SimpleSAML\SAML2\Assertion\Validation\ConstraintValidator\NotOnOrAfter

Complexity

Total Complexity

5

Size/Duplication

Total Lines	30
Duplicated Lines	0 %

Importance

Changes

0

2 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	3	1
A	validate()	0	12	4

<?php

declare(strict_types=1);

namespace SimpleSAML\SAML2\Assertion\Validation\ConstraintValidator;

use Beste\Clock;
use DateInterval;
use SimpleSAML\SAML2\Assertion\Validation\AssertionConstraintValidator;
use SimpleSAML\SAML2\Assertion\Validation\Result;
use SimpleSAML\SAML2\Utils;
use SimpleSAML\SAML2\XML\saml\Assertion;

class NotOnOrAfter implements AssertionConstraintValidator
{
    /** @var \Beste\Clock */
    private static Clock $clock;


    /**
     */
    public function __construct()
    {
        self::$clock = Utils::getContainer()->getClock();
    }


    /**
     * @param \SimpleSAML\SAML2\XML\saml\Assertion $assertion
     * @param \SimpleSAML\SAML2\Assertion\Validation\Result $result
     */
    public function validate(Assertion $assertion, Result $result): void
    {
        $conditions = $assertion->getConditions();
        if ($conditions !== null) {
            $notValidOnOrAfterTimestamp = $conditions->getNotOnOrAfter();
            $currentTime = self::$clock->now();
            if (
                ($notValidOnOrAfterTimestamp !== null) &&
                ($notValidOnOrAfterTimestamp <= ($currentTime->sub(new DateInterval('PT60S'))))
            ) {
                $result->addError(
                    'Received an assertion that has expired. Check clock synchronization on IdP and SP.',
                );
            }
        }
    }
}