VerificationController::verifyhash() - Code Metrics - Inspection of "Moved things around a bit." - phptek/silverstripe-verifiable - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 2ce6bc...9c94e5 )

by Russell

created 2018-06-14 10:01 UTC

VerificationController::verifyhash() C

↳ Parent: VerificationController

Complexity

Conditions	8
Paths	4

Size

Total Lines	29
Code Lines	19

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	8
eloc	19
nc	4
nop	1
dl	0
loc	29
rs	5.3846
c	0
b	0
f	0

<?php

/**
 * @author  Russell Michell 2018 <[email protected]>
 * @package silverstripe-verifiable
 */

namespace PhpTek\Verifiable\Controller;

use SilverStripe\Control\Controller;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Versioned\Versioned;

/**
 * Accepts incoming requests for data verification e.g. from within the CMS
 * or framework's admin area, and sends them on their way.
 *
 * Will proxy validation requests to the currently configured backend for both
 * {@link SiteTree} and {@link DataObject} subclasses.
 */
class VerificationController extends Controller
{
    /**
     * Represents a failed verification.
     *
     * @var string
     */
    const STATUS_FAILURE = 'FAIL';

    /**
     * Represents a passed verification.
     *
     * @var string
     */
    const STATUS_PASSED = 'PASS';

    /**
     * Represents a pending verification.
     *
     * @var string
     */
    const STATUS_PENDING = 'PENDING';

    /**
     * @var array
     */
    private static $allowed_actions = [

        'verifyhash',
    ];

    /**
     * Responds to URIs of the following prototype: /verifiable/verify/<model>/<ID>/<VID>
     * by echoing a JSON response for consumption by client-side logic.
     *
     * Also provides x2 extension points, both of which are passed a copy of
     * the contents of the managed record's "Proof" {@link ChainpointProof} "Proof"
     * field, an indirect {@link DBField} subclass.
     *
     * - onBeforeVerify()
     * - onAfterVerify()
     *
     * @param  HTTPRequest $request
     * @return void
     */
    public function verifyhash(HTTPRequest $request)
    {
        $class = $request->param('ClassName');
        $id = $request->param('ModelID');
        $vid = $request->param('VersionID');

        if (empty($id) || !is_numeric($id) ||
                empty($vid) || !is_numeric($vid) ||
                empty($class)) {
            return $this->httpError(400, 'Bad request');
        }

        if (!$record = $this->getVersionedRecord($class, $id, $vid)) {
        if (!$record = $this->getVersionedRecord($class, /** @scrutinizer ignore-type */ $id, $vid)) {
            return $this->httpError(400, 'Bad request');
        }

        if (!$record->getField('Proof')) {
            return $this->httpError(400, 'Bad request');
        }

        $response = json_encode([
            'RecordID' => "$record->RecordID",

            'Version' => "$record->Version",

            'Class' => get_class($record),
            'Submitted' => $record->dbObject('Proof')->getSubmittedAt(),
            'Submitted' => $record->dbObject('Proof')->/** @scrutinizer ignore-call */ getSubmittedAt(),
            'Status' => $this->getVerificationStatus($record),
        ], JSON_UNESCAPED_UNICODE);

        $this->renderJSON($response);
    }

    /**
     * Gives us the current verification status of the given record. Takes into
     * account the state of the saved proof as well as by making a backend
     * verification call.
     *
     * @param  StdClass $record

     * @return string
     * @todo What _is_ verification? That verifiable_fields data has NOT changed:
     *  1. If no full local proof: false
     *  2. If sending local proof to /verify fails: false, otherwise;
     *  3. Re-calculate hash
     *  4. Compare against local "Proof::hash()"
     *  5. Send hash-value to /proofs to see if we get a valid proof back
     *  6. Is Valid proof? Yes: Verified. No? Tampered-with
     */
    public function getVerificationStatus($record)
    {
        $hashToVerify = $this->verifiableService->hash($record->normaliseData()); // <-- Could have been tampered-with
        $hashToVerify = $this->verifiableService->hash($record->normaliseData()); // <-- Could have been tampered-with
        $hashIsVerified = $this->verifiableService->verify($hashToVerify);
        $proofData = $record->getField('Proof');
        $proofIsPartial = $this->verifiableService->proofIsPartial($proofData);
        $proofIsComplete = $this->verifiableService->proofIsComplete($proofData);

        switch (true) {
            case $proofIsComplete && !$hashIsVerified:
            default:
                return self::STATUS_FAILURE;
            case $proofIsPartial && !$hashIsVerified:
                return self::STATUS_PENDING;
            case $proofIsComplete && $proofIsVerified:

                return self::STATUS_PASS;

        }
    }

    /**
     * Fetch a record directly from the relevant table, for the given class
     * and ID.
     *
     * @param  string     $class   A fully-qualified PHP class name.
     * @param  int        $rid     The "RecordID" of the desired Versioned record.
     * @param  int        $version The "Version" of the desired Versioned record.
     * @return mixed null | DataObject
     * @todo Add an instanceof DataObject check to prevent "SiteTree" being passed for example
     */
    private function getVersionedRecord(string $class, int $id, int $vid)
    {
        return Versioned::get_version($class, $id, $vid);
    }

    /**
     * Properly return JSON, allowing consumers to render returned JSON correctly.
     *
     * @param  string $json
     * @return void
     */
    private function renderJSON(string $json)
    {
        header('Content-Type: application/json');

        echo $json;

        exit(0);

    }

}


phptek / silverstripe-verifiable

Push — master ( 2ce6bc...9c94e5 )

VerificationController::verifyhash() C

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like