TwoFactorAuthenticatesUsers::isValidTwoFactorTotp() - Code Metrics - rinvex/cortex-auth - Measure and Improve Code Quality continuously with Scrutinizer

isValidTwoFactorTotp() A
last analyzed 2019-09-03 21:54 UTC

↳ Parent: TwoFactorAuthenticatesUsers

Complexity

Conditions	2
Paths	2

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	7
rs	10
c	0
b	0
f	0
cc	2
nc	2
nop	2

<?php

declare(strict_types=1);

namespace Cortex\Auth\Traits;

use PragmaRX\Google2FA\Google2FA;
use Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract;

trait TwoFactorAuthenticatesUsers
{
    /**
     * Verify TwoFactor authentication.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function attemptTwoFactor(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        return $this->isValidTwoFactorTotp($user, $token) || $this->isValidTwoFactorBackup($user, $token) || $this->isValidTwoFactorPhone($user, $token);
    }

    /**
     * Invalidate given backup code for the given user.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return void
     */
    protected function invalidateTwoFactorBackup(AuthenticatableTwoFactorContract $user, int $token): void
    {
        $settings = $user->getTwoFactor();
        $backup = array_get($settings, 'totp.backup');
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        unset($backup[array_search($token, $backup)]);

        array_set($settings, 'totp.backup', $backup);
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        // Update TwoFactor OTP backup codes
        $user->fill(['two_factor' => $settings])->forceSave();
    }

    /**
     * Determine if the given token is a valid TwoFactor Phone token.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function isValidTwoFactorPhone(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        $settings = $user->getTwoFactor();
        $authyId = array_get($settings, 'phone.authy_id');
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

        return in_array(mb_strlen($token), [6, 7, 8]) && app('rinvex.authy.token')->verify($token, $authyId)->succeed();
    }

    /**
     * Determine if the given token is a valid TwoFactor Backup code.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function isValidTwoFactorBackup(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        $backup = array_get($user->getTwoFactor(), 'totp.backup', []);

        $result = mb_strlen($token) === 10 && in_array($token, $backup);
        ! $result || $this->invalidateTwoFactorBackup($user, $token);

        return $result;
    }

    /**
     * Determine if the given token is a valid TwoFactor TOTP token.
     *
     * @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
     * @param int                                                     $token
     *
     * @return bool
     */
    protected function isValidTwoFactorTotp(AuthenticatableTwoFactorContract $user, int $token): bool
    {
        $totpProvider = app(Google2FA::class);
        $secret = array_get($user->getTwoFactor(), 'totp.secret');


        return mb_strlen($token) === 6 && $totpProvider->verifyKey($secret, $token);
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace Cortex\Auth\Traits;
6
7			use PragmaRX\Google2FA\Google2FA;
8			use Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract;
9
10			trait TwoFactorAuthenticatesUsers
11			{
12			/**
13			* Verify TwoFactor authentication.
14			*
15			* @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
16			* @param int $token
17			*
18			* @return bool
19			*/
20			protected function attemptTwoFactor(AuthenticatableTwoFactorContract $user, int $token): bool
21			{
22			return $this->isValidTwoFactorTotp($user, $token) \|\| $this->isValidTwoFactorBackup($user, $token) \|\| $this->isValidTwoFactorPhone($user, $token);
23			}
24
25			/**
26			* Invalidate given backup code for the given user.
27			*
28			* @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
29			* @param int $token
30			*
31			* @return void
32			*/
33			protected function invalidateTwoFactorBackup(AuthenticatableTwoFactorContract $user, int $token): void
34			{
35			$settings = $user->getTwoFactor();
36			$backup = array_get($settings, 'totp.backup');
			0 ignored issues – show Bug introduced 2018-01-26 04:59 UTC by Report Bug Copy Issue Report It seems like `$settings` defined by `$user->getTwoFactor()` on line `35` can also be of type `null`; however, `array_get()` does only seem to accept `object<ArrayAccess>\|array`, maybe add an additional type check? If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /** * @return array\|string */ function returnsDifferentValues($x) { if ($x) { return 'foo'; } return array(); } $x = returnsDifferentValues($y); if (is_array($x)) { // $x is an array. } If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. Loading history... Deprecated Code introduced 2019-08-02 21:42 UTC by Report Bug Copy Issue Report The function `array_get()` has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0. This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
37
38			unset($backup[array_search($token, $backup)]);
39
40			array_set($settings, 'totp.backup', $backup);
			0 ignored issues – show Bug introduced 2018-01-26 04:59 UTC by Report Bug Copy Issue Report It seems like `$settings` defined by `$user->getTwoFactor()` on line `35` can also be of type `null`; however, `array_set()` does only seem to accept `array`, maybe add an additional type check? If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /** * @return array\|string */ function returnsDifferentValues($x) { if ($x) { return 'foo'; } return array(); } $x = returnsDifferentValues($y); if (is_array($x)) { // $x is an array. } If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. Loading history... Deprecated Code introduced 2019-08-02 21:42 UTC by Report Bug Copy Issue Report The function `array_set()` has been deprecated with message: Arr::set() should be used directly instead. Will be removed in Laravel 6.0. This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
41
42			// Update TwoFactor OTP backup codes
43			$user->fill(['two_factor' => $settings])->forceSave();
44			}
45
46			/**
47			* Determine if the given token is a valid TwoFactor Phone token.
48			*
49			* @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
50			* @param int $token
51			*
52			* @return bool
53			*/
54			protected function isValidTwoFactorPhone(AuthenticatableTwoFactorContract $user, int $token): bool
55			{
56			$settings = $user->getTwoFactor();
57			$authyId = array_get($settings, 'phone.authy_id');
			0 ignored issues – show Bug introduced 2018-01-26 04:59 UTC by Report Bug Copy Issue Report It seems like `$settings` defined by `$user->getTwoFactor()` on line `56` can also be of type `null`; however, `array_get()` does only seem to accept `object<ArrayAccess>\|array`, maybe add an additional type check? If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /** * @return array\|string */ function returnsDifferentValues($x) { if ($x) { return 'foo'; } return array(); } $x = returnsDifferentValues($y); if (is_array($x)) { // $x is an array. } If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. Loading history... Deprecated Code introduced 2019-08-02 21:42 UTC by Report Bug Copy Issue Report The function `array_get()` has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0. This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
58
59			return in_array(mb_strlen($token), [6, 7, 8]) && app('rinvex.authy.token')->verify($token, $authyId)->succeed();
60			}
61
62			/**
63			* Determine if the given token is a valid TwoFactor Backup code.
64			*
65			* @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
66			* @param int $token
67			*
68			* @return bool
69			*/
70			protected function isValidTwoFactorBackup(AuthenticatableTwoFactorContract $user, int $token): bool
71			{
72			$backup = array_get($user->getTwoFactor(), 'totp.backup', []);
			0 ignored issues – show Bug introduced 2018-02-17 19:31 UTC by Report Bug Copy Issue Report It seems like `$user->getTwoFactor()` targeting `Rinvex\Auth\Contracts\Au...ontract::getTwoFactor()` can also be of type `null`; however, `array_get()` does only seem to accept `object<ArrayAccess>\|array`, maybe add an additional type check? This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. Loading history... Deprecated Code introduced 2019-08-02 21:42 UTC by Report Bug Copy Issue Report The function `array_get()` has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0. This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
73			$result = mb_strlen($token) === 10 && in_array($token, $backup);
74			! $result \|\| $this->invalidateTwoFactorBackup($user, $token);
75
76			return $result;
77			}
78
79			/**
80			* Determine if the given token is a valid TwoFactor TOTP token.
81			*
82			* @param \Rinvex\Auth\Contracts\AuthenticatableTwoFactorContract $user
83			* @param int $token
84			*
85			* @return bool
86			*/
87			protected function isValidTwoFactorTotp(AuthenticatableTwoFactorContract $user, int $token): bool
88			{
89			$totpProvider = app(Google2FA::class);
90			$secret = array_get($user->getTwoFactor(), 'totp.secret');
			0 ignored issues – show Bug introduced 2018-02-17 19:31 UTC by Report Bug Copy Issue Report It seems like `$user->getTwoFactor()` targeting `Rinvex\Auth\Contracts\Au...ontract::getTwoFactor()` can also be of type `null`; however, `array_get()` does only seem to accept `object<ArrayAccess>\|array`, maybe add an additional type check? This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. Loading history... Deprecated Code introduced 2019-08-02 21:42 UTC by Report Bug Copy Issue Report The function `array_get()` has been deprecated with message: Arr::get() should be used directly instead. Will be removed in Laravel 6.0. This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
91
92			return mb_strlen($token) === 6 && $totpProvider->verifyKey($secret, $token);
93			}
94			}
95

rinvex / cortex-auth

isValidTwoFactorTotp() A last analyzed 2019-09-03 21:54 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

isValidTwoFactorTotp() A
last analyzed 2019-09-03 21:54 UTC