nextcloud / server

lib/private/Authentication/LoginCredentials/Store.php

Indentation +81 added lines, -81 removed lines

@@ -40,85 +40,85 @@
 
 class Store implements IStore {
 
-	/** @var ISession */
-	private $session;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var IProvider|null */
-	private $tokenProvider;
-
-	public function __construct(ISession $session,
-								LoggerInterface $logger,
-								IProvider $tokenProvider = null) {
-		$this->session = $session;
-		$this->logger = $logger;
-		$this->tokenProvider = $tokenProvider;
-
-		Util::connectHook('OC_User', 'post_login', $this, 'authenticate');
-	}
-
-	/**
-	 * Hook listener on post login
-	 *
-	 * @param array $params
-	 */
-	public function authenticate(array $params) {
-		$this->session->set('login_credentials', json_encode($params));
-	}
-
-	/**
-	 * Replace the session implementation
-	 *
-	 * @param ISession $session
-	 */
-	public function setSession(ISession $session) {
-		$this->session = $session;
-	}
-
-	/**
-	 * @since 12
-	 *
-	 * @return ICredentials the login credentials of the current user
-	 * @throws CredentialsUnavailableException
-	 */
-	public function getLoginCredentials(): ICredentials {
-		if ($this->tokenProvider === null) {
-			throw new CredentialsUnavailableException();
-		}
-
-		$trySession = false;
-		try {
-			$sessionId = $this->session->getId();
-			$token = $this->tokenProvider->getToken($sessionId);
-
-			$uid = $token->getUID();
-			$user = $token->getLoginName();
-			$password = $this->tokenProvider->getPassword($token, $sessionId);
-
-			return new Credentials($uid, $user, $password);
-		} catch (SessionNotAvailableException $ex) {
-			$this->logger->debug('could not get login credentials because session is unavailable', ['app' => 'core']);
-		} catch (InvalidTokenException $ex) {
-			$this->logger->debug('could not get login credentials because the token is invalid', ['app' => 'core']);
-			$trySession = true;
-		} catch (PasswordlessTokenException $ex) {
-			$this->logger->debug('could not get login credentials because the token has no password', ['app' => 'core']);
-			$trySession = true;
-		}
-
-		if ($trySession && $this->session->exists('login_credentials')) {
-			/** @var array $creds */
-			$creds = json_decode($this->session->get('login_credentials'), true);
-			return new Credentials(
-				$creds['uid'],
-				$creds['loginName'] ?? $this->session->get('loginname') ?? $creds['uid'], // Pre 20 didn't have a loginName property, hence fall back to the session value and then to the UID
-				$creds['password']
-			);
-		}
-
-		// If we reach this line, an exception was thrown.
-		throw new CredentialsUnavailableException();
-	}
+    /** @var ISession */
+    private $session;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    /** @var IProvider|null */
+    private $tokenProvider;
+
+    public function __construct(ISession $session,
+                                LoggerInterface $logger,
+                                IProvider $tokenProvider = null) {
+        $this->session = $session;
+        $this->logger = $logger;
+        $this->tokenProvider = $tokenProvider;
+
+        Util::connectHook('OC_User', 'post_login', $this, 'authenticate');
+    }
+
+    /**
+     * Hook listener on post login
+     *
+     * @param array $params
+     */
+    public function authenticate(array $params) {
+        $this->session->set('login_credentials', json_encode($params));
+    }
+
+    /**
+     * Replace the session implementation
+     *
+     * @param ISession $session
+     */
+    public function setSession(ISession $session) {
+        $this->session = $session;
+    }
+
+    /**
+     * @since 12
+     *
+     * @return ICredentials the login credentials of the current user
+     * @throws CredentialsUnavailableException
+     */
+    public function getLoginCredentials(): ICredentials {
+        if ($this->tokenProvider === null) {
+            throw new CredentialsUnavailableException();
+        }
+
+        $trySession = false;
+        try {
+            $sessionId = $this->session->getId();
+            $token = $this->tokenProvider->getToken($sessionId);
+
+            $uid = $token->getUID();
+            $user = $token->getLoginName();
+            $password = $this->tokenProvider->getPassword($token, $sessionId);
+
+            return new Credentials($uid, $user, $password);
+        } catch (SessionNotAvailableException $ex) {
+            $this->logger->debug('could not get login credentials because session is unavailable', ['app' => 'core']);
+        } catch (InvalidTokenException $ex) {
+            $this->logger->debug('could not get login credentials because the token is invalid', ['app' => 'core']);
+            $trySession = true;
+        } catch (PasswordlessTokenException $ex) {
+            $this->logger->debug('could not get login credentials because the token has no password', ['app' => 'core']);
+            $trySession = true;
+        }
+
+        if ($trySession && $this->session->exists('login_credentials')) {
+            /** @var array $creds */
+            $creds = json_decode($this->session->get('login_credentials'), true);
+            return new Credentials(
+                $creds['uid'],
+                $creds['loginName'] ?? $this->session->get('loginname') ?? $creds['uid'], // Pre 20 didn't have a loginName property, hence fall back to the session value and then to the UID
+                $creds['password']
+            );
+        }
+
+        // If we reach this line, an exception was thrown.
+        throw new CredentialsUnavailableException();
+    }
 }

lib/private/Authentication/WebAuthn/Manager.php

Indentation +214 added lines, -214 removed lines

@@ -57,219 +57,219 @@
 
 class Manager {
 
-	/** @var CredentialRepository */
-	private $repository;
-
-	/** @var PublicKeyCredentialMapper */
-	private $credentialMapper;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var IConfig */
-	private $config;
-
-	public function __construct(
-		CredentialRepository $repository,
-		PublicKeyCredentialMapper $credentialMapper,
-		LoggerInterface $logger,
-		IConfig $config
-	) {
-		$this->repository = $repository;
-		$this->credentialMapper = $credentialMapper;
-		$this->logger = $logger;
-		$this->config = $config;
-	}
-
-	public function startRegistration(IUser $user, string $serverHost): PublicKeyCredentialCreationOptions {
-		$rpEntity = new PublicKeyCredentialRpEntity(
-			'Nextcloud', //Name
-			$this->stripPort($serverHost),        //ID
-			null                            //Icon
-		);
-
-		$userEntity = new PublicKeyCredentialUserEntity(
-			$user->getUID(),                              //Name
-			$user->getUID(),                              //ID
-			$user->getDisplayName()                      //Display name
+    /** @var CredentialRepository */
+    private $repository;
+
+    /** @var PublicKeyCredentialMapper */
+    private $credentialMapper;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    /** @var IConfig */
+    private $config;
+
+    public function __construct(
+        CredentialRepository $repository,
+        PublicKeyCredentialMapper $credentialMapper,
+        LoggerInterface $logger,
+        IConfig $config
+    ) {
+        $this->repository = $repository;
+        $this->credentialMapper = $credentialMapper;
+        $this->logger = $logger;
+        $this->config = $config;
+    }
+
+    public function startRegistration(IUser $user, string $serverHost): PublicKeyCredentialCreationOptions {
+        $rpEntity = new PublicKeyCredentialRpEntity(
+            'Nextcloud', //Name
+            $this->stripPort($serverHost),        //ID
+            null                            //Icon
+        );
+
+        $userEntity = new PublicKeyCredentialUserEntity(
+            $user->getUID(),                              //Name
+            $user->getUID(),                              //ID
+            $user->getDisplayName()                      //Display name
 //            'https://foo.example.co/avatar/123e4567-e89b-12d3-a456-426655440000' //Icon
-		);
-
-		$challenge = random_bytes(32);
-
-		$publicKeyCredentialParametersList = [
-			new PublicKeyCredentialParameters('public-key', Algorithms::COSE_ALGORITHM_ES256),
-			new PublicKeyCredentialParameters('public-key', Algorithms::COSE_ALGORITHM_RS256),
-		];
-
-		$timeout = 60000;
-
-		$excludedPublicKeyDescriptors = [
-		];
-
-		$authenticatorSelectionCriteria = new AuthenticatorSelectionCriteria(
-			null,
-			false,
-			AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
-		);
-
-		return new PublicKeyCredentialCreationOptions(
-			$rpEntity,
-			$userEntity,
-			$challenge,
-			$publicKeyCredentialParametersList,
-			$timeout,
-			$excludedPublicKeyDescriptors,
-			$authenticatorSelectionCriteria,
-			PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_NONE,
-			null
-		);
-	}
-
-	public function finishRegister(PublicKeyCredentialCreationOptions $publicKeyCredentialCreationOptions, string $name, string $data): PublicKeyCredentialEntity {
-		$tokenBindingHandler = new TokenBindingNotSupportedHandler();
-
-		$attestationStatementSupportManager = new AttestationStatementSupportManager();
-		$attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
-
-		$attestationObjectLoader = new AttestationObjectLoader($attestationStatementSupportManager);
-		$publicKeyCredentialLoader = new PublicKeyCredentialLoader($attestationObjectLoader);
-
-		// Extension Output Checker Handler
-		$extensionOutputCheckerHandler = new ExtensionOutputCheckerHandler();
-
-		// Authenticator Attestation Response Validator
-		$authenticatorAttestationResponseValidator = new AuthenticatorAttestationResponseValidator(
-			$attestationStatementSupportManager,
-			$this->repository,
-			$tokenBindingHandler,
-			$extensionOutputCheckerHandler
-		);
-
-		try {
-			// Load the data
-			$publicKeyCredential = $publicKeyCredentialLoader->load($data);
-			$response = $publicKeyCredential->getResponse();
-
-			// Check if the response is an Authenticator Attestation Response
-			if (!$response instanceof AuthenticatorAttestationResponse) {
-				throw new \RuntimeException('Not an authenticator attestation response');
-			}
-
-			// Check the response against the request
-			$request = ServerRequest::fromGlobals();
-
-			$publicKeyCredentialSource = $authenticatorAttestationResponseValidator->check(
-				$response,
-				$publicKeyCredentialCreationOptions,
-				$request);
-		} catch (\Throwable $exception) {
-			throw $exception;
-		}
-
-		// Persist the data
-		return $this->repository->saveAndReturnCredentialSource($publicKeyCredentialSource, $name);
-	}
-
-	private function stripPort(string $serverHost): string {
-		return preg_replace('/(:\d+$)/', '', $serverHost);
-	}
-
-	public function startAuthentication(string $uid, string $serverHost): PublicKeyCredentialRequestOptions {
-		// List of registered PublicKeyCredentialDescriptor classes associated to the user
-		$registeredPublicKeyCredentialDescriptors = array_map(function (PublicKeyCredentialEntity $entity) {
-			$credential = $entity->toPublicKeyCredentialSource();
-			return new PublicKeyCredentialDescriptor(
-				$credential->getType(),
-				$credential->getPublicKeyCredentialId()
-			);
-		}, $this->credentialMapper->findAllForUid($uid));
-
-		// Public Key Credential Request Options
-		return new PublicKeyCredentialRequestOptions(
-			random_bytes(32),                                                    // Challenge
-			60000,                                                              // Timeout
-			$this->stripPort($serverHost),                                                                  // Relying Party ID
-			$registeredPublicKeyCredentialDescriptors,                                  // Registered PublicKeyCredentialDescriptor classes
-			AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
-		);
-	}
-
-	public function finishAuthentication(PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions, string $data, string $uid) {
-		$attestationStatementSupportManager = new AttestationStatementSupportManager();
-		$attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
-
-		$attestationObjectLoader = new AttestationObjectLoader($attestationStatementSupportManager);
-		$publicKeyCredentialLoader = new PublicKeyCredentialLoader($attestationObjectLoader);
-
-		$tokenBindingHandler = new TokenBindingNotSupportedHandler();
-		$extensionOutputCheckerHandler = new ExtensionOutputCheckerHandler();
-		$algorithmManager = new \Cose\Algorithm\Manager();
-		$algorithmManager->add(new ES256());
-		$algorithmManager->add(new RS256());
-
-		$authenticatorAssertionResponseValidator = new AuthenticatorAssertionResponseValidator(
-			$this->repository,
-			$tokenBindingHandler,
-			$extensionOutputCheckerHandler,
-			$algorithmManager
-		);
-
-		try {
-			$this->logger->debug('Loading publickey credentials from: ' . $data);
-
-			// Load the data
-			$publicKeyCredential = $publicKeyCredentialLoader->load($data);
-			$response = $publicKeyCredential->getResponse();
-
-			// Check if the response is an Authenticator Attestation Response
-			if (!$response instanceof AuthenticatorAssertionResponse) {
-				throw new \RuntimeException('Not an authenticator attestation response');
-			}
-
-			// Check the response against the request
-			$request = ServerRequest::fromGlobals();
-
-			$publicKeyCredentialSource = $authenticatorAssertionResponseValidator->check(
-				$publicKeyCredential->getRawId(),
-				$response,
-				$publicKeyCredentialRequestOptions,
-				$request,
-				$uid
-			);
-		} catch (\Throwable $e) {
-			throw $e;
-		}
-
-
-
-		return true;
-	}
-
-	public function deleteRegistration(IUser $user, int $id): void {
-		try {
-			$entry = $this->credentialMapper->findById($user->getUID(), $id);
-		} catch (DoesNotExistException $e) {
-			$this->logger->warning("WebAuthn device $id does not exist, can't delete it");
-			return;
-		}
-
-		$this->credentialMapper->delete($entry);
-	}
-
-	public function isWebAuthnAvailable(): bool {
-		if (!extension_loaded('bcmath')) {
-			return false;
-		}
-
-		if (!extension_loaded('gmp')) {
-			return false;
-		}
-
-		if (!$this->config->getSystemValueBool('auth.webauthn.enabled', true)) {
-			return false;
-		}
-
-		return true;
-	}
+        );
+
+        $challenge = random_bytes(32);
+
+        $publicKeyCredentialParametersList = [
+            new PublicKeyCredentialParameters('public-key', Algorithms::COSE_ALGORITHM_ES256),
+            new PublicKeyCredentialParameters('public-key', Algorithms::COSE_ALGORITHM_RS256),
+        ];
+
+        $timeout = 60000;
+
+        $excludedPublicKeyDescriptors = [
+        ];
+
+        $authenticatorSelectionCriteria = new AuthenticatorSelectionCriteria(
+            null,
+            false,
+            AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
+        );
+
+        return new PublicKeyCredentialCreationOptions(
+            $rpEntity,
+            $userEntity,
+            $challenge,
+            $publicKeyCredentialParametersList,
+            $timeout,
+            $excludedPublicKeyDescriptors,
+            $authenticatorSelectionCriteria,
+            PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_NONE,
+            null
+        );
+    }
+
+    public function finishRegister(PublicKeyCredentialCreationOptions $publicKeyCredentialCreationOptions, string $name, string $data): PublicKeyCredentialEntity {
+        $tokenBindingHandler = new TokenBindingNotSupportedHandler();
+
+        $attestationStatementSupportManager = new AttestationStatementSupportManager();
+        $attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
+
+        $attestationObjectLoader = new AttestationObjectLoader($attestationStatementSupportManager);
+        $publicKeyCredentialLoader = new PublicKeyCredentialLoader($attestationObjectLoader);
+
+        // Extension Output Checker Handler
+        $extensionOutputCheckerHandler = new ExtensionOutputCheckerHandler();
+
+        // Authenticator Attestation Response Validator
+        $authenticatorAttestationResponseValidator = new AuthenticatorAttestationResponseValidator(
+            $attestationStatementSupportManager,
+            $this->repository,
+            $tokenBindingHandler,
+            $extensionOutputCheckerHandler
+        );
+
+        try {
+            // Load the data
+            $publicKeyCredential = $publicKeyCredentialLoader->load($data);
+            $response = $publicKeyCredential->getResponse();
+
+            // Check if the response is an Authenticator Attestation Response
+            if (!$response instanceof AuthenticatorAttestationResponse) {
+                throw new \RuntimeException('Not an authenticator attestation response');
+            }
+
+            // Check the response against the request
+            $request = ServerRequest::fromGlobals();
+
+            $publicKeyCredentialSource = $authenticatorAttestationResponseValidator->check(
+                $response,
+                $publicKeyCredentialCreationOptions,
+                $request);
+        } catch (\Throwable $exception) {
+            throw $exception;
+        }
+
+        // Persist the data
+        return $this->repository->saveAndReturnCredentialSource($publicKeyCredentialSource, $name);
+    }
+
+    private function stripPort(string $serverHost): string {
+        return preg_replace('/(:\d+$)/', '', $serverHost);
+    }
+
+    public function startAuthentication(string $uid, string $serverHost): PublicKeyCredentialRequestOptions {
+        // List of registered PublicKeyCredentialDescriptor classes associated to the user
+        $registeredPublicKeyCredentialDescriptors = array_map(function (PublicKeyCredentialEntity $entity) {
+            $credential = $entity->toPublicKeyCredentialSource();
+            return new PublicKeyCredentialDescriptor(
+                $credential->getType(),
+                $credential->getPublicKeyCredentialId()
+            );
+        }, $this->credentialMapper->findAllForUid($uid));
+
+        // Public Key Credential Request Options
+        return new PublicKeyCredentialRequestOptions(
+            random_bytes(32),                                                    // Challenge
+            60000,                                                              // Timeout
+            $this->stripPort($serverHost),                                                                  // Relying Party ID
+            $registeredPublicKeyCredentialDescriptors,                                  // Registered PublicKeyCredentialDescriptor classes
+            AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
+        );
+    }
+
+    public function finishAuthentication(PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions, string $data, string $uid) {
+        $attestationStatementSupportManager = new AttestationStatementSupportManager();
+        $attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
+
+        $attestationObjectLoader = new AttestationObjectLoader($attestationStatementSupportManager);
+        $publicKeyCredentialLoader = new PublicKeyCredentialLoader($attestationObjectLoader);
+
+        $tokenBindingHandler = new TokenBindingNotSupportedHandler();
+        $extensionOutputCheckerHandler = new ExtensionOutputCheckerHandler();
+        $algorithmManager = new \Cose\Algorithm\Manager();
+        $algorithmManager->add(new ES256());
+        $algorithmManager->add(new RS256());
+
+        $authenticatorAssertionResponseValidator = new AuthenticatorAssertionResponseValidator(
+            $this->repository,
+            $tokenBindingHandler,
+            $extensionOutputCheckerHandler,
+            $algorithmManager
+        );
+
+        try {
+            $this->logger->debug('Loading publickey credentials from: ' . $data);
+
+            // Load the data
+            $publicKeyCredential = $publicKeyCredentialLoader->load($data);
+            $response = $publicKeyCredential->getResponse();
+
+            // Check if the response is an Authenticator Attestation Response
+            if (!$response instanceof AuthenticatorAssertionResponse) {
+                throw new \RuntimeException('Not an authenticator attestation response');
+            }
+
+            // Check the response against the request
+            $request = ServerRequest::fromGlobals();
+
+            $publicKeyCredentialSource = $authenticatorAssertionResponseValidator->check(
+                $publicKeyCredential->getRawId(),
+                $response,
+                $publicKeyCredentialRequestOptions,
+                $request,
+                $uid
+            );
+        } catch (\Throwable $e) {
+            throw $e;
+        }
+
+
+
+        return true;
+    }
+
+    public function deleteRegistration(IUser $user, int $id): void {
+        try {
+            $entry = $this->credentialMapper->findById($user->getUID(), $id);
+        } catch (DoesNotExistException $e) {
+            $this->logger->warning("WebAuthn device $id does not exist, can't delete it");
+            return;
+        }
+
+        $this->credentialMapper->delete($entry);
+    }
+
+    public function isWebAuthnAvailable(): bool {
+        if (!extension_loaded('bcmath')) {
+            return false;
+        }
+
+        if (!extension_loaded('gmp')) {
+            return false;
+        }
+
+        if (!$this->config->getSystemValueBool('auth.webauthn.enabled', true)) {
+            return false;
+        }
+
+        return true;
+    }
 }

lib/private/Authentication/Login/UserDisabledCheckCommand.php

Indentation +19 added lines, -19 removed lines

@@ -31,29 +31,29 @@
 
 class UserDisabledCheckCommand extends ALoginCommand {
 
-	/** @var IUserManager */
-	private $userManager;
+    /** @var IUserManager */
+    private $userManager;
 
-	/** @var LoggerInterface */
-	private $logger;
+    /** @var LoggerInterface */
+    private $logger;
 
-	public function __construct(IUserManager $userManager,
-								LoggerInterface $logger) {
-		$this->userManager = $userManager;
-		$this->logger = $logger;
-	}
+    public function __construct(IUserManager $userManager,
+                                LoggerInterface $logger) {
+        $this->userManager = $userManager;
+        $this->logger = $logger;
+    }
 
-	public function process(LoginData $loginData): LoginResult {
-		$user = $this->userManager->get($loginData->getUsername());
-		if ($user !== null && $user->isEnabled() === false) {
-			$username = $loginData->getUsername();
-			$ip = $loginData->getRequest()->getRemoteAddress();
+    public function process(LoginData $loginData): LoginResult {
+        $user = $this->userManager->get($loginData->getUsername());
+        if ($user !== null && $user->isEnabled() === false) {
+            $username = $loginData->getUsername();
+            $ip = $loginData->getRequest()->getRemoteAddress();
 
-			$this->logger->warning("Login failed: $username disabled (Remote IP: $ip)");
+            $this->logger->warning("Login failed: $username disabled (Remote IP: $ip)");
 
-			return LoginResult::failure($loginData, LoginController::LOGIN_MSG_USERDISABLED);
-		}
+            return LoginResult::failure($loginData, LoginController::LOGIN_MSG_USERDISABLED);
+        }
 
-		return $this->processNextOrFinishSuccessfully($loginData);
-	}
+        return $this->processNextOrFinishSuccessfully($loginData);
+    }
 }

lib/private/Authentication/Login/LoggedInCheckCommand.php

Indentation +19 added lines, -19 removed lines

@@ -33,29 +33,29 @@
 
 class LoggedInCheckCommand extends ALoginCommand {
 
-	/** @var LoggerInterface */
-	private $logger;
-	/** @var IEventDispatcher */
-	private $dispatcher;
+    /** @var LoggerInterface */
+    private $logger;
+    /** @var IEventDispatcher */
+    private $dispatcher;
 
-	public function __construct(LoggerInterface $logger,
-								IEventDispatcher $dispatcher) {
-		$this->logger = $logger;
-		$this->dispatcher = $dispatcher;
-	}
+    public function __construct(LoggerInterface $logger,
+                                IEventDispatcher $dispatcher) {
+        $this->logger = $logger;
+        $this->dispatcher = $dispatcher;
+    }
 
-	public function process(LoginData $loginData): LoginResult {
-		if ($loginData->getUser() === false) {
-			$loginName = $loginData->getUsername();
-			$ip = $loginData->getRequest()->getRemoteAddress();
+    public function process(LoginData $loginData): LoginResult {
+        if ($loginData->getUser() === false) {
+            $loginName = $loginData->getUsername();
+            $ip = $loginData->getRequest()->getRemoteAddress();
 
-			$this->logger->warning("Login failed: $loginName (Remote IP: $ip)");
+            $this->logger->warning("Login failed: $loginName (Remote IP: $ip)");
 
-			$this->dispatcher->dispatchTyped(new LoginFailed($loginName));
+            $this->dispatcher->dispatchTyped(new LoginFailed($loginName));
 
-			return LoginResult::failure($loginData, LoginController::LOGIN_MSG_INVALIDPASSWORD);
-		}
+            return LoginResult::failure($loginData, LoginController::LOGIN_MSG_INVALIDPASSWORD);
+        }
 
-		return $this->processNextOrFinishSuccessfully($loginData);
-	}
+        return $this->processNextOrFinishSuccessfully($loginData);
+    }
 }

lib/private/Authentication/Listeners/RemoteWipeEmailListener.php

Indentation +126 added lines, -126 removed lines

@@ -42,130 +42,130 @@
 
 class RemoteWipeEmailListener implements IEventListener {
 
-	/** @var IMailer */
-	private $mailer;
-
-	/** @var IUserManager */
-	private $userManager;
-
-	/** @var IL10N */
-	private $l10n;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	public function __construct(IMailer $mailer,
-								IUserManager $userManager,
-								IL10nFactory $l10nFactory,
-								LoggerInterface $logger) {
-		$this->mailer = $mailer;
-		$this->userManager = $userManager;
-		$this->l10n = $l10nFactory->get('core');
-		$this->logger = $logger;
-	}
-
-	/**
-	 * @param Event $event
-	 */
-	public function handle(Event $event): void {
-		if ($event instanceof RemoteWipeStarted) {
-			$uid = $event->getToken()->getUID();
-			$user = $this->userManager->get($uid);
-			if ($user === null) {
-				$this->logger->warning("not sending a wipe started email because user <$uid> does not exist (anymore)");
-				return;
-			}
-			if ($user->getEMailAddress() === null) {
-				$this->logger->info("not sending a wipe started email because user <$uid> has no email set");
-				return;
-			}
-
-			try {
-				$this->mailer->send(
-					$this->getWipingStartedMessage($event, $user)
-				);
-			} catch (Exception $e) {
-				$this->logger->error("Could not send remote wipe started email to <$uid>", [
-					'exception' => $e,
-				]);
-			}
-		} elseif ($event instanceof RemoteWipeFinished) {
-			$uid = $event->getToken()->getUID();
-			$user = $this->userManager->get($uid);
-			if ($user === null) {
-				$this->logger->warning("not sending a wipe finished email because user <$uid> does not exist (anymore)");
-				return;
-			}
-			if ($user->getEMailAddress() === null) {
-				$this->logger->info("not sending a wipe finished email because user <$uid> has no email set");
-				return;
-			}
-
-			try {
-				$this->mailer->send(
-					$this->getWipingFinishedMessage($event, $user)
-				);
-			} catch (Exception $e) {
-				$this->logger->error("Could not send remote wipe finished email to <$uid>", [
-					'exception' => $e,
-				]);
-			}
-		}
-	}
-
-	private function getWipingStartedMessage(RemoteWipeStarted $event, IUser $user): IMessage {
-		$message = $this->mailer->createMessage();
-		$emailTemplate = $this->mailer->createEMailTemplate('auth.RemoteWipeStarted');
-		$plainHeading = $this->l10n->t('Wiping of device %s has started', [$event->getToken()->getName()]);
-		$htmlHeading = $this->l10n->t('Wiping of device »%s« has started', [$event->getToken()->getName()]);
-		$emailTemplate->setSubject(
-			$this->l10n->t(
-				'»%s« started remote wipe',
-				[
-					substr($event->getToken()->getName(), 0, 15)
-				]
-			)
-		);
-		$emailTemplate->addHeader();
-		$emailTemplate->addHeading(
-			$htmlHeading,
-			$plainHeading
-		);
-		$emailTemplate->addBodyText(
-			$this->l10n->t('Device or application »%s« has started the remote wipe process. You will receive another email once the process has finished', [$event->getToken()->getName()])
-		);
-		$emailTemplate->addFooter();
-		$message->setTo([$user->getEMailAddress()]);
-		$message->useTemplate($emailTemplate);
-
-		return $message;
-	}
-
-	private function getWipingFinishedMessage(RemoteWipeFinished $event, IUser $user): IMessage {
-		$message = $this->mailer->createMessage();
-		$emailTemplate = $this->mailer->createEMailTemplate('auth.RemoteWipeFinished');
-		$plainHeading = $this->l10n->t('Wiping of device %s has finished', [$event->getToken()->getName()]);
-		$htmlHeading = $this->l10n->t('Wiping of device »%s« has finished', [$event->getToken()->getName()]);
-		$emailTemplate->setSubject(
-			$this->l10n->t(
-				'»%s« finished remote wipe',
-				[
-					substr($event->getToken()->getName(), 0, 15)
-				]
-			)
-		);
-		$emailTemplate->addHeader();
-		$emailTemplate->addHeading(
-			$htmlHeading,
-			$plainHeading
-		);
-		$emailTemplate->addBodyText(
-			$this->l10n->t('Device or application »%s« has finished the remote wipe process.', [$event->getToken()->getName()])
-		);
-		$emailTemplate->addFooter();
-		$message->setTo([$user->getEMailAddress()]);
-		$message->useTemplate($emailTemplate);
-
-		return $message;
-	}
+    /** @var IMailer */
+    private $mailer;
+
+    /** @var IUserManager */
+    private $userManager;
+
+    /** @var IL10N */
+    private $l10n;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    public function __construct(IMailer $mailer,
+                                IUserManager $userManager,
+                                IL10nFactory $l10nFactory,
+                                LoggerInterface $logger) {
+        $this->mailer = $mailer;
+        $this->userManager = $userManager;
+        $this->l10n = $l10nFactory->get('core');
+        $this->logger = $logger;
+    }
+
+    /**
+     * @param Event $event
+     */
+    public function handle(Event $event): void {
+        if ($event instanceof RemoteWipeStarted) {
+            $uid = $event->getToken()->getUID();
+            $user = $this->userManager->get($uid);
+            if ($user === null) {
+                $this->logger->warning("not sending a wipe started email because user <$uid> does not exist (anymore)");
+                return;
+            }
+            if ($user->getEMailAddress() === null) {
+                $this->logger->info("not sending a wipe started email because user <$uid> has no email set");
+                return;
+            }
+
+            try {
+                $this->mailer->send(
+                    $this->getWipingStartedMessage($event, $user)
+                );
+            } catch (Exception $e) {
+                $this->logger->error("Could not send remote wipe started email to <$uid>", [
+                    'exception' => $e,
+                ]);
+            }
+        } elseif ($event instanceof RemoteWipeFinished) {
+            $uid = $event->getToken()->getUID();
+            $user = $this->userManager->get($uid);
+            if ($user === null) {
+                $this->logger->warning("not sending a wipe finished email because user <$uid> does not exist (anymore)");
+                return;
+            }
+            if ($user->getEMailAddress() === null) {
+                $this->logger->info("not sending a wipe finished email because user <$uid> has no email set");
+                return;
+            }
+
+            try {
+                $this->mailer->send(
+                    $this->getWipingFinishedMessage($event, $user)
+                );
+            } catch (Exception $e) {
+                $this->logger->error("Could not send remote wipe finished email to <$uid>", [
+                    'exception' => $e,
+                ]);
+            }
+        }
+    }
+
+    private function getWipingStartedMessage(RemoteWipeStarted $event, IUser $user): IMessage {
+        $message = $this->mailer->createMessage();
+        $emailTemplate = $this->mailer->createEMailTemplate('auth.RemoteWipeStarted');
+        $plainHeading = $this->l10n->t('Wiping of device %s has started', [$event->getToken()->getName()]);
+        $htmlHeading = $this->l10n->t('Wiping of device »%s« has started', [$event->getToken()->getName()]);
+        $emailTemplate->setSubject(
+            $this->l10n->t(
+                '»%s« started remote wipe',
+                [
+                    substr($event->getToken()->getName(), 0, 15)
+                ]
+            )
+        );
+        $emailTemplate->addHeader();
+        $emailTemplate->addHeading(
+            $htmlHeading,
+            $plainHeading
+        );
+        $emailTemplate->addBodyText(
+            $this->l10n->t('Device or application »%s« has started the remote wipe process. You will receive another email once the process has finished', [$event->getToken()->getName()])
+        );
+        $emailTemplate->addFooter();
+        $message->setTo([$user->getEMailAddress()]);
+        $message->useTemplate($emailTemplate);
+
+        return $message;
+    }
+
+    private function getWipingFinishedMessage(RemoteWipeFinished $event, IUser $user): IMessage {
+        $message = $this->mailer->createMessage();
+        $emailTemplate = $this->mailer->createEMailTemplate('auth.RemoteWipeFinished');
+        $plainHeading = $this->l10n->t('Wiping of device %s has finished', [$event->getToken()->getName()]);
+        $htmlHeading = $this->l10n->t('Wiping of device »%s« has finished', [$event->getToken()->getName()]);
+        $emailTemplate->setSubject(
+            $this->l10n->t(
+                '»%s« finished remote wipe',
+                [
+                    substr($event->getToken()->getName(), 0, 15)
+                ]
+            )
+        );
+        $emailTemplate->addHeader();
+        $emailTemplate->addHeading(
+            $htmlHeading,
+            $plainHeading
+        );
+        $emailTemplate->addBodyText(
+            $this->l10n->t('Device or application »%s« has finished the remote wipe process.', [$event->getToken()->getName()])
+        );
+        $emailTemplate->addFooter();
+        $message->setTo([$user->getEMailAddress()]);
+        $message->useTemplate($emailTemplate);
+
+        return $message;
+    }
 }

lib/private/Authentication/Listeners/UserDeletedTokenCleanupListener.php

Indentation +30 added lines, -30 removed lines

@@ -35,38 +35,38 @@
 
 class UserDeletedTokenCleanupListener implements IEventListener {
 
-	/** @var Manager */
-	private $manager;
+    /** @var Manager */
+    private $manager;
 
-	/** @var LoggerInterface */
-	private $logger;
+    /** @var LoggerInterface */
+    private $logger;
 
-	public function __construct(Manager $manager,
-								LoggerInterface $logger) {
-		$this->manager = $manager;
-		$this->logger = $logger;
-	}
+    public function __construct(Manager $manager,
+                                LoggerInterface $logger) {
+        $this->manager = $manager;
+        $this->logger = $logger;
+    }
 
-	public function handle(Event $event): void {
-		if (!($event instanceof UserDeletedEvent)) {
-			// Unrelated
-			return;
-		}
+    public function handle(Event $event): void {
+        if (!($event instanceof UserDeletedEvent)) {
+            // Unrelated
+            return;
+        }
 
-		/**
-		 * Catch any exception during this process as any failure here shouldn't block the
-		 * user deletion.
-		 */
-		try {
-			$uid = $event->getUser()->getUID();
-			$tokens = $this->manager->getTokenByUser($uid);
-			foreach ($tokens as $token) {
-				$this->manager->invalidateTokenById($uid, $token->getId());
-			}
-		} catch (Throwable $e) {
-			$this->logger->error('Could not clean up auth tokens after user deletion: ' . $e->getMessage(), [
-				'exception' => $e,
-			]);
-		}
-	}
+        /**
+         * Catch any exception during this process as any failure here shouldn't block the
+         * user deletion.
+         */
+        try {
+            $uid = $event->getUser()->getUID();
+            $tokens = $this->manager->getTokenByUser($uid);
+            foreach ($tokens as $token) {
+                $this->manager->invalidateTokenById($uid, $token->getId());
+            }
+        } catch (Throwable $e) {
+            $this->logger->error('Could not clean up auth tokens after user deletion: ' . $e->getMessage(), [
+                'exception' => $e,
+            ]);
+        }
+    }
 }

Spacing +1 added lines, -1 removed lines

@@ -64,7 +64,7 @@
 				$this->manager->invalidateTokenById($uid, $token->getId());
 			}
 		} catch (Throwable $e) {
-			$this->logger->error('Could not clean up auth tokens after user deletion: ' . $e->getMessage(), [
+			$this->logger->error('Could not clean up auth tokens after user deletion: '.$e->getMessage(), [
 				'exception' => $e,
 			]);
 		}

lib/private/Authentication/Listeners/RemoteWipeActivityListener.php

Indentation +34 added lines, -34 removed lines

@@ -37,42 +37,42 @@
 
 class RemoteWipeActivityListener implements IEventListener {
 
-	/** @var IActvityManager */
-	private $activityManager;
+    /** @var IActvityManager */
+    private $activityManager;
 
-	/** @var LoggerInterface */
-	private $logger;
+    /** @var LoggerInterface */
+    private $logger;
 
-	public function __construct(IActvityManager $activityManager,
-								LoggerInterface $logger) {
-		$this->activityManager = $activityManager;
-		$this->logger = $logger;
-	}
+    public function __construct(IActvityManager $activityManager,
+                                LoggerInterface $logger) {
+        $this->activityManager = $activityManager;
+        $this->logger = $logger;
+    }
 
-	public function handle(Event $event): void {
-		if ($event instanceof RemoteWipeStarted) {
-			$this->publishActivity('remote_wipe_start', $event->getToken());
-		} elseif ($event instanceof RemoteWipeFinished) {
-			$this->publishActivity('remote_wipe_finish', $event->getToken());
-		}
-	}
+    public function handle(Event $event): void {
+        if ($event instanceof RemoteWipeStarted) {
+            $this->publishActivity('remote_wipe_start', $event->getToken());
+        } elseif ($event instanceof RemoteWipeFinished) {
+            $this->publishActivity('remote_wipe_finish', $event->getToken());
+        }
+    }
 
-	private function publishActivity(string $event, IToken $token): void {
-		$activity = $this->activityManager->generateEvent();
-		$activity->setApp('core')
-			->setType('security')
-			->setAuthor($token->getUID())
-			->setAffectedUser($token->getUID())
-			->setSubject($event, [
-				'name' => $token->getName(),
-			]);
-		try {
-			$this->activityManager->publish($activity);
-		} catch (BadMethodCallException $e) {
-			$this->logger->warning('could not publish activity', [
-				'app' => 'core',
-				'exception' => $e,
-			]);
-		}
-	}
+    private function publishActivity(string $event, IToken $token): void {
+        $activity = $this->activityManager->generateEvent();
+        $activity->setApp('core')
+            ->setType('security')
+            ->setAuthor($token->getUID())
+            ->setAffectedUser($token->getUID())
+            ->setSubject($event, [
+                'name' => $token->getName(),
+            ]);
+        try {
+            $this->activityManager->publish($activity);
+        } catch (BadMethodCallException $e) {
+            $this->logger->warning('could not publish activity', [
+                'app' => 'core',
+                'exception' => $e,
+            ]);
+        }
+    }
 }

lib/private/Authentication/TwoFactorAuth/Manager.php

Indentation +336 added lines, -336 removed lines

@@ -46,343 +46,343 @@
 use function array_filter;
 
 class Manager {
-	public const SESSION_UID_KEY = 'two_factor_auth_uid';
-	public const SESSION_UID_DONE = 'two_factor_auth_passed';
-	public const REMEMBER_LOGIN = 'two_factor_remember_login';
-	public const BACKUP_CODES_PROVIDER_ID = 'backup_codes';
-
-	/** @var ProviderLoader */
-	private $providerLoader;
-
-	/** @var IRegistry */
-	private $providerRegistry;
-
-	/** @var MandatoryTwoFactor */
-	private $mandatoryTwoFactor;
-
-	/** @var ISession */
-	private $session;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var IManager */
-	private $activityManager;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var TokenProvider */
-	private $tokenProvider;
-
-	/** @var ITimeFactory */
-	private $timeFactory;
-
-	/** @var EventDispatcherInterface */
-	private $dispatcher;
-
-	public function __construct(ProviderLoader $providerLoader,
-								IRegistry $providerRegistry,
-								MandatoryTwoFactor $mandatoryTwoFactor,
-								ISession $session,
-								IConfig $config,
-								IManager $activityManager,
-								LoggerInterface $logger,
-								TokenProvider $tokenProvider,
-								ITimeFactory $timeFactory,
-								EventDispatcherInterface $eventDispatcher) {
-		$this->providerLoader = $providerLoader;
-		$this->providerRegistry = $providerRegistry;
-		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
-		$this->session = $session;
-		$this->config = $config;
-		$this->activityManager = $activityManager;
-		$this->logger = $logger;
-		$this->tokenProvider = $tokenProvider;
-		$this->timeFactory = $timeFactory;
-		$this->dispatcher = $eventDispatcher;
-	}
-
-	/**
-	 * Determine whether the user must provide a second factor challenge
-	 *
-	 * @param IUser $user
-	 * @return boolean
-	 */
-	public function isTwoFactorAuthenticated(IUser $user): bool {
-		if ($this->mandatoryTwoFactor->isEnforcedFor($user)) {
-			return true;
-		}
-
-		$providerStates = $this->providerRegistry->getProviderStates($user);
-		$providers = $this->providerLoader->getProviders($user);
-		$fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
-		$enabled = array_filter($fixedStates);
-		$providerIds = array_keys($enabled);
-		$providerIdsWithoutBackupCodes = array_diff($providerIds, [self::BACKUP_CODES_PROVIDER_ID]);
-
-		return !empty($providerIdsWithoutBackupCodes);
-	}
-
-	/**
-	 * Get a 2FA provider by its ID
-	 *
-	 * @param IUser $user
-	 * @param string $challengeProviderId
-	 * @return IProvider|null
-	 */
-	public function getProvider(IUser $user, string $challengeProviderId) {
-		$providers = $this->getProviderSet($user)->getProviders();
-		return $providers[$challengeProviderId] ?? null;
-	}
-
-	/**
-	 * @param IUser $user
-	 * @return IActivatableAtLogin[]
-	 * @throws Exception
-	 */
-	public function getLoginSetupProviders(IUser $user): array {
-		$providers = $this->providerLoader->getProviders($user);
-		return array_filter($providers, function (IProvider $provider) {
-			return ($provider instanceof IActivatableAtLogin);
-		});
-	}
-
-	/**
-	 * Check if the persistant mapping of enabled/disabled state of each available
-	 * provider is missing an entry and add it to the registry in that case.
-	 *
-	 * @todo remove in Nextcloud 17 as by then all providers should have been updated
-	 *
-	 * @param string[] $providerStates
-	 * @param IProvider[] $providers
-	 * @param IUser $user
-	 * @return string[] the updated $providerStates variable
-	 */
-	private function fixMissingProviderStates(array $providerStates,
-		array $providers, IUser $user): array {
-		foreach ($providers as $provider) {
-			if (isset($providerStates[$provider->getId()])) {
-				// All good
-				continue;
-			}
-
-			$enabled = $provider->isTwoFactorAuthEnabledForUser($user);
-			if ($enabled) {
-				$this->providerRegistry->enableProviderFor($provider, $user);
-			} else {
-				$this->providerRegistry->disableProviderFor($provider, $user);
-			}
-			$providerStates[$provider->getId()] = $enabled;
-		}
-
-		return $providerStates;
-	}
-
-	/**
-	 * @param array $states
-	 * @param IProvider[] $providers
-	 */
-	private function isProviderMissing(array $states, array $providers): bool {
-		$indexed = [];
-		foreach ($providers as $provider) {
-			$indexed[$provider->getId()] = $provider;
-		}
-
-		$missing = [];
-		foreach ($states as $providerId => $enabled) {
-			if (!$enabled) {
-				// Don't care
-				continue;
-			}
-
-			if (!isset($indexed[$providerId])) {
-				$missing[] = $providerId;
-				$this->logger->alert("two-factor auth provider '$providerId' failed to load",
-					[
-						'app' => 'core',
-					]);
-			}
-		}
-
-		if (!empty($missing)) {
-			// There was at least one provider missing
-			$this->logger->alert(count($missing) . " two-factor auth providers failed to load", ['app' => 'core']);
-
-			return true;
-		}
-
-		// If we reach this, there was not a single provider missing
-		return false;
-	}
-
-	/**
-	 * Get the list of 2FA providers for the given user
-	 *
-	 * @param IUser $user
-	 * @throws Exception
-	 */
-	public function getProviderSet(IUser $user): ProviderSet {
-		$providerStates = $this->providerRegistry->getProviderStates($user);
-		$providers = $this->providerLoader->getProviders($user);
-
-		$fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
-		$isProviderMissing = $this->isProviderMissing($fixedStates, $providers);
-
-		$enabled = array_filter($providers, function (IProvider $provider) use ($fixedStates) {
-			return $fixedStates[$provider->getId()];
-		});
-		return new ProviderSet($enabled, $isProviderMissing);
-	}
-
-	/**
-	 * Verify the given challenge
-	 *
-	 * @param string $providerId
-	 * @param IUser $user
-	 * @param string $challenge
-	 * @return boolean
-	 */
-	public function verifyChallenge(string $providerId, IUser $user, string $challenge): bool {
-		$provider = $this->getProvider($user, $providerId);
-		if ($provider === null) {
-			return false;
-		}
-
-		$passed = $provider->verifyChallenge($user, $challenge);
-		if ($passed) {
-			if ($this->session->get(self::REMEMBER_LOGIN) === true) {
-				// TODO: resolve cyclic dependency and use DI
-				\OC::$server->getUserSession()->createRememberMeToken($user);
-			}
-			$this->session->remove(self::SESSION_UID_KEY);
-			$this->session->remove(self::REMEMBER_LOGIN);
-			$this->session->set(self::SESSION_UID_DONE, $user->getUID());
-
-			// Clear token from db
-			$sessionId = $this->session->getId();
-			$token = $this->tokenProvider->getToken($sessionId);
-			$tokenId = $token->getId();
-			$this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $tokenId);
-
-			$dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
-			$this->dispatcher->dispatch(IProvider::EVENT_SUCCESS, $dispatchEvent);
-
-			$this->publishEvent($user, 'twofactor_success', [
-				'provider' => $provider->getDisplayName(),
-			]);
-		} else {
-			$dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
-			$this->dispatcher->dispatch(IProvider::EVENT_FAILED, $dispatchEvent);
-
-			$this->publishEvent($user, 'twofactor_failed', [
-				'provider' => $provider->getDisplayName(),
-			]);
-		}
-		return $passed;
-	}
-
-	/**
-	 * Push a 2fa event the user's activity stream
-	 *
-	 * @param IUser $user
-	 * @param string $event
-	 * @param array $params
-	 */
-	private function publishEvent(IUser $user, string $event, array $params) {
-		$activity = $this->activityManager->generateEvent();
-		$activity->setApp('core')
-			->setType('security')
-			->setAuthor($user->getUID())
-			->setAffectedUser($user->getUID())
-			->setSubject($event, $params);
-		try {
-			$this->activityManager->publish($activity);
-		} catch (BadMethodCallException $e) {
-			$this->logger->warning('could not publish activity', ['app' => 'core', 'exception' => $e]);
-		}
-	}
-
-	/**
-	 * Check if the currently logged in user needs to pass 2FA
-	 *
-	 * @param IUser $user the currently logged in user
-	 * @return boolean
-	 */
-	public function needsSecondFactor(IUser $user = null): bool {
-		if ($user === null) {
-			return false;
-		}
-
-		// If we are authenticated using an app password skip all this
-		if ($this->session->exists('app_password')) {
-			return false;
-		}
-
-		// First check if the session tells us we should do 2FA (99% case)
-		if (!$this->session->exists(self::SESSION_UID_KEY)) {
-
-			// Check if the session tells us it is 2FA authenticated already
-			if ($this->session->exists(self::SESSION_UID_DONE) &&
-				$this->session->get(self::SESSION_UID_DONE) === $user->getUID()) {
-				return false;
-			}
-
-			/*
+    public const SESSION_UID_KEY = 'two_factor_auth_uid';
+    public const SESSION_UID_DONE = 'two_factor_auth_passed';
+    public const REMEMBER_LOGIN = 'two_factor_remember_login';
+    public const BACKUP_CODES_PROVIDER_ID = 'backup_codes';
+
+    /** @var ProviderLoader */
+    private $providerLoader;
+
+    /** @var IRegistry */
+    private $providerRegistry;
+
+    /** @var MandatoryTwoFactor */
+    private $mandatoryTwoFactor;
+
+    /** @var ISession */
+    private $session;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var IManager */
+    private $activityManager;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    /** @var TokenProvider */
+    private $tokenProvider;
+
+    /** @var ITimeFactory */
+    private $timeFactory;
+
+    /** @var EventDispatcherInterface */
+    private $dispatcher;
+
+    public function __construct(ProviderLoader $providerLoader,
+                                IRegistry $providerRegistry,
+                                MandatoryTwoFactor $mandatoryTwoFactor,
+                                ISession $session,
+                                IConfig $config,
+                                IManager $activityManager,
+                                LoggerInterface $logger,
+                                TokenProvider $tokenProvider,
+                                ITimeFactory $timeFactory,
+                                EventDispatcherInterface $eventDispatcher) {
+        $this->providerLoader = $providerLoader;
+        $this->providerRegistry = $providerRegistry;
+        $this->mandatoryTwoFactor = $mandatoryTwoFactor;
+        $this->session = $session;
+        $this->config = $config;
+        $this->activityManager = $activityManager;
+        $this->logger = $logger;
+        $this->tokenProvider = $tokenProvider;
+        $this->timeFactory = $timeFactory;
+        $this->dispatcher = $eventDispatcher;
+    }
+
+    /**
+     * Determine whether the user must provide a second factor challenge
+     *
+     * @param IUser $user
+     * @return boolean
+     */
+    public function isTwoFactorAuthenticated(IUser $user): bool {
+        if ($this->mandatoryTwoFactor->isEnforcedFor($user)) {
+            return true;
+        }
+
+        $providerStates = $this->providerRegistry->getProviderStates($user);
+        $providers = $this->providerLoader->getProviders($user);
+        $fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
+        $enabled = array_filter($fixedStates);
+        $providerIds = array_keys($enabled);
+        $providerIdsWithoutBackupCodes = array_diff($providerIds, [self::BACKUP_CODES_PROVIDER_ID]);
+
+        return !empty($providerIdsWithoutBackupCodes);
+    }
+
+    /**
+     * Get a 2FA provider by its ID
+     *
+     * @param IUser $user
+     * @param string $challengeProviderId
+     * @return IProvider|null
+     */
+    public function getProvider(IUser $user, string $challengeProviderId) {
+        $providers = $this->getProviderSet($user)->getProviders();
+        return $providers[$challengeProviderId] ?? null;
+    }
+
+    /**
+     * @param IUser $user
+     * @return IActivatableAtLogin[]
+     * @throws Exception
+     */
+    public function getLoginSetupProviders(IUser $user): array {
+        $providers = $this->providerLoader->getProviders($user);
+        return array_filter($providers, function (IProvider $provider) {
+            return ($provider instanceof IActivatableAtLogin);
+        });
+    }
+
+    /**
+     * Check if the persistant mapping of enabled/disabled state of each available
+     * provider is missing an entry and add it to the registry in that case.
+     *
+     * @todo remove in Nextcloud 17 as by then all providers should have been updated
+     *
+     * @param string[] $providerStates
+     * @param IProvider[] $providers
+     * @param IUser $user
+     * @return string[] the updated $providerStates variable
+     */
+    private function fixMissingProviderStates(array $providerStates,
+        array $providers, IUser $user): array {
+        foreach ($providers as $provider) {
+            if (isset($providerStates[$provider->getId()])) {
+                // All good
+                continue;
+            }
+
+            $enabled = $provider->isTwoFactorAuthEnabledForUser($user);
+            if ($enabled) {
+                $this->providerRegistry->enableProviderFor($provider, $user);
+            } else {
+                $this->providerRegistry->disableProviderFor($provider, $user);
+            }
+            $providerStates[$provider->getId()] = $enabled;
+        }
+
+        return $providerStates;
+    }
+
+    /**
+     * @param array $states
+     * @param IProvider[] $providers
+     */
+    private function isProviderMissing(array $states, array $providers): bool {
+        $indexed = [];
+        foreach ($providers as $provider) {
+            $indexed[$provider->getId()] = $provider;
+        }
+
+        $missing = [];
+        foreach ($states as $providerId => $enabled) {
+            if (!$enabled) {
+                // Don't care
+                continue;
+            }
+
+            if (!isset($indexed[$providerId])) {
+                $missing[] = $providerId;
+                $this->logger->alert("two-factor auth provider '$providerId' failed to load",
+                    [
+                        'app' => 'core',
+                    ]);
+            }
+        }
+
+        if (!empty($missing)) {
+            // There was at least one provider missing
+            $this->logger->alert(count($missing) . " two-factor auth providers failed to load", ['app' => 'core']);
+
+            return true;
+        }
+
+        // If we reach this, there was not a single provider missing
+        return false;
+    }
+
+    /**
+     * Get the list of 2FA providers for the given user
+     *
+     * @param IUser $user
+     * @throws Exception
+     */
+    public function getProviderSet(IUser $user): ProviderSet {
+        $providerStates = $this->providerRegistry->getProviderStates($user);
+        $providers = $this->providerLoader->getProviders($user);
+
+        $fixedStates = $this->fixMissingProviderStates($providerStates, $providers, $user);
+        $isProviderMissing = $this->isProviderMissing($fixedStates, $providers);
+
+        $enabled = array_filter($providers, function (IProvider $provider) use ($fixedStates) {
+            return $fixedStates[$provider->getId()];
+        });
+        return new ProviderSet($enabled, $isProviderMissing);
+    }
+
+    /**
+     * Verify the given challenge
+     *
+     * @param string $providerId
+     * @param IUser $user
+     * @param string $challenge
+     * @return boolean
+     */
+    public function verifyChallenge(string $providerId, IUser $user, string $challenge): bool {
+        $provider = $this->getProvider($user, $providerId);
+        if ($provider === null) {
+            return false;
+        }
+
+        $passed = $provider->verifyChallenge($user, $challenge);
+        if ($passed) {
+            if ($this->session->get(self::REMEMBER_LOGIN) === true) {
+                // TODO: resolve cyclic dependency and use DI
+                \OC::$server->getUserSession()->createRememberMeToken($user);
+            }
+            $this->session->remove(self::SESSION_UID_KEY);
+            $this->session->remove(self::REMEMBER_LOGIN);
+            $this->session->set(self::SESSION_UID_DONE, $user->getUID());
+
+            // Clear token from db
+            $sessionId = $this->session->getId();
+            $token = $this->tokenProvider->getToken($sessionId);
+            $tokenId = $token->getId();
+            $this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $tokenId);
+
+            $dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
+            $this->dispatcher->dispatch(IProvider::EVENT_SUCCESS, $dispatchEvent);
+
+            $this->publishEvent($user, 'twofactor_success', [
+                'provider' => $provider->getDisplayName(),
+            ]);
+        } else {
+            $dispatchEvent = new GenericEvent($user, ['provider' => $provider->getDisplayName()]);
+            $this->dispatcher->dispatch(IProvider::EVENT_FAILED, $dispatchEvent);
+
+            $this->publishEvent($user, 'twofactor_failed', [
+                'provider' => $provider->getDisplayName(),
+            ]);
+        }
+        return $passed;
+    }
+
+    /**
+     * Push a 2fa event the user's activity stream
+     *
+     * @param IUser $user
+     * @param string $event
+     * @param array $params
+     */
+    private function publishEvent(IUser $user, string $event, array $params) {
+        $activity = $this->activityManager->generateEvent();
+        $activity->setApp('core')
+            ->setType('security')
+            ->setAuthor($user->getUID())
+            ->setAffectedUser($user->getUID())
+            ->setSubject($event, $params);
+        try {
+            $this->activityManager->publish($activity);
+        } catch (BadMethodCallException $e) {
+            $this->logger->warning('could not publish activity', ['app' => 'core', 'exception' => $e]);
+        }
+    }
+
+    /**
+     * Check if the currently logged in user needs to pass 2FA
+     *
+     * @param IUser $user the currently logged in user
+     * @return boolean
+     */
+    public function needsSecondFactor(IUser $user = null): bool {
+        if ($user === null) {
+            return false;
+        }
+
+        // If we are authenticated using an app password skip all this
+        if ($this->session->exists('app_password')) {
+            return false;
+        }
+
+        // First check if the session tells us we should do 2FA (99% case)
+        if (!$this->session->exists(self::SESSION_UID_KEY)) {
+
+            // Check if the session tells us it is 2FA authenticated already
+            if ($this->session->exists(self::SESSION_UID_DONE) &&
+                $this->session->get(self::SESSION_UID_DONE) === $user->getUID()) {
+                return false;
+            }
+
+            /*
 			 * If the session is expired check if we are not logged in by a token
 			 * that still needs 2FA auth
 			 */
-			try {
-				$sessionId = $this->session->getId();
-				$token = $this->tokenProvider->getToken($sessionId);
-				$tokenId = $token->getId();
-				$tokensNeeding2FA = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
-
-				if (!\in_array($tokenId, $tokensNeeding2FA, true)) {
-					$this->session->set(self::SESSION_UID_DONE, $user->getUID());
-					return false;
-				}
-			} catch (InvalidTokenException $e) {
-			}
-		}
-
-		if (!$this->isTwoFactorAuthenticated($user)) {
-			// There is no second factor any more -> let the user pass
-			//   This prevents infinite redirect loops when a user is about
-			//   to solve the 2FA challenge, and the provider app is
-			//   disabled the same time
-			$this->session->remove(self::SESSION_UID_KEY);
-
-			$keys = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
-			foreach ($keys as $key) {
-				$this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $key);
-			}
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * Prepare the 2FA login
-	 *
-	 * @param IUser $user
-	 * @param boolean $rememberMe
-	 */
-	public function prepareTwoFactorLogin(IUser $user, bool $rememberMe) {
-		$this->session->set(self::SESSION_UID_KEY, $user->getUID());
-		$this->session->set(self::REMEMBER_LOGIN, $rememberMe);
-
-		$id = $this->session->getId();
-		$token = $this->tokenProvider->getToken($id);
-		$this->config->setUserValue($user->getUID(), 'login_token_2fa', $token->getId(), $this->timeFactory->getTime());
-	}
-
-	public function clearTwoFactorPending(string $userId) {
-		$tokensNeeding2FA = $this->config->getUserKeys($userId, 'login_token_2fa');
-
-		foreach ($tokensNeeding2FA as $tokenId) {
-			$this->tokenProvider->invalidateTokenById($userId, $tokenId);
-		}
-	}
+            try {
+                $sessionId = $this->session->getId();
+                $token = $this->tokenProvider->getToken($sessionId);
+                $tokenId = $token->getId();
+                $tokensNeeding2FA = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
+
+                if (!\in_array($tokenId, $tokensNeeding2FA, true)) {
+                    $this->session->set(self::SESSION_UID_DONE, $user->getUID());
+                    return false;
+                }
+            } catch (InvalidTokenException $e) {
+            }
+        }
+
+        if (!$this->isTwoFactorAuthenticated($user)) {
+            // There is no second factor any more -> let the user pass
+            //   This prevents infinite redirect loops when a user is about
+            //   to solve the 2FA challenge, and the provider app is
+            //   disabled the same time
+            $this->session->remove(self::SESSION_UID_KEY);
+
+            $keys = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
+            foreach ($keys as $key) {
+                $this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $key);
+            }
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Prepare the 2FA login
+     *
+     * @param IUser $user
+     * @param boolean $rememberMe
+     */
+    public function prepareTwoFactorLogin(IUser $user, bool $rememberMe) {
+        $this->session->set(self::SESSION_UID_KEY, $user->getUID());
+        $this->session->set(self::REMEMBER_LOGIN, $rememberMe);
+
+        $id = $this->session->getId();
+        $token = $this->tokenProvider->getToken($id);
+        $this->config->setUserValue($user->getUID(), 'login_token_2fa', $token->getId(), $this->timeFactory->getTime());
+    }
+
+    public function clearTwoFactorPending(string $userId) {
+        $tokensNeeding2FA = $this->config->getUserKeys($userId, 'login_token_2fa');
+
+        foreach ($tokensNeeding2FA as $tokenId) {
+            $this->tokenProvider->invalidateTokenById($userId, $tokenId);
+        }
+    }
 }

lib/private/Authentication/Token/DefaultTokenProvider.php

Indentation +306 added lines, -306 removed lines

@@ -44,310 +44,310 @@
 
 class DefaultTokenProvider implements IProvider {
 
-	/** @var DefaultTokenMapper */
-	private $mapper;
-
-	/** @var ICrypto */
-	private $crypto;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var ITimeFactory */
-	private $time;
-
-	public function __construct(DefaultTokenMapper $mapper,
-								ICrypto $crypto,
-								IConfig $config,
-								LoggerInterface $logger,
-								ITimeFactory $time) {
-		$this->mapper = $mapper;
-		$this->crypto = $crypto;
-		$this->config = $config;
-		$this->logger = $logger;
-		$this->time = $time;
-	}
-
-	/**
-	 * Create and persist a new token
-	 *
-	 * @param string $token
-	 * @param string $uid
-	 * @param string $loginName
-	 * @param string|null $password
-	 * @param string $name
-	 * @param int $type token type
-	 * @param int $remember whether the session token should be used for remember-me
-	 * @return IToken
-	 */
-	public function generateToken(string $token,
-								  string $uid,
-								  string $loginName,
-								  $password,
-								  string $name,
-								  int $type = IToken::TEMPORARY_TOKEN,
-								  int $remember = IToken::DO_NOT_REMEMBER): IToken {
-		$dbToken = new DefaultToken();
-		$dbToken->setUid($uid);
-		$dbToken->setLoginName($loginName);
-		if (!is_null($password)) {
-			$dbToken->setPassword($this->encryptPassword($password, $token));
-		}
-		$dbToken->setName($name);
-		$dbToken->setToken($this->hashToken($token));
-		$dbToken->setType($type);
-		$dbToken->setRemember($remember);
-		$dbToken->setLastActivity($this->time->getTime());
-		$dbToken->setLastCheck($this->time->getTime());
-		$dbToken->setVersion(DefaultToken::VERSION);
-
-		$this->mapper->insert($dbToken);
-
-		return $dbToken;
-	}
-
-	/**
-	 * Save the updated token
-	 *
-	 * @param IToken $token
-	 * @throws InvalidTokenException
-	 */
-	public function updateToken(IToken $token) {
-		if (!($token instanceof DefaultToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-		$this->mapper->update($token);
-	}
-
-	/**
-	 * Update token activity timestamp
-	 *
-	 * @throws InvalidTokenException
-	 * @param IToken $token
-	 */
-	public function updateTokenActivity(IToken $token) {
-		if (!($token instanceof DefaultToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-		/** @var DefaultToken $token */
-		$now = $this->time->getTime();
-		if ($token->getLastActivity() < ($now - 60)) {
-			// Update token only once per minute
-			$token->setLastActivity($now);
-			$this->mapper->update($token);
-		}
-	}
-
-	public function getTokenByUser(string $uid): array {
-		return $this->mapper->getTokenByUser($uid);
-	}
-
-	/**
-	 * Get a token by token
-	 *
-	 * @param string $tokenId
-	 * @throws InvalidTokenException
-	 * @throws ExpiredTokenException
-	 * @return IToken
-	 */
-	public function getToken(string $tokenId): IToken {
-		try {
-			$token = $this->mapper->getToken($this->hashToken($tokenId));
-		} catch (DoesNotExistException $ex) {
-			throw new InvalidTokenException("Token does not exist", 0, $ex);
-		}
-
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
-			throw new ExpiredTokenException($token);
-		}
-
-		return $token;
-	}
-
-	/**
-	 * Get a token by token id
-	 *
-	 * @param int $tokenId
-	 * @throws InvalidTokenException
-	 * @throws ExpiredTokenException
-	 * @return IToken
-	 */
-	public function getTokenById(int $tokenId): IToken {
-		try {
-			$token = $this->mapper->getTokenById($tokenId);
-		} catch (DoesNotExistException $ex) {
-			throw new InvalidTokenException("Token with ID $tokenId does not exist", 0, $ex);
-		}
-
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
-			throw new ExpiredTokenException($token);
-		}
-
-		return $token;
-	}
-
-	/**
-	 * @param string $oldSessionId
-	 * @param string $sessionId
-	 * @throws InvalidTokenException
-	 * @return IToken
-	 */
-	public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
-		$token = $this->getToken($oldSessionId);
-
-		$newToken = new DefaultToken();
-		$newToken->setUid($token->getUID());
-		$newToken->setLoginName($token->getLoginName());
-		if (!is_null($token->getPassword())) {
-			$password = $this->decryptPassword($token->getPassword(), $oldSessionId);
-			$newToken->setPassword($this->encryptPassword($password, $sessionId));
-		}
-		$newToken->setName($token->getName());
-		$newToken->setToken($this->hashToken($sessionId));
-		$newToken->setType(IToken::TEMPORARY_TOKEN);
-		$newToken->setRemember($token->getRemember());
-		$newToken->setLastActivity($this->time->getTime());
-		$this->mapper->insert($newToken);
-		$this->mapper->delete($token);
-
-		return $newToken;
-	}
-
-	/**
-	 * @param IToken $savedToken
-	 * @param string $tokenId session token
-	 * @throws InvalidTokenException
-	 * @throws PasswordlessTokenException
-	 * @return string
-	 */
-	public function getPassword(IToken $savedToken, string $tokenId): string {
-		$password = $savedToken->getPassword();
-		if (is_null($password)) {
-			throw new PasswordlessTokenException();
-		}
-		return $this->decryptPassword($password, $tokenId);
-	}
-
-	/**
-	 * Encrypt and set the password of the given token
-	 *
-	 * @param IToken $token
-	 * @param string $tokenId
-	 * @param string $password
-	 * @throws InvalidTokenException
-	 */
-	public function setPassword(IToken $token, string $tokenId, string $password) {
-		if (!($token instanceof DefaultToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-		/** @var DefaultToken $token */
-		$token->setPassword($this->encryptPassword($password, $tokenId));
-		$this->mapper->update($token);
-	}
-
-	/**
-	 * Invalidate (delete) the given session token
-	 *
-	 * @param string $token
-	 */
-	public function invalidateToken(string $token) {
-		$this->mapper->invalidate($this->hashToken($token));
-	}
-
-	public function invalidateTokenById(string $uid, int $id) {
-		$this->mapper->deleteById($uid, $id);
-	}
-
-	/**
-	 * Invalidate (delete) old session tokens
-	 */
-	public function invalidateOldTokens() {
-		$olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
-		$this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
-		$this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
-		$rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
-		$this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
-		$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
-	}
-
-	/**
-	 * Rotate the token. Usefull for for example oauth tokens
-	 *
-	 * @param IToken $token
-	 * @param string $oldTokenId
-	 * @param string $newTokenId
-	 * @return IToken
-	 */
-	public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
-		try {
-			$password = $this->getPassword($token, $oldTokenId);
-			$token->setPassword($this->encryptPassword($password, $newTokenId));
-		} catch (PasswordlessTokenException $e) {
-		}
-
-		$token->setToken($this->hashToken($newTokenId));
-		$this->updateToken($token);
-
-		return $token;
-	}
-
-	/**
-	 * @param string $token
-	 * @return string
-	 */
-	private function hashToken(string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		return hash('sha512', $token . $secret);
-	}
-
-	/**
-	 * Encrypt the given password
-	 *
-	 * The token is used as key
-	 *
-	 * @param string $password
-	 * @param string $token
-	 * @return string encrypted password
-	 */
-	private function encryptPassword(string $password, string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		return $this->crypto->encrypt($password, $token . $secret);
-	}
-
-	/**
-	 * Decrypt the given password
-	 *
-	 * The token is used as key
-	 *
-	 * @param string $password
-	 * @param string $token
-	 * @throws InvalidTokenException
-	 * @return string the decrypted key
-	 */
-	private function decryptPassword(string $password, string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		try {
-			return $this->crypto->decrypt($password, $token . $secret);
-		} catch (Exception $ex) {
-			// Delete the invalid token
-			$this->invalidateToken($token);
-			throw new InvalidTokenException("Can not decrypt token password: " . $ex->getMessage(), 0, $ex);
-		}
-	}
-
-	public function markPasswordInvalid(IToken $token, string $tokenId) {
-		if (!($token instanceof DefaultToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		//No need to mark as invalid. We just invalide default tokens
-		$this->invalidateToken($tokenId);
-	}
-
-	public function updatePasswords(string $uid, string $password) {
-		// Nothing to do here
-	}
+    /** @var DefaultTokenMapper */
+    private $mapper;
+
+    /** @var ICrypto */
+    private $crypto;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    /** @var ITimeFactory */
+    private $time;
+
+    public function __construct(DefaultTokenMapper $mapper,
+                                ICrypto $crypto,
+                                IConfig $config,
+                                LoggerInterface $logger,
+                                ITimeFactory $time) {
+        $this->mapper = $mapper;
+        $this->crypto = $crypto;
+        $this->config = $config;
+        $this->logger = $logger;
+        $this->time = $time;
+    }
+
+    /**
+     * Create and persist a new token
+     *
+     * @param string $token
+     * @param string $uid
+     * @param string $loginName
+     * @param string|null $password
+     * @param string $name
+     * @param int $type token type
+     * @param int $remember whether the session token should be used for remember-me
+     * @return IToken
+     */
+    public function generateToken(string $token,
+                                    string $uid,
+                                    string $loginName,
+                                    $password,
+                                    string $name,
+                                    int $type = IToken::TEMPORARY_TOKEN,
+                                    int $remember = IToken::DO_NOT_REMEMBER): IToken {
+        $dbToken = new DefaultToken();
+        $dbToken->setUid($uid);
+        $dbToken->setLoginName($loginName);
+        if (!is_null($password)) {
+            $dbToken->setPassword($this->encryptPassword($password, $token));
+        }
+        $dbToken->setName($name);
+        $dbToken->setToken($this->hashToken($token));
+        $dbToken->setType($type);
+        $dbToken->setRemember($remember);
+        $dbToken->setLastActivity($this->time->getTime());
+        $dbToken->setLastCheck($this->time->getTime());
+        $dbToken->setVersion(DefaultToken::VERSION);
+
+        $this->mapper->insert($dbToken);
+
+        return $dbToken;
+    }
+
+    /**
+     * Save the updated token
+     *
+     * @param IToken $token
+     * @throws InvalidTokenException
+     */
+    public function updateToken(IToken $token) {
+        if (!($token instanceof DefaultToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+        $this->mapper->update($token);
+    }
+
+    /**
+     * Update token activity timestamp
+     *
+     * @throws InvalidTokenException
+     * @param IToken $token
+     */
+    public function updateTokenActivity(IToken $token) {
+        if (!($token instanceof DefaultToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+        /** @var DefaultToken $token */
+        $now = $this->time->getTime();
+        if ($token->getLastActivity() < ($now - 60)) {
+            // Update token only once per minute
+            $token->setLastActivity($now);
+            $this->mapper->update($token);
+        }
+    }
+
+    public function getTokenByUser(string $uid): array {
+        return $this->mapper->getTokenByUser($uid);
+    }
+
+    /**
+     * Get a token by token
+     *
+     * @param string $tokenId
+     * @throws InvalidTokenException
+     * @throws ExpiredTokenException
+     * @return IToken
+     */
+    public function getToken(string $tokenId): IToken {
+        try {
+            $token = $this->mapper->getToken($this->hashToken($tokenId));
+        } catch (DoesNotExistException $ex) {
+            throw new InvalidTokenException("Token does not exist", 0, $ex);
+        }
+
+        if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+            throw new ExpiredTokenException($token);
+        }
+
+        return $token;
+    }
+
+    /**
+     * Get a token by token id
+     *
+     * @param int $tokenId
+     * @throws InvalidTokenException
+     * @throws ExpiredTokenException
+     * @return IToken
+     */
+    public function getTokenById(int $tokenId): IToken {
+        try {
+            $token = $this->mapper->getTokenById($tokenId);
+        } catch (DoesNotExistException $ex) {
+            throw new InvalidTokenException("Token with ID $tokenId does not exist", 0, $ex);
+        }
+
+        if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+            throw new ExpiredTokenException($token);
+        }
+
+        return $token;
+    }
+
+    /**
+     * @param string $oldSessionId
+     * @param string $sessionId
+     * @throws InvalidTokenException
+     * @return IToken
+     */
+    public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
+        $token = $this->getToken($oldSessionId);
+
+        $newToken = new DefaultToken();
+        $newToken->setUid($token->getUID());
+        $newToken->setLoginName($token->getLoginName());
+        if (!is_null($token->getPassword())) {
+            $password = $this->decryptPassword($token->getPassword(), $oldSessionId);
+            $newToken->setPassword($this->encryptPassword($password, $sessionId));
+        }
+        $newToken->setName($token->getName());
+        $newToken->setToken($this->hashToken($sessionId));
+        $newToken->setType(IToken::TEMPORARY_TOKEN);
+        $newToken->setRemember($token->getRemember());
+        $newToken->setLastActivity($this->time->getTime());
+        $this->mapper->insert($newToken);
+        $this->mapper->delete($token);
+
+        return $newToken;
+    }
+
+    /**
+     * @param IToken $savedToken
+     * @param string $tokenId session token
+     * @throws InvalidTokenException
+     * @throws PasswordlessTokenException
+     * @return string
+     */
+    public function getPassword(IToken $savedToken, string $tokenId): string {
+        $password = $savedToken->getPassword();
+        if (is_null($password)) {
+            throw new PasswordlessTokenException();
+        }
+        return $this->decryptPassword($password, $tokenId);
+    }
+
+    /**
+     * Encrypt and set the password of the given token
+     *
+     * @param IToken $token
+     * @param string $tokenId
+     * @param string $password
+     * @throws InvalidTokenException
+     */
+    public function setPassword(IToken $token, string $tokenId, string $password) {
+        if (!($token instanceof DefaultToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+        /** @var DefaultToken $token */
+        $token->setPassword($this->encryptPassword($password, $tokenId));
+        $this->mapper->update($token);
+    }
+
+    /**
+     * Invalidate (delete) the given session token
+     *
+     * @param string $token
+     */
+    public function invalidateToken(string $token) {
+        $this->mapper->invalidate($this->hashToken($token));
+    }
+
+    public function invalidateTokenById(string $uid, int $id) {
+        $this->mapper->deleteById($uid, $id);
+    }
+
+    /**
+     * Invalidate (delete) old session tokens
+     */
+    public function invalidateOldTokens() {
+        $olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
+        $this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
+        $this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
+        $rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+        $this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
+        $this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
+    }
+
+    /**
+     * Rotate the token. Usefull for for example oauth tokens
+     *
+     * @param IToken $token
+     * @param string $oldTokenId
+     * @param string $newTokenId
+     * @return IToken
+     */
+    public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
+        try {
+            $password = $this->getPassword($token, $oldTokenId);
+            $token->setPassword($this->encryptPassword($password, $newTokenId));
+        } catch (PasswordlessTokenException $e) {
+        }
+
+        $token->setToken($this->hashToken($newTokenId));
+        $this->updateToken($token);
+
+        return $token;
+    }
+
+    /**
+     * @param string $token
+     * @return string
+     */
+    private function hashToken(string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        return hash('sha512', $token . $secret);
+    }
+
+    /**
+     * Encrypt the given password
+     *
+     * The token is used as key
+     *
+     * @param string $password
+     * @param string $token
+     * @return string encrypted password
+     */
+    private function encryptPassword(string $password, string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        return $this->crypto->encrypt($password, $token . $secret);
+    }
+
+    /**
+     * Decrypt the given password
+     *
+     * The token is used as key
+     *
+     * @param string $password
+     * @param string $token
+     * @throws InvalidTokenException
+     * @return string the decrypted key
+     */
+    private function decryptPassword(string $password, string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        try {
+            return $this->crypto->decrypt($password, $token . $secret);
+        } catch (Exception $ex) {
+            // Delete the invalid token
+            $this->invalidateToken($token);
+            throw new InvalidTokenException("Can not decrypt token password: " . $ex->getMessage(), 0, $ex);
+        }
+    }
+
+    public function markPasswordInvalid(IToken $token, string $tokenId) {
+        if (!($token instanceof DefaultToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        //No need to mark as invalid. We just invalide default tokens
+        $this->invalidateToken($tokenId);
+    }
+
+    public function updatePasswords(string $uid, string $password) {
+        // Nothing to do here
+    }
 }