SubsonicMiddleware::afterException() - Code Metrics - Inspection of "Subsonic/Ampache: Add cache headers to the cover a..." - owncloud/music - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( d62d52...23afda )

by Pauli

created 2025-03-01 18:11 UTC

SubsonicMiddleware::afterException() A

↳ Parent: SubsonicMiddleware

Complexity

Conditions	4
Paths	4

Size

Total Lines	13
Code Lines	9

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	4
eloc	9
nc	4
nop	3
dl	0
loc	13
rs	9.9666
c	0
b	0
f	0

<?php declare(strict_types=1);

/**
 * ownCloud - Music app
 *
 * This file is licensed under the Affero General Public License version 3 or
 * later. See the COPYING file.
 *
 * @author Pauli Järvinen <[email protected]>
 * @copyright Pauli Järvinen 2019 - 2025
 */

namespace OCA\Music\Middleware;

use OCP\IRequest;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Response;
use OCP\AppFramework\Middleware;

use OCA\Music\AppFramework\BusinessLayer\BusinessLayerException;
use OCA\Music\AppFramework\Core\Logger;
use OCA\Music\Controller\SubsonicController;
use OCA\Music\Db\AmpacheUserMapper;
use OCA\Music\Utility\Util;

/**
 * Checks the authentication on each Subsonic API call before the
 * request is allowed to be passed to SubsonicController.
 * Map SubsonicExceptions from the controller to proper Subsonic error results.
 */
class SubsonicMiddleware extends Middleware {
	private IRequest $request;
	private AmpacheUserMapper $userMapper;
	private Logger $logger;

	public function __construct(IRequest $request, AmpacheUserMapper $userMapper, Logger $logger) {
		$this->request = $request;
		$this->userMapper = $userMapper;
		$this->logger = $logger;
	}

	/**
	 * This function is run before any HTTP request handler method, but it does
	 * nothing if the call in question is not routed to SubsonicController. In
	 * case of Subsonic call, this checks the user authentication.
	 *
	 * NOTE: Type declarations cannot be used on this function signature because that would be
	 * in conflict with the base class which is not in our hands.
	 *
	 * @param Controller $controller the controller that is being called
	 * @param string $methodName the name of the method
	 * @throws SubsonicException when a security check fails
	 */
	public function beforeController($controller, $methodName) {
		if ($controller instanceof SubsonicController) {
			$this->setupResponseFormat($controller);
			$this->checkAuthentication($controller);
		}
	}

	/**
	 * Evaluate the response format parameters and setup the controller to use
	 * the requested format
	 * @param SubsonicController $controller
	 * @throws SubsonicException
	 */
	private function setupResponseFormat(SubsonicController $controller) {
		$format = $this->request->getParam('f', 'xml');
		$callback = $this->request->getParam('callback');

		if (!\in_array($format, ['json', 'xml', 'jsonp'])) {
			throw new SubsonicException("Unsupported format $format", 0);
		}

		if ($format === 'jsonp' && empty($callback)) {
			$format = 'xml';
			$this->logger->log("'jsonp' format requested but no arg 'callback' supplied, falling back to 'xml' format", 'debug');
		}

		$controller->setResponseFormat($format, $callback);
	}

	/**
	 * Check that valid credentials have been given.
	 * Setup the controller with the active user if the authentication is ok.
	 * @param SubsonicController $controller
	 * @throws SubsonicException
	 */
	private function checkAuthentication(SubsonicController $controller) {
		if ($this->request->getParam('t') !== null) {
			throw new SubsonicException('Token-based authentication not supported', 41);
		}

		$user = $this->request->getParam('u');
		$apiKey = $this->request->getParam('apiKey');

		if ($user !== null && $apiKey !== null) {
			throw new SubsonicException('Multiple conflicting authentication mechanisms provided', 43);
		}
		else if ($apiKey !== null) {
			$credentials = $this->userAndKeyIdForPass($apiKey);
			if ($credentials !== null) {
				$controller->setAuthenticatedUser($credentials['user_id'], $credentials['key_id']);
			} else {
				throw new SubsonicException('Invalid API key', 44);
			}
		}
		else if ($user !== null) {
			$pass = $this->request->getParam('p');
			if ($pass === null) {
				throw new SubsonicException('Password argument `p` missing', 10);
			}

			// The password may be given in hexadecimal format
			if (Util::startsWith($pass, 'enc:')) {
				$pass = \hex2bin(\substr($pass, \strlen('enc:')));
			}

			$credentials = $this->userAndKeyIdForPass($pass);
			if (Util::stringCaseCompare($user, $credentials['user_id']) === 0) {
				$controller->setAuthenticatedUser($credentials['user_id'], $credentials['key_id']);
			} else {
				throw new SubsonicException('Wrong username or password', 40);
			}
		}
		else {
			// Not passing any credentials is allowed since some parts of the API are allowed without authentication.
			// SubsonicController::handleRequest needs to check that there is an authenticated user if needed.
		}
	}

	/**
	 * @param string $pass Password aka API key
	 * @return ?array like ['key_id' => int, 'user_id' => string] or null if $pass was not valid
	 */
	private function userAndKeyIdForPass(string $pass) : ?array {
		$hash = \hash('sha256', $pass);
		return $this->userMapper->getUserByPasswordHash($hash);
	}

	/**
	 * Catch SubsonicException and BusinessLayerException instances thrown when handling
	 * Subsonic requests, and render the the appropriate Subsonic error response. Any other
	 * exceptions are allowed to flow through, reaching eventually the default handler if
	 * no-one else intercepts them. The default handler logs the error and returns response
	 * code 500.
	 *
	 * NOTE: Type declarations cannot be used on this function signature because that would be
	 * in conflict with the base class which is not in our hands.
	 *
	 * @param Controller $controller the controller that was being called
	 * @param string $methodName the name of the method that was called on the controller
	 * @param \Exception $exception the thrown exception
	 * @throws \Exception the passed in exception if it couldn't be handled
	 * @return Response a Response object in case the exception could be handled
	 */
	public function afterException($controller, $methodName, \Exception $exception) {
		if ($controller instanceof SubsonicController) {
			if ($exception instanceof SubsonicException) {
				$this->logger->log($exception->getMessage(), 'debug');
				return $controller->subsonicErrorResponse(
						$exception->getCode(),
						$exception->getMessage()
				);
			} elseif ($exception instanceof BusinessLayerException) {
				return $controller->subsonicErrorResponse(70, 'Entity not found');
			}
		}
		throw $exception;
	}
}


1			<?php declare(strict_types=1);
2
3			/**
4			* ownCloud - Music app
5			*
6			* This file is licensed under the Affero General Public License version 3 or
7			* later. See the COPYING file.
8			*
9			* @author Pauli Järvinen <[email protected]>
10			* @copyright Pauli Järvinen 2019 - 2025
11			*/
12
13			namespace OCA\Music\Middleware;
14
15			use OCP\IRequest;
16			use OCP\AppFramework\Controller;
17			use OCP\AppFramework\Http\Response;
18			use OCP\AppFramework\Middleware;
19
20			use OCA\Music\AppFramework\BusinessLayer\BusinessLayerException;
21			use OCA\Music\AppFramework\Core\Logger;
22			use OCA\Music\Controller\SubsonicController;
23			use OCA\Music\Db\AmpacheUserMapper;
24			use OCA\Music\Utility\Util;
25
26			/**
27			* Checks the authentication on each Subsonic API call before the
28			* request is allowed to be passed to SubsonicController.
29			* Map SubsonicExceptions from the controller to proper Subsonic error results.
30			*/
31			class SubsonicMiddleware extends Middleware {
32			private IRequest $request;
33			private AmpacheUserMapper $userMapper;
34			private Logger $logger;
35
36			public function __construct(IRequest $request, AmpacheUserMapper $userMapper, Logger $logger) {
37			$this->request = $request;
38			$this->userMapper = $userMapper;
39			$this->logger = $logger;
40			}
41
42			/**
43			* This function is run before any HTTP request handler method, but it does
44			* nothing if the call in question is not routed to SubsonicController. In
45			* case of Subsonic call, this checks the user authentication.
46			*
47			* NOTE: Type declarations cannot be used on this function signature because that would be
48			* in conflict with the base class which is not in our hands.
49			*
50			* @param Controller $controller the controller that is being called
51			* @param string $methodName the name of the method
52			* @throws SubsonicException when a security check fails
53			*/
54			public function beforeController($controller, $methodName) {
55			if ($controller instanceof SubsonicController) {
56			$this->setupResponseFormat($controller);
57			$this->checkAuthentication($controller);
58			}
59			}
60
61			/**
62			* Evaluate the response format parameters and setup the controller to use
63			* the requested format
64			* @param SubsonicController $controller
65			* @throws SubsonicException
66			*/
67			private function setupResponseFormat(SubsonicController $controller) {
68			$format = $this->request->getParam('f', 'xml');
69			$callback = $this->request->getParam('callback');
70
71			if (!\in_array($format, ['json', 'xml', 'jsonp'])) {
72			throw new SubsonicException("Unsupported format $format", 0);
73			}
74
75			if ($format === 'jsonp' && empty($callback)) {
76			$format = 'xml';
77			$this->logger->log("'jsonp' format requested but no arg 'callback' supplied, falling back to 'xml' format", 'debug');
78			}
79
80			$controller->setResponseFormat($format, $callback);
81			}
82
83			/**
84			* Check that valid credentials have been given.
85			* Setup the controller with the active user if the authentication is ok.
86			* @param SubsonicController $controller
87			* @throws SubsonicException
88			*/
89			private function checkAuthentication(SubsonicController $controller) {
90			if ($this->request->getParam('t') !== null) {
91			throw new SubsonicException('Token-based authentication not supported', 41);
92			}
93
94			$user = $this->request->getParam('u');
95			$apiKey = $this->request->getParam('apiKey');
96
97			if ($user !== null && $apiKey !== null) {
98			throw new SubsonicException('Multiple conflicting authentication mechanisms provided', 43);
99			}
100			else if ($apiKey !== null) {
101			$credentials = $this->userAndKeyIdForPass($apiKey);
102			if ($credentials !== null) {
103			$controller->setAuthenticatedUser($credentials['user_id'], $credentials['key_id']);
104			} else {
105			throw new SubsonicException('Invalid API key', 44);
106			}
107			}
108			else if ($user !== null) {
109			$pass = $this->request->getParam('p');
110			if ($pass === null) {
111			throw new SubsonicException('Password argument `p` missing', 10);
112			}
113
114			// The password may be given in hexadecimal format
115			if (Util::startsWith($pass, 'enc:')) {
116			$pass = \hex2bin(\substr($pass, \strlen('enc:')));
117			}
118
119			$credentials = $this->userAndKeyIdForPass($pass);
120			if (Util::stringCaseCompare($user, $credentials['user_id']) === 0) {
121			$controller->setAuthenticatedUser($credentials['user_id'], $credentials['key_id']);
122			} else {
123			throw new SubsonicException('Wrong username or password', 40);
124			}
125			}
126			else {
127			// Not passing any credentials is allowed since some parts of the API are allowed without authentication.
128			// SubsonicController::handleRequest needs to check that there is an authenticated user if needed.
129			}
130			}
131
132			/**
133			* @param string $pass Password aka API key
134			* @return ?array like ['key_id' => int, 'user_id' => string] or null if $pass was not valid
135			*/
136			private function userAndKeyIdForPass(string $pass) : ?array {
137			$hash = \hash('sha256', $pass);
138			return $this->userMapper->getUserByPasswordHash($hash);
139			}
140
141			/**
142			* Catch SubsonicException and BusinessLayerException instances thrown when handling
143			* Subsonic requests, and render the the appropriate Subsonic error response. Any other
144			* exceptions are allowed to flow through, reaching eventually the default handler if
145			* no-one else intercepts them. The default handler logs the error and returns response
146			* code 500.
147			*
148			* NOTE: Type declarations cannot be used on this function signature because that would be
149			* in conflict with the base class which is not in our hands.
150			*
151			* @param Controller $controller the controller that was being called
152			* @param string $methodName the name of the method that was called on the controller
153			* @param \Exception $exception the thrown exception
154			* @throws \Exception the passed in exception if it couldn't be handled
155			* @return Response a Response object in case the exception could be handled
156			*/
157			public function afterException($controller, $methodName, \Exception $exception) {
158			if ($controller instanceof SubsonicController) {
159			if ($exception instanceof SubsonicException) {
160			$this->logger->log($exception->getMessage(), 'debug');
161			return $controller->subsonicErrorResponse(
162			$exception->getCode(),
163			$exception->getMessage()
164			);
165			} elseif ($exception instanceof BusinessLayerException) {
166			return $controller->subsonicErrorResponse(70, 'Entity not found');
167			}
168			}
169			throw $exception;
170			}
171			}
172

owncloud / music

Push — master ( d62d52...23afda )

SubsonicMiddleware::afterException() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like