catch (DoesNotExistException $ex2) {
-					$this->cache[$tokenHash] = $ex2;
-					throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
-				}
-			}
-		}
-
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
-			throw new ExpiredTokenException($token);
-		}
-
-		if ($token->getType() === IToken::WIPE_TOKEN) {
-			throw new WipeTokenException($token);
-		}
-
-		if ($token->getPasswordInvalid() === true) {
-			//The password is invalid we should throw an TokenPasswordExpiredException
-			throw new TokenPasswordExpiredException($token);
-		}
-
-		return $token;
-	}
-
-	public function getTokenById(int $tokenId): IToken {
-		try {
-			$token = $this->mapper->getTokenById($tokenId);
-		} catch (DoesNotExistException $ex) {
-			throw new InvalidTokenException("Token with ID $tokenId does not exist: " . $ex->getMessage(), 0, $ex);
-		}
-
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
-			throw new ExpiredTokenException($token);
-		}
-
-		if ($token->getType() === IToken::WIPE_TOKEN) {
-			throw new WipeTokenException($token);
-		}
-
-		if ($token->getPasswordInvalid() === true) {
-			//The password is invalid we should throw an TokenPasswordExpiredException
-			throw new TokenPasswordExpiredException($token);
-		}
-
-		return $token;
-	}
-
-	public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
-		$this->cache->clear();
-
-		return $this->atomic(function () use ($oldSessionId, $sessionId) {
-			$token = $this->getToken($oldSessionId);
-
-			if (!($token instanceof PublicKeyToken)) {
-				throw new InvalidTokenException("Invalid token type");
-			}
-
-			$password = null;
-			if (!is_null($token->getPassword())) {
-				$privateKey = $this->decrypt($token->getPrivateKey(), $oldSessionId);
-				$password = $this->decryptPassword($token->getPassword(), $privateKey);
-			}
-			$newToken = $this->generateToken(
-				$sessionId,
-				$token->getUID(),
-				$token->getLoginName(),
-				$password,
-				$token->getName(),
-				IToken::TEMPORARY_TOKEN,
-				$token->getRemember()
-			);
-
-			$this->mapper->delete($token);
-
-			return $newToken;
-		}, $this->db);
-	}
-
-	public function invalidateToken(string $token) {
-		$this->cache->clear();
-
-		$this->mapper->invalidate($this->hashToken($token));
-		$this->mapper->invalidate($this->hashTokenWithEmptySecret($token));
-	}
-
-	public function invalidateTokenById(string $uid, int $id) {
-		$this->cache->clear();
-
-		$this->mapper->deleteById($uid, $id);
-	}
-
-	public function invalidateOldTokens() {
-		$this->cache->clear();
-
-		$olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
-		$this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
-		$this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
-		$rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
-		$this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
-		$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
-	}
-
-	public function updateToken(IToken $token) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-		$this->mapper->update($token);
-	}
-
-	public function updateTokenActivity(IToken $token) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		$activityInterval = $this->config->getSystemValueInt('token_auth_activity_update', 60);
-		$activityInterval = min(max($activityInterval, 0), 300);
-
-		/** @var PublicKeyToken $token */
-		$now = $this->time->getTime();
-		if ($token->getLastActivity() < ($now - $activityInterval)) {
-			$token->setLastActivity($now);
-			$this->mapper->updateActivity($token, $now);
-		}
-	}
-
-	public function getTokenByUser(string $uid): array {
-		return $this->mapper->getTokenByUser($uid);
-	}
-
-	public function getPassword(IToken $savedToken, string $tokenId): string {
-		if (!($savedToken instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		if ($savedToken->getPassword() === null) {
-			throw new PasswordlessTokenException();
-		}
-
-		// Decrypt private key with tokenId
-		$privateKey = $this->decrypt($savedToken->getPrivateKey(), $tokenId);
-
-		// Decrypt password with private key
-		return $this->decryptPassword($savedToken->getPassword(), $privateKey);
-	}
-
-	public function setPassword(IToken $token, string $tokenId, string $password) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		// When changing passwords all temp tokens are deleted
-		$this->mapper->deleteTempToken($token);
-
-		// Update the password for all tokens
-		$tokens = $this->mapper->getTokenByUser($token->getUID());
-		$hashedPassword = $this->hashPassword($password);
-		foreach ($tokens as $t) {
-			$publicKey = $t->getPublicKey();
-			$t->setPassword($this->encryptPassword($password, $publicKey));
-			$t->setPasswordHash($hashedPassword);
-			$this->updateToken($t);
-		}
-	}
-
-	private function hashPassword(string $password): string {
-		return $this->hasher->hash(sha1($password) . $password);
-	}
-
-	public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		// Decrypt private key with oldTokenId
-		$privateKey = $this->decrypt($token->getPrivateKey(), $oldTokenId);
-		// Encrypt with the new token
-		$token->setPrivateKey($this->encrypt($privateKey, $newTokenId));
-
-		$token->setToken($this->hashToken($newTokenId));
-		$this->updateToken($token);
-
-		return $token;
-	}
-
-	private function encrypt(string $plaintext, string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		return $this->crypto->encrypt($plaintext, $token . $secret);
-	}
-
-	/**
-	 * @throws InvalidTokenException
-	 */
-	private function decrypt(string $cipherText, string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		try {
-			return $this->crypto->decrypt($cipherText, $token . $secret);
-		} catch (\Exception $ex) {
-			// Retry with empty secret as a fallback for instances where the secret might not have been set by accident
-			try {
-				return $this->crypto->decrypt($cipherText, $token);
-			} catch (\Exception $ex2) {
-				// Delete the invalid token
-				$this->invalidateToken($token);
-				throw new InvalidTokenException("Could not decrypt token password: " . $ex->getMessage(), 0, $ex2);
-			}
-		}
-	}
-
-	private function encryptPassword(string $password, string $publicKey): string {
-		openssl_public_encrypt($password, $encryptedPassword, $publicKey, OPENSSL_PKCS1_OAEP_PADDING);
-		$encryptedPassword = base64_encode($encryptedPassword);
-
-		return $encryptedPassword;
-	}
-
-	private function decryptPassword(string $encryptedPassword, string $privateKey): string {
-		$encryptedPassword = base64_decode($encryptedPassword);
-		openssl_private_decrypt($encryptedPassword, $password, $privateKey, OPENSSL_PKCS1_OAEP_PADDING);
-
-		return $password;
-	}
-
-	private function hashToken(string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		return hash('sha512', $token . $secret);
-	}
-
-	/**
-	 * @deprecated Fallback for instances where the secret might not have been set by accident
-	 */
-	private function hashTokenWithEmptySecret(string $token): string {
-		return hash('sha512', $token);
-	}
-
-	/**
-	 * @throws \RuntimeException when OpenSSL reports a problem
-	 */
-	private function newToken(string $token,
-							  string $uid,
-							  string $loginName,
-							  $password,
-							  string $name,
-							  int $type,
-							  int $remember): PublicKeyToken {
-		$dbToken = new PublicKeyToken();
-		$dbToken->setUid($uid);
-		$dbToken->setLoginName($loginName);
-
-		$config = array_merge([
-			'digest_alg' => 'sha512',
-			'private_key_bits' => $password !== null && strlen($password) > 250 ? 4096 : 2048,
-		], $this->config->getSystemValue('openssl', []));
-
-		// Generate new key
-		$res = openssl_pkey_new($config);
-		if ($res === false) {
-			$this->logOpensslError();
-			throw new \RuntimeException('OpenSSL reported a problem');
-		}
-
-		if (openssl_pkey_export($res, $privateKey, null, $config) === false) {
-			$this->logOpensslError();
-			throw new \RuntimeException('OpenSSL reported a problem');
-		}
-
-		// Extract the public key from $res to $pubKey
-		$publicKey = openssl_pkey_get_details($res);
-		$publicKey = $publicKey['key'];
-
-		$dbToken->setPublicKey($publicKey);
-		$dbToken->setPrivateKey($this->encrypt($privateKey, $token));
-
-		if (!is_null($password) && $this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
-			if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
-				throw new \RuntimeException('Trying to save a password with more than 469 characters is not supported. If you want to use big passwords, disable the auth.storeCryptedPassword option in config.php');
-			}
-			$dbToken->setPassword($this->encryptPassword($password, $publicKey));
-			$dbToken->setPasswordHash($this->hashPassword($password));
-		}
-
-		$dbToken->setName($name);
-		$dbToken->setToken($this->hashToken($token));
-		$dbToken->setType($type);
-		$dbToken->setRemember($remember);
-		$dbToken->setLastActivity($this->time->getTime());
-		$dbToken->setLastCheck($this->time->getTime());
-		$dbToken->setVersion(PublicKeyToken::VERSION);
-
-		return $dbToken;
-	}
-
-	public function markPasswordInvalid(IToken $token, string $tokenId) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		$token->setPasswordInvalid(true);
-		$this->mapper->update($token);
-	}
-
-	public function updatePasswords(string $uid, string $password) {
-		$this->cache->clear();
-
-		// prevent setting an empty pw as result of pw-less-login
-		if ($password === '' || !$this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
-			return;
-		}
-
-		// Update the password for all tokens
-		$tokens = $this->mapper->getTokenByUser($uid);
-		$newPasswordHash = null;
-
-		/**
-		 * - true: The password hash could not be verified anymore
-		 *     and the token needs to be updated with the newly encrypted password
-		 * - false: The hash could still be verified
-		 * - missing: The hash needs to be verified
-		 */
-		$hashNeedsUpdate = [];
-
-		foreach ($tokens as $t) {
-			if (!isset($hashNeedsUpdate[$t->getPasswordHash()])) {
-				if ($t->getPasswordHash() === null) {
-					$hashNeedsUpdate[$t->getPasswordHash() ?: ''] = true;
-				} elseif (!$this->hasher->verify(sha1($password) . $password, $t->getPasswordHash())) {
-					$hashNeedsUpdate[$t->getPasswordHash() ?: ''] = true;
-				} else {
-					$hashNeedsUpdate[$t->getPasswordHash() ?: ''] = false;
-				}
-			}
-			$needsUpdating = $hashNeedsUpdate[$t->getPasswordHash() ?: ''] ?? true;
-
-			if ($needsUpdating) {
-				if ($newPasswordHash === null) {
-					$newPasswordHash = $this->hashPassword($password);
-				}
-
-				$publicKey = $t->getPublicKey();
-				$t->setPassword($this->encryptPassword($password, $publicKey));
-				$t->setPasswordHash($newPasswordHash);
-				$t->setPasswordInvalid(false);
-				$this->updateToken($t);
-			}
-		}
-
-		// If password hashes are different we update them all to be equal so
-		// that the next execution only needs to verify once
-		if (count($hashNeedsUpdate) > 1) {
-			$newPasswordHash = $this->hashPassword($password);
-			$this->mapper->updateHashesForUser($uid, $newPasswordHash);
-		}
-	}
-
-	private function logOpensslError() {
-		$errors = [];
-		while ($error = openssl_error_string()) {
-			$errors[] = $error;
-		}
-		$this->logger->critical('Something is wrong with your openssl setup: ' . implode(', ', $errors));
-	}
+    use TTransactional;
+
+    /** @var PublicKeyTokenMapper */
+    private $mapper;
+
+    /** @var ICrypto */
+    private $crypto;
+
+    /** @var IConfig */
+    private $config;
+
+    private IDBConnection $db;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    /** @var ITimeFactory */
+    private $time;
+
+    /** @var CappedMemoryCache */
+    private $cache;
+
+    private IHasher $hasher;
+
+    public function __construct(PublicKeyTokenMapper $mapper,
+                                ICrypto $crypto,
+                                IConfig $config,
+                                IDBConnection $db,
+                                LoggerInterface $logger,
+                                ITimeFactory $time,
+                                IHasher $hasher) {
+        $this->mapper = $mapper;
+        $this->crypto = $crypto;
+        $this->config = $config;
+        $this->db = $db;
+        $this->logger = $logger;
+        $this->time = $time;
+
+        $this->cache = new CappedMemoryCache();
+        $this->hasher = $hasher;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function generateToken(string $token,
+                                    string $uid,
+                                    string $loginName,
+                                  ?string $password,
+                                    string $name,
+                                    int $type = IToken::TEMPORARY_TOKEN,
+                                    int $remember = IToken::DO_NOT_REMEMBER): IToken {
+        if (mb_strlen($name) > 128) {
+            $name = mb_substr($name, 0, 120) . '…';
+        }
+
+        // We need to check against one old token to see if there is a password
+        // hash that we can reuse for detecting outdated passwords
+        $randomOldToken = $this->mapper->getFirstTokenForUser($uid);
+        $oldTokenMatches = $randomOldToken && $this->hasher->verify(sha1($password) . $password, $randomOldToken->getPasswordHash());
+
+        $dbToken = $this->newToken($token, $uid, $loginName, $password, $name, $type, $remember);
+
+        if ($oldTokenMatches) {
+            $dbToken->setPasswordHash($randomOldToken->getPasswordHash());
+        }
+
+        $this->mapper->insert($dbToken);
+
+        if (!$oldTokenMatches && $password !== null) {
+            $this->updatePasswords($uid, $password);
+        }
+
+        // Add the token to the cache
+        $this->cache[$dbToken->getToken()] = $dbToken;
+
+        return $dbToken;
+    }
+
+    public function getToken(string $tokenId): IToken {
+        $tokenHash = $this->hashToken($tokenId);
+
+        if (isset($this->cache[$tokenHash])) {
+            if ($this->cache[$tokenHash] instanceof DoesNotExistException) {
+                $ex = $this->cache[$tokenHash];
+                throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
+            }
+            $token = $this->cache[$tokenHash];
+        } else {
+            try {
+                $token = $this->mapper->getToken($this->hashToken($tokenId));
+                $this->cache[$token->getToken()] = $token;
+            } catch (DoesNotExistException $ex) {
+                try {
+                    $token = $this->mapper->getToken($this->hashTokenWithEmptySecret($tokenId));
+                    $this->cache[$token->getToken()] = $token;
+                    $this->rotate($token, $tokenId, $tokenId);
+                } catch (DoesNotExistException $ex2) {
+                    $this->cache[$tokenHash] = $ex2;
+                    throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
+                }
+            }
+        }
+
+        if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+            throw new ExpiredTokenException($token);
+        }
+
+        if ($token->getType() === IToken::WIPE_TOKEN) {
+            throw new WipeTokenException($token);
+        }
+
+        if ($token->getPasswordInvalid() === true) {
+            //The password is invalid we should throw an TokenPasswordExpiredException
+            throw new TokenPasswordExpiredException($token);
+        }
+
+        return $token;
+    }
+
+    public function getTokenById(int $tokenId): IToken {
+        try {
+            $token = $this->mapper->getTokenById($tokenId);
+        } catch (DoesNotExistException $ex) {
+            throw new InvalidTokenException("Token with ID $tokenId does not exist: " . $ex->getMessage(), 0, $ex);
+        }
+
+        if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+            throw new ExpiredTokenException($token);
+        }
+
+        if ($token->getType() === IToken::WIPE_TOKEN) {
+            throw new WipeTokenException($token);
+        }
+
+        if ($token->getPasswordInvalid() === true) {
+            //The password is invalid we should throw an TokenPasswordExpiredException
+            throw new TokenPasswordExpiredException($token);
+        }
+
+        return $token;
+    }
+
+    public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
+        $this->cache->clear();
+
+        return $this->atomic(function () use ($oldSessionId, $sessionId) {
+            $token = $this->getToken($oldSessionId);
+
+            if (!($token instanceof PublicKeyToken)) {
+                throw new InvalidTokenException("Invalid token type");
+            }
+
+            $password = null;
+            if (!is_null($token->getPassword())) {
+                $privateKey = $this->decrypt($token->getPrivateKey(), $oldSessionId);
+                $password = $this->decryptPassword($token->getPassword(), $privateKey);
+            }
+            $newToken = $this->generateToken(
+                $sessionId,
+                $token->getUID(),
+                $token->getLoginName(),
+                $password,
+                $token->getName(),
+                IToken::TEMPORARY_TOKEN,
+                $token->getRemember()
+            );
+
+            $this->mapper->delete($token);
+
+            return $newToken;
+        }, $this->db);
+    }
+
+    public function invalidateToken(string $token) {
+        $this->cache->clear();
+
+        $this->mapper->invalidate($this->hashToken($token));
+        $this->mapper->invalidate($this->hashTokenWithEmptySecret($token));
+    }
+
+    public function invalidateTokenById(string $uid, int $id) {
+        $this->cache->clear();
+
+        $this->mapper->deleteById($uid, $id);
+    }
+
+    public function invalidateOldTokens() {
+        $this->cache->clear();
+
+        $olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
+        $this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
+        $this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
+        $rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+        $this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
+        $this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
+    }
+
+    public function updateToken(IToken $token) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+        $this->mapper->update($token);
+    }
+
+    public function updateTokenActivity(IToken $token) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        $activityInterval = $this->config->getSystemValueInt('token_auth_activity_update', 60);
+        $activityInterval = min(max($activityInterval, 0), 300);
+
+        /** @var PublicKeyToken $token */
+        $now = $this->time->getTime();
+        if ($token->getLastActivity() < ($now - $activityInterval)) {
+            $token->setLastActivity($now);
+            $this->mapper->updateActivity($token, $now);
+        }
+    }
+
+    public function getTokenByUser(string $uid): array {
+        return $this->mapper->getTokenByUser($uid);
+    }
+
+    public function getPassword(IToken $savedToken, string $tokenId): string {
+        if (!($savedToken instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        if ($savedToken->getPassword() === null) {
+            throw new PasswordlessTokenException();
+        }
+
+        // Decrypt private key with tokenId
+        $privateKey = $this->decrypt($savedToken->getPrivateKey(), $tokenId);
+
+        // Decrypt password with private key
+        return $this->decryptPassword($savedToken->getPassword(), $privateKey);
+    }
+
+    public function setPassword(IToken $token, string $tokenId, string $password) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        // When changing passwords all temp tokens are deleted
+        $this->mapper->deleteTempToken($token);
+
+        // Update the password for all tokens
+        $tokens = $this->mapper->getTokenByUser($token->getUID());
+        $hashedPassword = $this->hashPassword($password);
+        foreach ($tokens as $t) {
+            $publicKey = $t->getPublicKey();
+            $t->setPassword($this->encryptPassword($password, $publicKey));
+            $t->setPasswordHash($hashedPassword);
+            $this->updateToken($t);
+        }
+    }
+
+    private function hashPassword(string $password): string {
+        return $this->hasher->hash(sha1($password) . $password);
+    }
+
+    public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        // Decrypt private key with oldTokenId
+        $privateKey = $this->decrypt($token->getPrivateKey(), $oldTokenId);
+        // Encrypt with the new token
+        $token->setPrivateKey($this->encrypt($privateKey, $newTokenId));
+
+        $token->setToken($this->hashToken($newTokenId));
+        $this->updateToken($token);
+
+        return $token;
+    }
+
+    private function encrypt(string $plaintext, string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        return $this->crypto->encrypt($plaintext, $token . $secret);
+    }
+
+    /**
+     * @throws InvalidTokenException
+     */
+    private function decrypt(string $cipherText, string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        try {
+            return $this->crypto->decrypt($cipherText, $token . $secret);
+        } catch (\Exception $ex) {
+            // Retry with empty secret as a fallback for instances where the secret might not have been set by accident
+            try {
+                return $this->crypto->decrypt($cipherText, $token);
+            } catch (\Exception $ex2) {
+                // Delete the invalid token
+                $this->invalidateToken($token);
+                throw new InvalidTokenException("Could not decrypt token password: " . $ex->getMessage(), 0, $ex2);
+            }
+        }
+    }
+
+    private function encryptPassword(string $password, string $publicKey): string {
+        openssl_public_encrypt($password, $encryptedPassword, $publicKey, OPENSSL_PKCS1_OAEP_PADDING);
+        $encryptedPassword = base64_encode($encryptedPassword);
+
+        return $encryptedPassword;
+    }
+
+    private function decryptPassword(string $encryptedPassword, string $privateKey): string {
+        $encryptedPassword = base64_decode($encryptedPassword);
+        openssl_private_decrypt($encryptedPassword, $password, $privateKey, OPENSSL_PKCS1_OAEP_PADDING);
+
+        return $password;
+    }
+
+    private function hashToken(string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        return hash('sha512', $token . $secret);
+    }
+
+    /**
+     * @deprecated Fallback for instances where the secret might not have been set by accident
+     */
+    private function hashTokenWithEmptySecret(string $token): string {
+        return hash('sha512', $token);
+    }
+
+    /**
+     * @throws \RuntimeException when OpenSSL reports a problem
+     */
+    private function newToken(string $token,
+                                string $uid,
+                                string $loginName,
+                                $password,
+                                string $name,
+                                int $type,
+                                int $remember): PublicKeyToken {
+        $dbToken = new PublicKeyToken();
+        $dbToken->setUid($uid);
+        $dbToken->setLoginName($loginName);
+
+        $config = array_merge([
+            'digest_alg' => 'sha512',
+            'private_key_bits' => $password !== null && strlen($password) > 250 ? 4096 : 2048,
+        ], $this->config->getSystemValue('openssl', []));
+
+        // Generate new key
+        $res = openssl_pkey_new($config);
+        if ($res === false) {
+            $this->logOpensslError();
+            throw new \RuntimeException('OpenSSL reported a problem');
+        }
+
+        if (openssl_pkey_export($res, $privateKey, null, $config) === false) {
+            $this->logOpensslError();
+            throw new \RuntimeException('OpenSSL reported a problem');
+        }
+
+        // Extract the public key from $res to $pubKey
+        $publicKey = openssl_pkey_get_details($res);
+        $publicKey = $publicKey['key'];
+
+        $dbToken->setPublicKey($publicKey);
+        $dbToken->setPrivateKey($this->encrypt($privateKey, $token));
+
+        if (!is_null($password) && $this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
+            if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
+                throw new \RuntimeException('Trying to save a password with more than 469 characters is not supported. If you want to use big passwords, disable the auth.storeCryptedPassword option in config.php');
+            }
+            $dbToken->setPassword($this->encryptPassword($password, $publicKey));
+            $dbToken->setPasswordHash($this->hashPassword($password));
+        }
+
+        $dbToken->setName($name);
+        $dbToken->setToken($this->hashToken($token));
+        $dbToken->setType($type);
+        $dbToken->setRemember($remember);
+        $dbToken->setLastActivity($this->time->getTime());
+        $dbToken->setLastCheck($this->time->getTime());
+        $dbToken->setVersion(PublicKeyToken::VERSION);
+
+        return $dbToken;
+    }
+
+    public function markPasswordInvalid(IToken $token, string $tokenId) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        $token->setPasswordInvalid(true);
+        $this->mapper->update($token);
+    }
+
+    public function updatePasswords(string $uid, string $password) {
+        $this->cache->clear();
+
+        // prevent setting an empty pw as result of pw-less-login
+        if ($password === '' || !$this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
+            return;
+        }
+
+        // Update the password for all tokens
+        $tokens = $this->mapper->getTokenByUser($uid);
+        $newPasswordHash = null;
+
+        /**
+         * - true: The password hash could not be verified anymore
+         *     and the token needs to be updated with the newly encrypted password
+         * - false: The hash could still be verified
+         * - missing: The hash needs to be verified
+         */
+        $hashNeedsUpdate = [];
+
+        foreach ($tokens as $t) {
+            if (!isset($hashNeedsUpdate[$t->getPasswordHash()])) {
+                if ($t->getPasswordHash() === null) {
+                    $hashNeedsUpdate[$t->getPasswordHash() ?: ''] = true;
+                } elseif (!$this->hasher->verify(sha1($password) . $password, $t->getPasswordHash())) {
+                    $hashNeedsUpdate[$t->getPasswordHash() ?: ''] = true;
+                } else {
+                    $hashNeedsUpdate[$t->getPasswordHash() ?: ''] = false;
+                }
+            }
+            $needsUpdating = $hashNeedsUpdate[$t->getPasswordHash() ?: ''] ?? true;
+
+            if ($needsUpdating) {
+                if ($newPasswordHash === null) {
+                    $newPasswordHash = $this->hashPassword($password);
+                }
+
+                $publicKey = $t->getPublicKey();
+                $t->setPassword($this->encryptPassword($password, $publicKey));
+                $t->setPasswordHash($newPasswordHash);
+                $t->setPasswordInvalid(false);
+                $this->updateToken($t);
+            }
+        }
+
+        // If password hashes are different we update them all to be equal so
+        // that the next execution only needs to verify once
+        if (count($hashNeedsUpdate) > 1) {
+            $newPasswordHash = $this->hashPassword($password);
+            $this->mapper->updateHashesForUser($uid, $newPasswordHash);
+        }
+    }
+
+    private function logOpensslError() {
+        $errors = [];
+        while ($error = openssl_error_string()) {
+            $errors[] = $error;
+        }
+        $this->logger->critical('Something is wrong with your openssl setup: ' . implode(', ', $errors));
+    }
 }

Spacing +17 added lines, -17 removed lines

@@ -99,13 +99,13 @@ 
 								  int $type = IToken::TEMPORARY_TOKEN,
 								  int $remember = IToken::DO_NOT_REMEMBER): IToken {
 		if (mb_strlen($name) > 128) {
-			$name = mb_substr($name, 0, 120) . '…';
+			$name = mb_substr($name, 0, 120).'…';
 		}
 
 		// We need to check against one old token to see if there is a password
 		// hash that we can reuse for detecting outdated passwords
 		$randomOldToken = $this->mapper->getFirstTokenForUser($uid);
-		$oldTokenMatches = $randomOldToken && $this->hasher->verify(sha1($password) . $password, $randomOldToken->getPasswordHash());
+		$oldTokenMatches = $randomOldToken && $this->hasher->verify(sha1($password).$password, $randomOldToken->getPasswordHash());
 
 		$dbToken = $this->newToken($token, $uid, $loginName, $password, $name, $type, $remember);
 
@@ -131,7 +131,7 @@ 
 		if (isset($this->cache[$tokenHash])) {
 			if ($this->cache[$tokenHash] instanceof DoesNotExistException) {
 				$ex = $this->cache[$tokenHash];
-				throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
+				throw new InvalidTokenException("Token does not exist: ".$ex->getMessage(), 0, $ex);
 			}
 			$token = $this->cache[$tokenHash];
 		} else {
@@ -145,12 +145,12 @@ 
 					$this->rotate($token, $tokenId, $tokenId);
 				} catch (DoesNotExistException $ex2) {
 					$this->cache[$tokenHash] = $ex2;
-					throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
+					throw new InvalidTokenException("Token does not exist: ".$ex->getMessage(), 0, $ex);
 				}
 			}
 		}
 
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+		if ((int) $token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
 			throw new ExpiredTokenException($token);
 		}
 
@@ -170,10 +170,10 @@ 
 		try {
 			$token = $this->mapper->getTokenById($tokenId);
 		} catch (DoesNotExistException $ex) {
-			throw new InvalidTokenException("Token with ID $tokenId does not exist: " . $ex->getMessage(), 0, $ex);
+			throw new InvalidTokenException("Token with ID $tokenId does not exist: ".$ex->getMessage(), 0, $ex);
 		}
 
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+		if ((int) $token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
 			throw new ExpiredTokenException($token);
 		}
 
@@ -192,7 +192,7 @@ 
 	public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
 		$this->cache->clear();
 
-		return $this->atomic(function () use ($oldSessionId, $sessionId) {
+		return $this->atomic(function() use ($oldSessionId, $sessionId) {
 			$token = $this->getToken($oldSessionId);
 
 			if (!($token instanceof PublicKeyToken)) {
@@ -237,10 +237,10 @@ 
 		$this->cache->clear();
 
 		$olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
-		$this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
+		$this->logger->debug('Invalidating session tokens older than '.date('c', $olderThan), ['app' => 'cron']);
 		$this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
 		$rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
-		$this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
+		$this->logger->debug('Invalidating remembered session tokens older than '.date('c', $rememberThreshold), ['app' => 'cron']);
 		$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
 	}
 
@@ -313,7 +313,7 @@ 
 	}
 
 	private function hashPassword(string $password): string {
-		return $this->hasher->hash(sha1($password) . $password);
+		return $this->hasher->hash(sha1($password).$password);
 	}
 
 	public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
@@ -336,7 +336,7 @@ 
 
 	private function encrypt(string $plaintext, string $token): string {
 		$secret = $this->config->getSystemValue('secret');
-		return $this->crypto->encrypt($plaintext, $token . $secret);
+		return $this->crypto->encrypt($plaintext, $token.$secret);
 	}
 
 	/**
@@ -345,7 +345,7 @@ 
 	private function decrypt(string $cipherText, string $token): string {
 		$secret = $this->config->getSystemValue('secret');
 		try {
-			return $this->crypto->decrypt($cipherText, $token . $secret);
+			return $this->crypto->decrypt($cipherText, $token.$secret);
 		} catch (\Exception $ex) {
 			// Retry with empty secret as a fallback for instances where the secret might not have been set by accident
 			try {
@@ -353,7 +353,7 @@ 
 			} catch (\Exception $ex2) {
 				// Delete the invalid token
 				$this->invalidateToken($token);
-				throw new InvalidTokenException("Could not decrypt token password: " . $ex->getMessage(), 0, $ex2);
+				throw new InvalidTokenException("Could not decrypt token password: ".$ex->getMessage(), 0, $ex2);
 			}
 		}
 	}
@@ -374,7 +374,7 @@ 
 
 	private function hashToken(string $token): string {
 		$secret = $this->config->getSystemValue('secret');
-		return hash('sha512', $token . $secret);
+		return hash('sha512', $token.$secret);
 	}
 
 	/**
@@ -476,7 +476,7 @@ 
 			if (!isset($hashNeedsUpdate[$t->getPasswordHash()])) {
 				if ($t->getPasswordHash() === null) {
 					$hashNeedsUpdate[$t->getPasswordHash() ?: ''] = true;
-				} elseif (!$this->hasher->verify(sha1($password) . $password, $t->getPasswordHash())) {
+				} elseif (!$this->hasher->verify(sha1($password).$password, $t->getPasswordHash())) {
 					$hashNeedsUpdate[$t->getPasswordHash() ?: ''] = true;
 				} else {
 					$hashNeedsUpdate[$t->getPasswordHash() ?: ''] = false;
@@ -510,6 +510,6 @@ 
 		while ($error = openssl_error_string()) {
 			$errors[] = $error;
 		}
-		$this->logger->critical('Something is wrong with your openssl setup: ' . implode(', ', $errors));
+		$this->logger->critical('Something is wrong with your openssl setup: '.implode(', ', $errors));
 	}
 }