nextcloud / server

lib/private/Security/Bruteforce/Throttler.php

Indentation +200 added lines, -200 removed lines

@@ -31,204 +31,204 @@
  * @package OC\Security\Bruteforce
  */
 class Throttler implements IThrottler {
-	/** @var bool[] */
-	private array $hasAttemptsDeleted = [];
-
-	public function __construct(
-		private ITimeFactory $timeFactory,
-		private LoggerInterface $logger,
-		private IConfig $config,
-		private IBackend $backend,
-		private BruteforceAllowList $allowList,
-	) {
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function registerAttempt(string $action,
-		string $ip,
-		array $metadata = []): void {
-		// No need to log if the bruteforce protection is disabled
-		if (!$this->config->getSystemValueBool('auth.bruteforce.protection.enabled', true)) {
-			return;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		if ($this->isBypassListed((string)$ipAddress)) {
-			return;
-		}
-
-		$this->logger->notice(
-			sprintf(
-				'Bruteforce attempt from "%s" detected for action "%s".',
-				$ip,
-				$action
-			),
-			[
-				'app' => 'core',
-			]
-		);
-
-		$this->backend->registerAttempt(
-			(string)$ipAddress,
-			$ipAddress->getSubnet(),
-			$this->timeFactory->getTime(),
-			$action,
-			$metadata
-		);
-	}
-
-	/**
-	 * Check if the IP is whitelisted
-	 */
-	public function isBypassListed(string $ip): bool {
-		return $this->allowList->isBypassListed($ip);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function showBruteforceWarning(string $ip, string $action = ''): bool {
-		$attempts = $this->getAttempts($ip, $action);
-		// 4 failed attempts is the last delay below 5 seconds
-		return $attempts >= 4;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function getAttempts(string $ip, string $action = '', float $maxAgeHours = 12): int {
-		if ($maxAgeHours > 48) {
-			$this->logger->error('Bruteforce has to use less than 48 hours');
-			$maxAgeHours = 48;
-		}
-
-		if ($ip === '' || isset($this->hasAttemptsDeleted[$action])) {
-			return 0;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		if ($this->isBypassListed((string)$ipAddress)) {
-			return 0;
-		}
-
-		$maxAgeTimestamp = (int)($this->timeFactory->getTime() - 3600 * $maxAgeHours);
-
-		return $this->backend->getAttempts(
-			$ipAddress->getSubnet(),
-			$maxAgeTimestamp,
-			$action !== '' ? $action : null,
-		);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function getDelay(string $ip, string $action = ''): int {
-		$attempts = $this->getAttempts($ip, $action);
-		return $this->calculateDelay($attempts);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function calculateDelay(int $attempts): int {
-		if ($attempts === 0) {
-			return 0;
-		}
-
-		$firstDelay = 0.1;
-		if ($attempts > $this->config->getSystemValueInt('auth.bruteforce.max-attempts', self::MAX_ATTEMPTS)) {
-			// Don't ever overflow. Just assume the maxDelay time:s
-			return self::MAX_DELAY_MS;
-		}
-
-		$delay = $firstDelay * 2 ** $attempts;
-		if ($delay > self::MAX_DELAY) {
-			return self::MAX_DELAY_MS;
-		}
-		return (int)\ceil($delay * 1000);
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function resetDelay(string $ip, string $action, array $metadata): void {
-		// No need to log if the bruteforce protection is disabled
-		if (!$this->config->getSystemValueBool('auth.bruteforce.protection.enabled', true)) {
-			return;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		if ($this->isBypassListed((string)$ipAddress)) {
-			return;
-		}
-
-		$this->backend->resetAttempts(
-			$ipAddress->getSubnet(),
-			$action,
-			$metadata,
-		);
-
-		$this->hasAttemptsDeleted[$action] = true;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function resetDelayForIP(string $ip): void {
-		// No need to log if the bruteforce protection is disabled
-		if (!$this->config->getSystemValueBool('auth.bruteforce.protection.enabled', true)) {
-			return;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		if ($this->isBypassListed((string)$ipAddress)) {
-			return;
-		}
-
-		$this->backend->resetAttempts($ipAddress->getSubnet());
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function sleepDelay(string $ip, string $action = ''): int {
-		$delay = $this->getDelay($ip, $action);
-		if (!$this->config->getSystemValueBool('auth.bruteforce.protection.testing')) {
-			usleep($delay * 1000);
-		}
-		return $delay;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function sleepDelayOrThrowOnMax(string $ip, string $action = ''): int {
-		$attempts = $this->getAttempts($ip, $action, 0.5);
-		if ($attempts > $this->config->getSystemValueInt('auth.bruteforce.max-attempts', self::MAX_ATTEMPTS)) {
-			$this->logger->info('IP address blocked because it reached the maximum failed attempts in the last 30 minutes [action: {action}, attempts: {attempts}, ip: {ip}]', [
-				'action' => $action,
-				'ip' => $ip,
-				'attempts' => $attempts,
-			]);
-			// If the ip made too many attempts within the last 30 mins we don't execute anymore
-			throw new MaxDelayReached('Reached maximum delay');
-		}
-
-		$attempts = $this->getAttempts($ip, $action);
-		if ($attempts > 10) {
-			$this->logger->info('IP address throttled because it reached the attempts limit in the last 12 hours [action: {action}, attempts: {attempts}, ip: {ip}]', [
-				'action' => $action,
-				'ip' => $ip,
-				'attempts' => $attempts,
-			]);
-		}
-		if ($attempts > 0) {
-			return $this->calculateDelay($attempts);
-		}
-
-		return 0;
-	}
+    /** @var bool[] */
+    private array $hasAttemptsDeleted = [];
+
+    public function __construct(
+        private ITimeFactory $timeFactory,
+        private LoggerInterface $logger,
+        private IConfig $config,
+        private IBackend $backend,
+        private BruteforceAllowList $allowList,
+    ) {
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function registerAttempt(string $action,
+        string $ip,
+        array $metadata = []): void {
+        // No need to log if the bruteforce protection is disabled
+        if (!$this->config->getSystemValueBool('auth.bruteforce.protection.enabled', true)) {
+            return;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        if ($this->isBypassListed((string)$ipAddress)) {
+            return;
+        }
+
+        $this->logger->notice(
+            sprintf(
+                'Bruteforce attempt from "%s" detected for action "%s".',
+                $ip,
+                $action
+            ),
+            [
+                'app' => 'core',
+            ]
+        );
+
+        $this->backend->registerAttempt(
+            (string)$ipAddress,
+            $ipAddress->getSubnet(),
+            $this->timeFactory->getTime(),
+            $action,
+            $metadata
+        );
+    }
+
+    /**
+     * Check if the IP is whitelisted
+     */
+    public function isBypassListed(string $ip): bool {
+        return $this->allowList->isBypassListed($ip);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function showBruteforceWarning(string $ip, string $action = ''): bool {
+        $attempts = $this->getAttempts($ip, $action);
+        // 4 failed attempts is the last delay below 5 seconds
+        return $attempts >= 4;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function getAttempts(string $ip, string $action = '', float $maxAgeHours = 12): int {
+        if ($maxAgeHours > 48) {
+            $this->logger->error('Bruteforce has to use less than 48 hours');
+            $maxAgeHours = 48;
+        }
+
+        if ($ip === '' || isset($this->hasAttemptsDeleted[$action])) {
+            return 0;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        if ($this->isBypassListed((string)$ipAddress)) {
+            return 0;
+        }
+
+        $maxAgeTimestamp = (int)($this->timeFactory->getTime() - 3600 * $maxAgeHours);
+
+        return $this->backend->getAttempts(
+            $ipAddress->getSubnet(),
+            $maxAgeTimestamp,
+            $action !== '' ? $action : null,
+        );
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function getDelay(string $ip, string $action = ''): int {
+        $attempts = $this->getAttempts($ip, $action);
+        return $this->calculateDelay($attempts);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function calculateDelay(int $attempts): int {
+        if ($attempts === 0) {
+            return 0;
+        }
+
+        $firstDelay = 0.1;
+        if ($attempts > $this->config->getSystemValueInt('auth.bruteforce.max-attempts', self::MAX_ATTEMPTS)) {
+            // Don't ever overflow. Just assume the maxDelay time:s
+            return self::MAX_DELAY_MS;
+        }
+
+        $delay = $firstDelay * 2 ** $attempts;
+        if ($delay > self::MAX_DELAY) {
+            return self::MAX_DELAY_MS;
+        }
+        return (int)\ceil($delay * 1000);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function resetDelay(string $ip, string $action, array $metadata): void {
+        // No need to log if the bruteforce protection is disabled
+        if (!$this->config->getSystemValueBool('auth.bruteforce.protection.enabled', true)) {
+            return;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        if ($this->isBypassListed((string)$ipAddress)) {
+            return;
+        }
+
+        $this->backend->resetAttempts(
+            $ipAddress->getSubnet(),
+            $action,
+            $metadata,
+        );
+
+        $this->hasAttemptsDeleted[$action] = true;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function resetDelayForIP(string $ip): void {
+        // No need to log if the bruteforce protection is disabled
+        if (!$this->config->getSystemValueBool('auth.bruteforce.protection.enabled', true)) {
+            return;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        if ($this->isBypassListed((string)$ipAddress)) {
+            return;
+        }
+
+        $this->backend->resetAttempts($ipAddress->getSubnet());
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function sleepDelay(string $ip, string $action = ''): int {
+        $delay = $this->getDelay($ip, $action);
+        if (!$this->config->getSystemValueBool('auth.bruteforce.protection.testing')) {
+            usleep($delay * 1000);
+        }
+        return $delay;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function sleepDelayOrThrowOnMax(string $ip, string $action = ''): int {
+        $attempts = $this->getAttempts($ip, $action, 0.5);
+        if ($attempts > $this->config->getSystemValueInt('auth.bruteforce.max-attempts', self::MAX_ATTEMPTS)) {
+            $this->logger->info('IP address blocked because it reached the maximum failed attempts in the last 30 minutes [action: {action}, attempts: {attempts}, ip: {ip}]', [
+                'action' => $action,
+                'ip' => $ip,
+                'attempts' => $attempts,
+            ]);
+            // If the ip made too many attempts within the last 30 mins we don't execute anymore
+            throw new MaxDelayReached('Reached maximum delay');
+        }
+
+        $attempts = $this->getAttempts($ip, $action);
+        if ($attempts > 10) {
+            $this->logger->info('IP address throttled because it reached the attempts limit in the last 12 hours [action: {action}, attempts: {attempts}, ip: {ip}]', [
+                'action' => $action,
+                'ip' => $ip,
+                'attempts' => $attempts,
+            ]);
+        }
+        if ($attempts > 0) {
+            return $this->calculateDelay($attempts);
+        }
+
+        return 0;
+    }
 }

lib/private/AppFramework/Middleware/PublicShare/PublicShareMiddleware.php

Indentation +103 added lines, -103 removed lines

@@ -20,107 +20,107 @@
 
 class PublicShareMiddleware extends Middleware {
 
-	public function __construct(
-		private IRequest $request,
-		private ISession $session,
-		private IConfig $config,
-		private IThrottler $throttler,
-	) {
-	}
-
-	public function beforeController($controller, $methodName) {
-		if (!($controller instanceof PublicShareController)) {
-			return;
-		}
-
-		$controllerClassPath = explode('\\', get_class($controller));
-		$controllerShortClass = end($controllerClassPath);
-		$bruteforceProtectionAction = $controllerShortClass . '::' . $methodName;
-		$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), $bruteforceProtectionAction);
-
-		if (!$this->isLinkSharingEnabled()) {
-			throw new NotFoundException('Link sharing is disabled');
-		}
-
-		// We require the token parameter to be set
-		$token = $this->request->getParam('token');
-		if ($token === null) {
-			throw new NotFoundException();
-		}
-
-		// Set the token
-		$controller->setToken($token);
-
-		if (!$controller->isValidToken()) {
-			$this->throttle($bruteforceProtectionAction, $token);
-
-			$controller->shareNotFound();
-			throw new NotFoundException();
-		}
-
-		// No need to check for authentication when we try to authenticate
-		if ($methodName === 'authenticate' || $methodName === 'showAuthenticate') {
-			return;
-		}
-
-		// If authentication succeeds just continue
-		if ($controller->isAuthenticated()) {
-			return;
-		}
-
-		// If we can authenticate to this controller do it else we throw a 404 to not leak any info
-		if ($controller instanceof AuthPublicShareController) {
-			$this->session->set('public_link_authenticate_redirect', json_encode($this->request->getParams()));
-			throw new NeedAuthenticationException();
-		}
-
-		$this->throttle($bruteforceProtectionAction, $token);
-		throw new NotFoundException();
-	}
-
-	public function afterException($controller, $methodName, \Exception $exception) {
-		if (!($controller instanceof PublicShareController)) {
-			throw $exception;
-		}
-
-		if ($exception instanceof NotFoundException) {
-			return new TemplateResponse(Application::APP_ID, 'sharenotfound', [
-				'message' => $exception->getMessage(),
-			], 'guest', Http::STATUS_NOT_FOUND);
-		}
-
-		if ($controller instanceof AuthPublicShareController && $exception instanceof NeedAuthenticationException) {
-			return $controller->getAuthenticationRedirect($this->getFunctionForRoute($this->request->getParam('_route')));
-		}
-
-		throw $exception;
-	}
-
-	private function getFunctionForRoute(string $route): string {
-		$tmp = explode('.', $route);
-		return array_pop($tmp);
-	}
-
-	/**
-	 * Check if link sharing is allowed
-	 */
-	private function isLinkSharingEnabled(): bool {
-		// Check if the shareAPI is enabled
-		if ($this->config->getAppValue('core', 'shareapi_enabled', 'yes') !== 'yes') {
-			return false;
-		}
-
-		// Check whether public sharing is enabled
-		if ($this->config->getAppValue('core', 'shareapi_allow_links', 'yes') !== 'yes') {
-			return false;
-		}
-
-		return true;
-	}
-
-	private function throttle($bruteforceProtectionAction, $token): void {
-		$ip = $this->request->getRemoteAddress();
-		$this->throttler->sleepDelayOrThrowOnMax($ip, $bruteforceProtectionAction);
-		$this->throttler->registerAttempt($bruteforceProtectionAction, $ip, ['token' => $token]);
-	}
+    public function __construct(
+        private IRequest $request,
+        private ISession $session,
+        private IConfig $config,
+        private IThrottler $throttler,
+    ) {
+    }
+
+    public function beforeController($controller, $methodName) {
+        if (!($controller instanceof PublicShareController)) {
+            return;
+        }
+
+        $controllerClassPath = explode('\\', get_class($controller));
+        $controllerShortClass = end($controllerClassPath);
+        $bruteforceProtectionAction = $controllerShortClass . '::' . $methodName;
+        $this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), $bruteforceProtectionAction);
+
+        if (!$this->isLinkSharingEnabled()) {
+            throw new NotFoundException('Link sharing is disabled');
+        }
+
+        // We require the token parameter to be set
+        $token = $this->request->getParam('token');
+        if ($token === null) {
+            throw new NotFoundException();
+        }
+
+        // Set the token
+        $controller->setToken($token);
+
+        if (!$controller->isValidToken()) {
+            $this->throttle($bruteforceProtectionAction, $token);
+
+            $controller->shareNotFound();
+            throw new NotFoundException();
+        }
+
+        // No need to check for authentication when we try to authenticate
+        if ($methodName === 'authenticate' || $methodName === 'showAuthenticate') {
+            return;
+        }
+
+        // If authentication succeeds just continue
+        if ($controller->isAuthenticated()) {
+            return;
+        }
+
+        // If we can authenticate to this controller do it else we throw a 404 to not leak any info
+        if ($controller instanceof AuthPublicShareController) {
+            $this->session->set('public_link_authenticate_redirect', json_encode($this->request->getParams()));
+            throw new NeedAuthenticationException();
+        }
+
+        $this->throttle($bruteforceProtectionAction, $token);
+        throw new NotFoundException();
+    }
+
+    public function afterException($controller, $methodName, \Exception $exception) {
+        if (!($controller instanceof PublicShareController)) {
+            throw $exception;
+        }
+
+        if ($exception instanceof NotFoundException) {
+            return new TemplateResponse(Application::APP_ID, 'sharenotfound', [
+                'message' => $exception->getMessage(),
+            ], 'guest', Http::STATUS_NOT_FOUND);
+        }
+
+        if ($controller instanceof AuthPublicShareController && $exception instanceof NeedAuthenticationException) {
+            return $controller->getAuthenticationRedirect($this->getFunctionForRoute($this->request->getParam('_route')));
+        }
+
+        throw $exception;
+    }
+
+    private function getFunctionForRoute(string $route): string {
+        $tmp = explode('.', $route);
+        return array_pop($tmp);
+    }
+
+    /**
+     * Check if link sharing is allowed
+     */
+    private function isLinkSharingEnabled(): bool {
+        // Check if the shareAPI is enabled
+        if ($this->config->getAppValue('core', 'shareapi_enabled', 'yes') !== 'yes') {
+            return false;
+        }
+
+        // Check whether public sharing is enabled
+        if ($this->config->getAppValue('core', 'shareapi_allow_links', 'yes') !== 'yes') {
+            return false;
+        }
+
+        return true;
+    }
+
+    private function throttle($bruteforceProtectionAction, $token): void {
+        $ip = $this->request->getRemoteAddress();
+        $this->throttler->sleepDelayOrThrowOnMax($ip, $bruteforceProtectionAction);
+        $this->throttler->registerAttempt($bruteforceProtectionAction, $ip, ['token' => $token]);
+    }
 }

apps/dav/lib/Direct/DirectHome.php

Indentation +60 added lines, -60 removed lines

@@ -22,64 +22,64 @@
 
 class DirectHome implements ICollection {
 
-	public function __construct(
-		private IRootFolder $rootFolder,
-		private DirectMapper $mapper,
-		private ITimeFactory $timeFactory,
-		private IThrottler $throttler,
-		private IRequest $request,
-		private IEventDispatcher $eventDispatcher,
-	) {
-	}
-
-	public function createFile($name, $data = null) {
-		throw new Forbidden();
-	}
-
-	public function createDirectory($name) {
-		throw new Forbidden();
-	}
-
-	public function getChild($name): DirectFile {
-		try {
-			$direct = $this->mapper->getByToken($name);
-
-			// Expired
-			if ($direct->getExpiration() < $this->timeFactory->getTime()) {
-				throw new NotFound();
-			}
-
-			return new DirectFile($direct, $this->rootFolder, $this->eventDispatcher);
-		} catch (DoesNotExistException $e) {
-			// Since the token space is so huge only throttle on non-existing token
-			$this->throttler->registerAttempt('directlink', $this->request->getRemoteAddress());
-			$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), 'directlink');
-
-			throw new NotFound();
-		}
-	}
-
-	public function getChildren() {
-		throw new MethodNotAllowed('Listing members of this collection is disabled');
-	}
-
-	public function childExists($name): bool {
-		return false;
-	}
-
-	public function delete() {
-		throw new Forbidden();
-	}
-
-	public function getName(): string {
-		return 'direct';
-	}
-
-	public function setName($name) {
-		throw new Forbidden();
-	}
-
-	public function getLastModified(): int {
-		return 0;
-	}
+    public function __construct(
+        private IRootFolder $rootFolder,
+        private DirectMapper $mapper,
+        private ITimeFactory $timeFactory,
+        private IThrottler $throttler,
+        private IRequest $request,
+        private IEventDispatcher $eventDispatcher,
+    ) {
+    }
+
+    public function createFile($name, $data = null) {
+        throw new Forbidden();
+    }
+
+    public function createDirectory($name) {
+        throw new Forbidden();
+    }
+
+    public function getChild($name): DirectFile {
+        try {
+            $direct = $this->mapper->getByToken($name);
+
+            // Expired
+            if ($direct->getExpiration() < $this->timeFactory->getTime()) {
+                throw new NotFound();
+            }
+
+            return new DirectFile($direct, $this->rootFolder, $this->eventDispatcher);
+        } catch (DoesNotExistException $e) {
+            // Since the token space is so huge only throttle on non-existing token
+            $this->throttler->registerAttempt('directlink', $this->request->getRemoteAddress());
+            $this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), 'directlink');
+
+            throw new NotFound();
+        }
+    }
+
+    public function getChildren() {
+        throw new MethodNotAllowed('Listing members of this collection is disabled');
+    }
+
+    public function childExists($name): bool {
+        return false;
+    }
+
+    public function delete() {
+        throw new Forbidden();
+    }
+
+    public function getName(): string {
+        return 'direct';
+    }
+
+    public function setName($name) {
+        throw new Forbidden();
+    }
+
+    public function getLastModified(): int {
+        return 0;
+    }
 }

apps/dav/lib/Connector/Sabre/PublicAuth.php

Indentation +175 added lines, -175 removed lines

@@ -34,179 +34,179 @@
  * @package OCA\DAV\Connector
  */
 class PublicAuth extends AbstractBasic {
-	private const BRUTEFORCE_ACTION = 'public_dav_auth';
-	public const DAV_AUTHENTICATED = 'public_link_authenticated';
-
-	private ?IShare $share = null;
-
-	public function __construct(
-		private IRequest $request,
-		private IManager $shareManager,
-		private ISession $session,
-		private IThrottler $throttler,
-		private LoggerInterface $logger,
-	) {
-		// setup realm
-		$defaults = new Defaults();
-		$this->realm = $defaults->getName();
-	}
-
-	/**
-	 * @param RequestInterface $request
-	 * @param ResponseInterface $response
-	 *
-	 * @return array
-	 * @throws NotAuthenticated
-	 * @throws MaxDelayReached
-	 * @throws ServiceUnavailable
-	 */
-	public function check(RequestInterface $request, ResponseInterface $response): array {
-		try {
-			$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), self::BRUTEFORCE_ACTION);
-
-			$auth = new HTTP\Auth\Basic(
-				$this->realm,
-				$request,
-				$response
-			);
-
-			$userpass = $auth->getCredentials();
-			// If authentication provided, checking its validity
-			if ($userpass && !$this->validateUserPass($userpass[0], $userpass[1])) {
-				return [false, 'Username or password was incorrect'];
-			}
-
-			return $this->checkToken();
-		} catch (NotAuthenticated|MaxDelayReached $e) {
-			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
-			throw $e;
-		} catch (\Exception $e) {
-			$class = get_class($e);
-			$msg = $e->getMessage();
-			$this->logger->error($e->getMessage(), ['exception' => $e]);
-			throw new ServiceUnavailable("$class: $msg");
-		}
-	}
-
-	/**
-	 * Extract token from request url
-	 * @return string
-	 * @throws NotFound
-	 */
-	private function getToken(): string {
-		$path = $this->request->getPathInfo() ?: '';
-		// ['', 'dav', 'files', 'token']
-		$splittedPath = explode('/', $path);
-
-		if (count($splittedPath) < 4 || $splittedPath[3] === '') {
-			throw new NotFound();
-		}
-
-		return $splittedPath[3];
-	}
-
-	/**
-	 * Check token validity
-	 * @return array
-	 * @throws NotFound
-	 * @throws NotAuthenticated
-	 */
-	private function checkToken(): array {
-		$token = $this->getToken();
-
-		try {
-			/** @var IShare $share */
-			$share = $this->shareManager->getShareByToken($token);
-		} catch (ShareNotFound $e) {
-			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
-			throw new NotFound();
-		}
-
-		$this->share = $share;
-		\OC_User::setIncognitoMode(true);
-
-		// If already authenticated
-		if ($this->session->exists(self::DAV_AUTHENTICATED)
-			&& $this->session->get(self::DAV_AUTHENTICATED) === $share->getId()) {
-			return [true, $this->principalPrefix . $token];
-		}
-
-		// If the share is protected but user is not authenticated
-		if ($share->getPassword() !== null) {
-			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
-			throw new NotAuthenticated();
-		}
-
-		return [true, $this->principalPrefix . $token];
-	}
-
-	/**
-	 * Validates a username and password
-	 *
-	 * This method should return true or false depending on if login
-	 * succeeded.
-	 *
-	 * @param string $username
-	 * @param string $password
-	 *
-	 * @return bool
-	 * @throws NotAuthenticated
-	 */
-	protected function validateUserPass($username, $password) {
-		$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), self::BRUTEFORCE_ACTION);
-
-		$token = $this->getToken();
-		try {
-			$share = $this->shareManager->getShareByToken($token);
-		} catch (ShareNotFound $e) {
-			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
-			return false;
-		}
-
-		$this->share = $share;
-		\OC_User::setIncognitoMode(true);
-
-		// check if the share is password protected
-		if ($share->getPassword() !== null) {
-			if ($share->getShareType() === IShare::TYPE_LINK
-				|| $share->getShareType() === IShare::TYPE_EMAIL
-				|| $share->getShareType() === IShare::TYPE_CIRCLE) {
-				if ($this->shareManager->checkPassword($share, $password)) {
-					// If not set, set authenticated session cookie
-					if (!$this->session->exists(self::DAV_AUTHENTICATED)
-						|| $this->session->get(self::DAV_AUTHENTICATED) !== $share->getId()) {
-						$this->session->set(self::DAV_AUTHENTICATED, $share->getId());
-					}
-					return true;
-				}
-
-				if ($this->session->exists(PublicAuth::DAV_AUTHENTICATED)
-					&& $this->session->get(PublicAuth::DAV_AUTHENTICATED) === $share->getId()) {
-					return true;
-				}
-
-				if (in_array('XMLHttpRequest', explode(',', $this->request->getHeader('X-Requested-With')))) {
-					// do not re-authenticate over ajax, use dummy auth name to prevent browser popup
-					http_response_code(401);
-					header('WWW-Authenticate: DummyBasic realm="' . $this->realm . '"');
-					throw new NotAuthenticated('Cannot authenticate over ajax calls');
-				}
-
-				$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
-				return false;
-			} elseif ($share->getShareType() === IShare::TYPE_REMOTE) {
-				return true;
-			}
-
-			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
-			return false;
-		}
-
-		return true;
-	}
-
-	public function getShare(): IShare {
-		assert($this->share !== null);
-		return $this->share;
-	}
+    private const BRUTEFORCE_ACTION = 'public_dav_auth';
+    public const DAV_AUTHENTICATED = 'public_link_authenticated';
+
+    private ?IShare $share = null;
+
+    public function __construct(
+        private IRequest $request,
+        private IManager $shareManager,
+        private ISession $session,
+        private IThrottler $throttler,
+        private LoggerInterface $logger,
+    ) {
+        // setup realm
+        $defaults = new Defaults();
+        $this->realm = $defaults->getName();
+    }
+
+    /**
+     * @param RequestInterface $request
+     * @param ResponseInterface $response
+     *
+     * @return array
+     * @throws NotAuthenticated
+     * @throws MaxDelayReached
+     * @throws ServiceUnavailable
+     */
+    public function check(RequestInterface $request, ResponseInterface $response): array {
+        try {
+            $this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), self::BRUTEFORCE_ACTION);
+
+            $auth = new HTTP\Auth\Basic(
+                $this->realm,
+                $request,
+                $response
+            );
+
+            $userpass = $auth->getCredentials();
+            // If authentication provided, checking its validity
+            if ($userpass && !$this->validateUserPass($userpass[0], $userpass[1])) {
+                return [false, 'Username or password was incorrect'];
+            }
+
+            return $this->checkToken();
+        } catch (NotAuthenticated|MaxDelayReached $e) {
+            $this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
+            throw $e;
+        } catch (\Exception $e) {
+            $class = get_class($e);
+            $msg = $e->getMessage();
+            $this->logger->error($e->getMessage(), ['exception' => $e]);
+            throw new ServiceUnavailable("$class: $msg");
+        }
+    }
+
+    /**
+     * Extract token from request url
+     * @return string
+     * @throws NotFound
+     */
+    private function getToken(): string {
+        $path = $this->request->getPathInfo() ?: '';
+        // ['', 'dav', 'files', 'token']
+        $splittedPath = explode('/', $path);
+
+        if (count($splittedPath) < 4 || $splittedPath[3] === '') {
+            throw new NotFound();
+        }
+
+        return $splittedPath[3];
+    }
+
+    /**
+     * Check token validity
+     * @return array
+     * @throws NotFound
+     * @throws NotAuthenticated
+     */
+    private function checkToken(): array {
+        $token = $this->getToken();
+
+        try {
+            /** @var IShare $share */
+            $share = $this->shareManager->getShareByToken($token);
+        } catch (ShareNotFound $e) {
+            $this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
+            throw new NotFound();
+        }
+
+        $this->share = $share;
+        \OC_User::setIncognitoMode(true);
+
+        // If already authenticated
+        if ($this->session->exists(self::DAV_AUTHENTICATED)
+            && $this->session->get(self::DAV_AUTHENTICATED) === $share->getId()) {
+            return [true, $this->principalPrefix . $token];
+        }
+
+        // If the share is protected but user is not authenticated
+        if ($share->getPassword() !== null) {
+            $this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
+            throw new NotAuthenticated();
+        }
+
+        return [true, $this->principalPrefix . $token];
+    }
+
+    /**
+     * Validates a username and password
+     *
+     * This method should return true or false depending on if login
+     * succeeded.
+     *
+     * @param string $username
+     * @param string $password
+     *
+     * @return bool
+     * @throws NotAuthenticated
+     */
+    protected function validateUserPass($username, $password) {
+        $this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), self::BRUTEFORCE_ACTION);
+
+        $token = $this->getToken();
+        try {
+            $share = $this->shareManager->getShareByToken($token);
+        } catch (ShareNotFound $e) {
+            $this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
+            return false;
+        }
+
+        $this->share = $share;
+        \OC_User::setIncognitoMode(true);
+
+        // check if the share is password protected
+        if ($share->getPassword() !== null) {
+            if ($share->getShareType() === IShare::TYPE_LINK
+                || $share->getShareType() === IShare::TYPE_EMAIL
+                || $share->getShareType() === IShare::TYPE_CIRCLE) {
+                if ($this->shareManager->checkPassword($share, $password)) {
+                    // If not set, set authenticated session cookie
+                    if (!$this->session->exists(self::DAV_AUTHENTICATED)
+                        || $this->session->get(self::DAV_AUTHENTICATED) !== $share->getId()) {
+                        $this->session->set(self::DAV_AUTHENTICATED, $share->getId());
+                    }
+                    return true;
+                }
+
+                if ($this->session->exists(PublicAuth::DAV_AUTHENTICATED)
+                    && $this->session->get(PublicAuth::DAV_AUTHENTICATED) === $share->getId()) {
+                    return true;
+                }
+
+                if (in_array('XMLHttpRequest', explode(',', $this->request->getHeader('X-Requested-With')))) {
+                    // do not re-authenticate over ajax, use dummy auth name to prevent browser popup
+                    http_response_code(401);
+                    header('WWW-Authenticate: DummyBasic realm="' . $this->realm . '"');
+                    throw new NotAuthenticated('Cannot authenticate over ajax calls');
+                }
+
+                $this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
+                return false;
+            } elseif ($share->getShareType() === IShare::TYPE_REMOTE) {
+                return true;
+            }
+
+            $this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
+            return false;
+        }
+
+        return true;
+    }
+
+    public function getShare(): IShare {
+        assert($this->share !== null);
+        return $this->share;
+    }
 }

Spacing +4 added lines, -4 removed lines

@@ -77,7 +77,7 @@ 
 			}
 
 			return $this->checkToken();
-		} catch (NotAuthenticated|MaxDelayReached $e) {
+		} catch (NotAuthenticated | MaxDelayReached $e) {
 			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
 			throw $e;
 		} catch (\Exception $e) {
@@ -128,7 +128,7 @@ 
 		// If already authenticated
 		if ($this->session->exists(self::DAV_AUTHENTICATED)
 			&& $this->session->get(self::DAV_AUTHENTICATED) === $share->getId()) {
-			return [true, $this->principalPrefix . $token];
+			return [true, $this->principalPrefix.$token];
 		}
 
 		// If the share is protected but user is not authenticated
@@ -137,7 +137,7 @@ 
 			throw new NotAuthenticated();
 		}
 
-		return [true, $this->principalPrefix . $token];
+		return [true, $this->principalPrefix.$token];
 	}
 
 	/**
@@ -188,7 +188,7 @@ 
 				if (in_array('XMLHttpRequest', explode(',', $this->request->getHeader('X-Requested-With')))) {
 					// do not re-authenticate over ajax, use dummy auth name to prevent browser popup
 					http_response_code(401);
-					header('WWW-Authenticate: DummyBasic realm="' . $this->realm . '"');
+					header('WWW-Authenticate: DummyBasic realm="'.$this->realm.'"');
 					throw new NotAuthenticated('Cannot authenticate over ajax calls');
 				}
 

apps/dav/lib/Files/BrowserErrorPagePlugin.php

Indentation +78 added lines, -78 removed lines

@@ -18,89 +18,89 @@
 use Sabre\DAV\ServerPlugin;
 
 class BrowserErrorPagePlugin extends ServerPlugin {
-	/** @var Server */
-	private $server;
+    /** @var Server */
+    private $server;
 
-	/**
-	 * This initializes the plugin.
-	 *
-	 * This function is called by Sabre\DAV\Server, after
-	 * addPlugin is called.
-	 *
-	 * This method should set up the required event subscriptions.
-	 *
-	 * @param Server $server
-	 * @return void
-	 */
-	public function initialize(Server $server) {
-		$this->server = $server;
-		$server->on('exception', [$this, 'logException'], 1000);
-	}
+    /**
+     * This initializes the plugin.
+     *
+     * This function is called by Sabre\DAV\Server, after
+     * addPlugin is called.
+     *
+     * This method should set up the required event subscriptions.
+     *
+     * @param Server $server
+     * @return void
+     */
+    public function initialize(Server $server) {
+        $this->server = $server;
+        $server->on('exception', [$this, 'logException'], 1000);
+    }
 
-	/**
-	 * @param IRequest $request
-	 * @return bool
-	 */
-	public static function isBrowserRequest(IRequest $request) {
-		if ($request->getMethod() !== 'GET') {
-			return false;
-		}
-		return $request->isUserAgent([
-			Request::USER_AGENT_IE,
-			Request::USER_AGENT_MS_EDGE,
-			Request::USER_AGENT_CHROME,
-			Request::USER_AGENT_FIREFOX,
-			Request::USER_AGENT_SAFARI,
-		]);
-	}
+    /**
+     * @param IRequest $request
+     * @return bool
+     */
+    public static function isBrowserRequest(IRequest $request) {
+        if ($request->getMethod() !== 'GET') {
+            return false;
+        }
+        return $request->isUserAgent([
+            Request::USER_AGENT_IE,
+            Request::USER_AGENT_MS_EDGE,
+            Request::USER_AGENT_CHROME,
+            Request::USER_AGENT_FIREFOX,
+            Request::USER_AGENT_SAFARI,
+        ]);
+    }
 
-	/**
-	 * @param \Throwable $ex
-	 */
-	public function logException(\Throwable $ex): void {
-		if ($ex instanceof Exception) {
-			$httpCode = $ex->getHTTPCode();
-			$headers = $ex->getHTTPHeaders($this->server);
-		} elseif ($ex instanceof MaxDelayReached) {
-			$httpCode = 429;
-			$headers = [];
-		} else {
-			$httpCode = 500;
-			$headers = [];
-		}
-		$this->server->httpResponse->addHeaders($headers);
-		$this->server->httpResponse->setStatus($httpCode);
-		$body = $this->generateBody($httpCode);
-		$this->server->httpResponse->setBody($body);
-		$csp = new ContentSecurityPolicy();
-		$this->server->httpResponse->addHeader('Content-Security-Policy', $csp->buildPolicy());
-		$this->sendResponse();
-	}
+    /**
+     * @param \Throwable $ex
+     */
+    public function logException(\Throwable $ex): void {
+        if ($ex instanceof Exception) {
+            $httpCode = $ex->getHTTPCode();
+            $headers = $ex->getHTTPHeaders($this->server);
+        } elseif ($ex instanceof MaxDelayReached) {
+            $httpCode = 429;
+            $headers = [];
+        } else {
+            $httpCode = 500;
+            $headers = [];
+        }
+        $this->server->httpResponse->addHeaders($headers);
+        $this->server->httpResponse->setStatus($httpCode);
+        $body = $this->generateBody($httpCode);
+        $this->server->httpResponse->setBody($body);
+        $csp = new ContentSecurityPolicy();
+        $this->server->httpResponse->addHeader('Content-Security-Policy', $csp->buildPolicy());
+        $this->sendResponse();
+    }
 
-	/**
-	 * @codeCoverageIgnore
-	 * @return bool|string
-	 */
-	public function generateBody(int $httpCode) {
-		$request = \OCP\Server::get(IRequest::class);
+    /**
+     * @codeCoverageIgnore
+     * @return bool|string
+     */
+    public function generateBody(int $httpCode) {
+        $request = \OCP\Server::get(IRequest::class);
 
-		$templateName = 'exception';
-		if ($httpCode === 403 || $httpCode === 404 || $httpCode === 429) {
-			$templateName = (string)$httpCode;
-		}
+        $templateName = 'exception';
+        if ($httpCode === 403 || $httpCode === 404 || $httpCode === 429) {
+            $templateName = (string)$httpCode;
+        }
 
-		$content = \OCP\Server::get(ITemplateManager::class)->getTemplate('core', $templateName, TemplateResponse::RENDER_AS_GUEST);
-		$content->assign('title', $this->server->httpResponse->getStatusText());
-		$content->assign('remoteAddr', $request->getRemoteAddress());
-		$content->assign('requestID', $request->getId());
-		return $content->fetchPage();
-	}
+        $content = \OCP\Server::get(ITemplateManager::class)->getTemplate('core', $templateName, TemplateResponse::RENDER_AS_GUEST);
+        $content->assign('title', $this->server->httpResponse->getStatusText());
+        $content->assign('remoteAddr', $request->getRemoteAddress());
+        $content->assign('requestID', $request->getId());
+        return $content->fetchPage();
+    }
 
-	/**
-	 * @codeCoverageIgnore
-	 */
-	public function sendResponse() {
-		$this->server->sapi->sendResponse($this->server->httpResponse);
-		exit();
-	}
+    /**
+     * @codeCoverageIgnore
+     */
+    public function sendResponse() {
+        $this->server->sapi->sendResponse($this->server->httpResponse);
+        exit();
+    }
 }

Spacing +1 added lines, -1 removed lines

@@ -86,7 +86,7 @@
 
 		$templateName = 'exception';
 		if ($httpCode === 403 || $httpCode === 404 || $httpCode === 429) {
-			$templateName = (string)$httpCode;
+			$templateName = (string) $httpCode;
 		}
 
 		$content = \OCP\Server::get(ITemplateManager::class)->getTemplate('core', $templateName, TemplateResponse::RENDER_AS_GUEST);

apps/dav/tests/unit/Direct/DirectHomeTest.php

Indentation +107 added lines, -107 removed lines

@@ -25,149 +25,149 @@
 
 class DirectHomeTest extends TestCase {
 
-	/** @var DirectMapper|\PHPUnit\Framework\MockObject\MockObject */
-	private $directMapper;
+    /** @var DirectMapper|\PHPUnit\Framework\MockObject\MockObject */
+    private $directMapper;
 
-	/** @var IRootFolder|\PHPUnit\Framework\MockObject\MockObject */
-	private $rootFolder;
+    /** @var IRootFolder|\PHPUnit\Framework\MockObject\MockObject */
+    private $rootFolder;
 
-	/** @var ITimeFactory|\PHPUnit\Framework\MockObject\MockObject */
-	private $timeFactory;
+    /** @var ITimeFactory|\PHPUnit\Framework\MockObject\MockObject */
+    private $timeFactory;
 
-	/** @var IThrottler|\PHPUnit\Framework\MockObject\MockObject */
-	private $throttler;
+    /** @var IThrottler|\PHPUnit\Framework\MockObject\MockObject */
+    private $throttler;
 
-	/** @var IRequest */
-	private $request;
+    /** @var IRequest */
+    private $request;
 
-	/** @var DirectHome */
-	private $directHome;
+    /** @var DirectHome */
+    private $directHome;
 
-	/** @var IEventDispatcher */
-	private $eventDispatcher;
+    /** @var IEventDispatcher */
+    private $eventDispatcher;
 
-	protected function setUp(): void {
-		parent::setUp();
+    protected function setUp(): void {
+        parent::setUp();
 
-		$this->directMapper = $this->createMock(DirectMapper::class);
-		$this->rootFolder = $this->createMock(IRootFolder::class);
-		$this->timeFactory = $this->createMock(ITimeFactory::class);
-		$this->throttler = $this->createMock(IThrottler::class);
-		$this->request = $this->createMock(IRequest::class);
-		$this->eventDispatcher = $this->createMock(IEventDispatcher::class);
+        $this->directMapper = $this->createMock(DirectMapper::class);
+        $this->rootFolder = $this->createMock(IRootFolder::class);
+        $this->timeFactory = $this->createMock(ITimeFactory::class);
+        $this->throttler = $this->createMock(IThrottler::class);
+        $this->request = $this->createMock(IRequest::class);
+        $this->eventDispatcher = $this->createMock(IEventDispatcher::class);
 
-		$this->timeFactory->method('getTime')
-			->willReturn(42);
+        $this->timeFactory->method('getTime')
+            ->willReturn(42);
 
-		$this->request->method('getRemoteAddress')
-			->willReturn('1.2.3.4');
+        $this->request->method('getRemoteAddress')
+            ->willReturn('1.2.3.4');
 
 
-		$this->directHome = new DirectHome(
-			$this->rootFolder,
-			$this->directMapper,
-			$this->timeFactory,
-			$this->throttler,
-			$this->request,
-			$this->eventDispatcher
-		);
-	}
+        $this->directHome = new DirectHome(
+            $this->rootFolder,
+            $this->directMapper,
+            $this->timeFactory,
+            $this->throttler,
+            $this->request,
+            $this->eventDispatcher
+        );
+    }
 
-	public function testCreateFile(): void {
-		$this->expectException(Forbidden::class);
+    public function testCreateFile(): void {
+        $this->expectException(Forbidden::class);
 
-		$this->directHome->createFile('foo', 'bar');
-	}
+        $this->directHome->createFile('foo', 'bar');
+    }
 
-	public function testCreateDirectory(): void {
-		$this->expectException(Forbidden::class);
+    public function testCreateDirectory(): void {
+        $this->expectException(Forbidden::class);
 
-		$this->directHome->createDirectory('foo');
-	}
+        $this->directHome->createDirectory('foo');
+    }
 
-	public function testGetChildren(): void {
-		$this->expectException(MethodNotAllowed::class);
+    public function testGetChildren(): void {
+        $this->expectException(MethodNotAllowed::class);
 
-		$this->directHome->getChildren();
-	}
+        $this->directHome->getChildren();
+    }
 
-	public function testChildExists(): void {
-		$this->assertFalse($this->directHome->childExists('foo'));
-	}
+    public function testChildExists(): void {
+        $this->assertFalse($this->directHome->childExists('foo'));
+    }
 
-	public function testDelete(): void {
-		$this->expectException(Forbidden::class);
+    public function testDelete(): void {
+        $this->expectException(Forbidden::class);
 
-		$this->directHome->delete();
-	}
+        $this->directHome->delete();
+    }
 
-	public function testGetName(): void {
-		$this->assertSame('direct', $this->directHome->getName());
-	}
+    public function testGetName(): void {
+        $this->assertSame('direct', $this->directHome->getName());
+    }
 
-	public function testSetName(): void {
-		$this->expectException(Forbidden::class);
+    public function testSetName(): void {
+        $this->expectException(Forbidden::class);
 
-		$this->directHome->setName('foo');
-	}
+        $this->directHome->setName('foo');
+    }
 
-	public function testGetLastModified(): void {
-		$this->assertSame(0, $this->directHome->getLastModified());
-	}
+    public function testGetLastModified(): void {
+        $this->assertSame(0, $this->directHome->getLastModified());
+    }
 
-	public function testGetChildValid(): void {
-		$direct = Direct::fromParams([
-			'expiration' => 100,
-		]);
+    public function testGetChildValid(): void {
+        $direct = Direct::fromParams([
+            'expiration' => 100,
+        ]);
 
-		$this->directMapper->method('getByToken')
-			->with('longtoken')
-			->willReturn($direct);
+        $this->directMapper->method('getByToken')
+            ->with('longtoken')
+            ->willReturn($direct);
 
-		$this->throttler->expects($this->never())
-			->method($this->anything());
+        $this->throttler->expects($this->never())
+            ->method($this->anything());
 
-		$result = $this->directHome->getChild('longtoken');
-		$this->assertInstanceOf(DirectFile::class, $result);
-	}
+        $result = $this->directHome->getChild('longtoken');
+        $this->assertInstanceOf(DirectFile::class, $result);
+    }
 
-	public function testGetChildExpired(): void {
-		$direct = Direct::fromParams([
-			'expiration' => 41,
-		]);
+    public function testGetChildExpired(): void {
+        $direct = Direct::fromParams([
+            'expiration' => 41,
+        ]);
 
-		$this->directMapper->method('getByToken')
-			->with('longtoken')
-			->willReturn($direct);
+        $this->directMapper->method('getByToken')
+            ->with('longtoken')
+            ->willReturn($direct);
 
-		$this->throttler->expects($this->never())
-			->method($this->anything());
+        $this->throttler->expects($this->never())
+            ->method($this->anything());
 
-		$this->expectException(NotFound::class);
+        $this->expectException(NotFound::class);
 
-		$this->directHome->getChild('longtoken');
-	}
+        $this->directHome->getChild('longtoken');
+    }
 
-	public function testGetChildInvalid(): void {
-		$this->directMapper->method('getByToken')
-			->with('longtoken')
-			->willThrowException(new DoesNotExistException('not found'));
+    public function testGetChildInvalid(): void {
+        $this->directMapper->method('getByToken')
+            ->with('longtoken')
+            ->willThrowException(new DoesNotExistException('not found'));
 
-		$this->throttler->expects($this->once())
-			->method('registerAttempt')
-			->with(
-				'directlink',
-				'1.2.3.4'
-			);
-		$this->throttler->expects($this->once())
-			->method('sleepDelayOrThrowOnMax')
-			->with(
-				'1.2.3.4',
-				'directlink'
-			);
+        $this->throttler->expects($this->once())
+            ->method('registerAttempt')
+            ->with(
+                'directlink',
+                '1.2.3.4'
+            );
+        $this->throttler->expects($this->once())
+            ->method('sleepDelayOrThrowOnMax')
+            ->with(
+                '1.2.3.4',
+                'directlink'
+            );
 
-		$this->expectException(NotFound::class);
+        $this->expectException(NotFound::class);
 
-		$this->directHome->getChild('longtoken');
-	}
+        $this->directHome->getChild('longtoken');
+    }
 }