Completed
Push — master ( 20a6e3...887da8 )
by Abdelrahman
04:09 queued 02:12
created

GenericHandler::lockout()   B

Complexity

Conditions 8
Paths 21

Size

Total Lines 24

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
dl 0
loc 24
rs 8.4444
c 0
b 0
f 0
cc 8
nc 21
nop 1
1
<?php
2
3
declare(strict_types=1);
4
5
namespace Cortex\Auth\Handlers;
6
7
use Illuminate\Auth\Events\Login;
8
use Illuminate\Auth\Events\Lockout;
9
use Illuminate\Auth\Events\Registered;
10
use Illuminate\Contracts\Events\Dispatcher;
11
use Illuminate\Contracts\Container\Container;
12
use Cortex\Auth\Notifications\RegistrationSuccessNotification;
13
use Cortex\Auth\Notifications\AuthenticationLockoutNotification;
14
15
class GenericHandler
16
{
17
    /**
18
     * The container instance.
19
     *
20
     * @var \Illuminate\Container\Container
21
     */
22
    protected $app;
23
24
    /**
25
     * Create a new GenericHandler instance.
26
     *
27
     * @param \Illuminate\Contracts\Container\Container $app
28
     */
29
    public function __construct(Container $app)
30
    {
31
        $this->app = $app;
0 ignored issues
show
Documentation Bug introduced by
$app is of type object<Illuminate\Contracts\Container\Container>, but the property $app was declared to be of type object<Illuminate\Container\Container>. Are you sure that you always receive this specific sub-class here, or does it make sense to add an instanceof check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a given class or a super-class is assigned to a property that is type hinted more strictly.

Either this assignment is in error or an instanceof check should be added for that assignment.

class Alien {}

class Dalek extends Alien {}

class Plot
{
    /** @var  Dalek */
    public $villain;
}

$alien = new Alien();
$plot = new Plot();
if ($alien instanceof Dalek) {
    $plot->villain = $alien;
}
Loading history...
32
    }
33
34
    /**
35
     * Register the listeners for the subscriber.
36
     *
37
     * @param \Illuminate\Contracts\Events\Dispatcher $dispatcher
38
     */
39
    public function subscribe(Dispatcher $dispatcher)
40
    {
41
        $dispatcher->listen(Login::class, __CLASS__.'@login');
42
        $dispatcher->listen(Lockout::class, __CLASS__.'@lockout');
43
        $dispatcher->listen(Registered::class, __CLASS__.'@registered');
44
    }
45
46
    /**
47
     * Listen to the authentication lockout event.
48
     *
49
     * @param \Illuminate\Auth\Events\Lockout $event
50
     *
51
     * @return void
52
     */
53
    public function lockout(Lockout $event): void
54
    {
55
        if (config('cortex.auth.emails.throttle_lockout')) {
56
            switch ($event->request->route('accessarea')) {
57
                case 'managerarea':
58
                    $model = app('cortex.auth.manager');
59
                    break;
60
                case 'adminarea':
61
                    $model = app('cortex.auth.admin');
62
                    break;
63
                case 'frontarea':
64
                case 'tenantarea':
65
                default:
66
                    $model = app('cortex.auth.member');
67
                    break;
68
            }
69
70
            $user = get_login_field($loginfield = $event->request->get('loginfield')) === 'email'
71
                ? $model::where('email', $loginfield)->first()
72
                : $model::where('username', $loginfield)->first();
73
74
            ! $user || $user->notify(new AuthenticationLockoutNotification($event->request->ip(), $event->request->server('HTTP_USER_AGENT')));
0 ignored issues
show
Bug introduced by
It seems like $event->request->server('HTTP_USER_AGENT') targeting Illuminate\Http\Concerns...actsWithInput::server() can also be of type array; however, Cortex\Auth\Notification...fication::__construct() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
Coding Style introduced by
This line exceeds maximum limit of 120 characters; contains 143 characters

Overly long lines are hard to read on any screen. Most code styles therefor impose a maximum limit on the number of characters in a line.

Loading history...
75
        }
76
    }
77
78
    /**
79
     * Listen to the authentication login event.
80
     *
81
     * @param \Illuminate\Auth\Events\Login $event
82
     *
83
     * @return void
84
     */
85
    public function login(Login $event): void
86
    {
87
        config('cortex.auth.persistence') !== 'single' || $event->user->sessions()->delete();
0 ignored issues
show
Bug introduced by
It seems like you code against a concrete implementation and not the interface Illuminate\Contracts\Auth\Authenticatable as the method sessions() does only exist in the following implementations of said interface: Cortex\Auth\Models\Admin, Cortex\Auth\Models\Guardian, Cortex\Auth\Models\Manager, Cortex\Auth\Models\Member, Cortex\Auth\Models\User.

Let’s take a look at an example:

interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}

In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different implementation of User which does not have a getDisplayName() method, the code will break.

Available Fixes

  1. Change the type-hint for the parameter:

    class AuthSystem
    {
        public function authenticate(MyUser $user) { /* ... */ }
    }
    
  2. Add an additional type-check:

    class AuthSystem
    {
        public function authenticate(User $user)
        {
            if ($user instanceof MyUser) {
                $this->logger->info(/** ... */);
            }
    
            // or alternatively
            if ( ! $user instanceof MyUser) {
                throw new \LogicException(
                    '$user must be an instance of MyUser, '
                   .'other instances are not supported.'
                );
            }
    
        }
    }
    
Note: PHP Analyzer uses reverse abstract interpretation to narrow down the types inside the if block in such a case.
  1. Add the method to the interface:

    interface User
    {
        /** @return string */
        public function getPassword();
    
        /** @return string */
        public function getDisplayName();
    }
    
Loading history...
88
    }
89
90
    /**
91
     * Listen to the register success event.
92
     *
93
     * @param \Illuminate\Auth\Events\Registered $event
94
     *
95
     * @return void
96
     */
97
    public function registered(Registered $event): void
98
    {
99
        ! config('cortex.auth.emails.welcome') || $event->user->notify(new RegistrationSuccessNotification());
0 ignored issues
show
Bug introduced by
It seems like you code against a concrete implementation and not the interface Illuminate\Contracts\Auth\Authenticatable as the method notify() does only exist in the following implementations of said interface: Cortex\Auth\Models\Admin, Cortex\Auth\Models\Manager, Cortex\Auth\Models\Member, Cortex\Auth\Models\User.

Let’s take a look at an example:

interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}

In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different implementation of User which does not have a getDisplayName() method, the code will break.

Available Fixes

  1. Change the type-hint for the parameter:

    class AuthSystem
    {
        public function authenticate(MyUser $user) { /* ... */ }
    }
    
  2. Add an additional type-check:

    class AuthSystem
    {
        public function authenticate(User $user)
        {
            if ($user instanceof MyUser) {
                $this->logger->info(/** ... */);
            }
    
            // or alternatively
            if ( ! $user instanceof MyUser) {
                throw new \LogicException(
                    '$user must be an instance of MyUser, '
                   .'other instances are not supported.'
                );
            }
    
        }
    }
    
Note: PHP Analyzer uses reverse abstract interpretation to narrow down the types inside the if block in such a case.
  1. Add the method to the interface:

    interface User
    {
        /** @return string */
        public function getPassword();
    
        /** @return string */
        public function getDisplayName();
    }
    
Loading history...
100
    }
101
}
102