Cortex\Auth\Traits\TwoFactorAuthenticatesUsers

Complexity

Total Complexity

11

Size/Duplication

Total Lines	85
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	1

Importance

Changes

0

5 Methods

Rating	Name	Duplication	Size	Complexity
A	attemptTwoFactor()	0	4	3
A	invalidateTwoFactorBackup()	0	12	1
A	isValidTwoFactorPhone()	0	7	2
A	isValidTwoFactorBackup()	0	8	3
A	isValidTwoFactorTotp()	0	7	2

<?php

declare(strict_types=1);

namespace Cortex\Auth\Traits;

use PragmaRX\Google2FA\Google2FA;
use Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract;

trait TwoFactorAuthenticatesUsers
{
    /**
     * Verify TwoFactor authentication.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function attemptTwoFactor(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        return $this->isValidTwoFactorTotp($user, $token) || $this->isValidTwoFactorBackup($user, $token) || $this->isValidTwoFactorPhone($user, $token);
    }

    /**
     * Invalidate given backup code for the given user.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return void
     */
    protected function invalidateTwoFactorBackup(AuthenticatableTwoFactorContract $user, int $token): void
    {
        $settings = $user->getTwoFactor();
        $backup = array_get($settings, 'totp.backup');

It seems like $settings defined by $user->getTwoFactor() on line 35 can also be of type null; however, array_get() does only seem to accept object<ArrayAccess>|array, maybe add an additional type check?

The function array_get() has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0.

        unset($backup[array_search($token, $backup)]);

        array_set($settings, 'totp.backup', $backup);

It seems like $settings defined by $user->getTwoFactor() on line 35 can also be of type null; however, array_set() does only seem to accept array, maybe add an additional type check?

The function array_set() has been deprecated with message: Arr::set() should be used directly instead. Will be removed in Laravel 6.0.

        // Update TwoFactor OTP backup codes
        $user->fill(['two_factor' => $settings])->forceSave();
    }

    /**
     * Determine if the given token is a valid TwoFactor Phone token.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function isValidTwoFactorPhone(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        $settings = $user->getTwoFactor();
        $authyId = array_get($settings, 'phone.authy_id');

It seems like $settings defined by $user->getTwoFactor() on line 56 can also be of type null; however, array_get() does only seem to accept object<ArrayAccess>|array, maybe add an additional type check?

The function array_get() has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0.

        return in_array(mb_strlen($token), [6, 7, 8]) && app('rinvex.authy.token')->verify($token, $authyId)->succeed();
    }

    /**
     * Determine if the given token is a valid TwoFactor Backup code.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function isValidTwoFactorBackup(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        $backup = array_get($user->getTwoFactor(), 'totp.backup', []);

It seems like $user->getTwoFactor() targeting Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract::getTwoFactor() can also be of type null; however, array_get() does only seem to accept object<ArrayAccess>|array, maybe add an additional type check?

The function array_get() has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0.

        $result = mb_strlen($token) === 10 && in_array($token, $backup);
        ! $result || $this->invalidateTwoFactorBackup($user, $token);

        return $result;
    }

    /**
     * Determine if the given token is a valid TwoFactor TOTP token.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function isValidTwoFactorTotp(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        $totpProvider = app(Google2FA::class);
        $secret = array_get($user->getTwoFactor(), 'totp.secret');

It seems like $user->getTwoFactor() targeting Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract::getTwoFactor() can also be of type null; however, array_get() does only seem to accept object<ArrayAccess>|array, maybe add an additional type check?

The function array_get() has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0.

        return mb_strlen($token) === 6 && $totpProvider->verifyKey($secret, $token);
    }
}