Spiral\Http\Cookies\CookieManager

Complexity

Total Complexity

22

Size/Duplication

Total Lines	202
Duplicated Lines	10.89 %

Coupling/Cohesion

Components	1
Dependencies	8

Importance

Changes

0

9 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	5	1
A	__invoke()	22	22	1
A	unpackCookies()	0	15	3
B	packCookies()	0	19	5
A	isProtected()	0	9	2
B	decodeCookie()	0	24	5
A	getEncrypter()	0	9	2
A	encodeCookie()	0	11	2
A	hmacSign()	0	8	1

<?php
/**
 * Spiral Framework.
 *
 * @license   MIT
 * @author    Anton Titov (Wolfy-J)
 */

namespace Spiral\Http\Cookies;

use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use Spiral\Core\Component;
use Spiral\Core\ContainerInterface;
use Spiral\Encrypter\EncrypterInterface;
use Spiral\Encrypter\Exceptions\DecryptException;
use Spiral\Http\Configs\HttpConfig;
use Spiral\Http\MiddlewareInterface;

/**
 * Middleware used to encrypt and decrypt cookies. Creates container scope for a cookie bucket.
 *
 * Attention, EncrypterInterface is requested from container on demand.
 */
class CookieManager extends Component implements MiddlewareInterface
{
    /**
     * @var EncrypterInterface
     */
    private $encrypter = null;

    /**
     * @var HttpConfig
     */
    private $httpConfig = null;

    /**
     * @invisible
     * @var ContainerInterface
     */
    protected $container = null;

    /**
     * @param HttpConfig         $httpConfig
     * @param ContainerInterface $container Lazy access to encrypter.
     */
    public function __construct(HttpConfig $httpConfig, ContainerInterface $container)
    {
        $this->httpConfig = $httpConfig;
        $this->container = $container;
    }

    /**
     * {@inheritdoc}
     */
    public function __invoke(Request $request, Response $response, callable $next = null)

This method seems to be duplicated in your project.

    {
        //Aggregates all user cookies
        $queue = new CookieQueue($this->httpConfig, $request);

        //Opening cookie scope
        $scope = $this->container->replace(CookieQueue::class, $queue);

$queue is of type object<Spiral\Http\Cookies\CookieQueue>, but the function expects a callable.

        try {
            /**
             * Debug: middleware creates scope for [CookieQueue].
             */
            $response = $next(
                $this->unpackCookies($request)->withAttribute(CookieQueue::ATTRIBUTE, $queue),
                $response
            );

            //New cookies
            return $this->packCookies($response, $queue);
        } finally {
            $this->container->restore($scope);
        }
    }

    /**
     * Unpack incoming cookies and decrypt their content.
     *
     * @param Request $request
     *
     * @return Request
     */
    protected function unpackCookies(Request $request): Request
    {
        $cookies = $request->getCookieParams();

        foreach ($cookies as $name => $cookie) {
            if (!$this->isProtected($name)) {
                //Nothing to protect
                continue;
            }

            $cookies[$name] = $this->decodeCookie($cookie);
        }

        return $request->withCookieParams($cookies);
    }

    /**
     * Pack outcoming cookies with encrypted value.
     *
     * @param Response    $response
     * @param CookieQueue $queue
     *
     * @return Response
     *
     * @throws \Spiral\Encrypter\Exceptions\EncryptException
     */
    protected function packCookies(Response $response, CookieQueue $queue): Response
    {
        if (empty($queue->getScheduled())) {
            return $response;
        }

        $cookies = $response->getHeader('Set-Cookie');

        foreach ($queue->getScheduled() as $cookie) {
            if (!$this->isProtected($cookie->getName()) || empty($cookie->getValue())) {
                $cookies[] = $cookie->createHeader();
                continue;
            }

            $cookies[] = $this->encodeCookie($cookie)->createHeader();
        }

        return $response->withHeader('Set-Cookie', $cookies);
    }

    /**
     * Check if cookie has to be protected.
     *
     * @param string $cookie
     *
     * @return bool
     */
    protected function isProtected(string $cookie): bool
    {
        if (in_array($cookie, $this->httpConfig->excludedCookies())) {
            //Excluded
            return false;
        }

        return $this->httpConfig->cookieProtection() != HttpConfig::COOKIE_UNPROTECTED;
    }

    /**
     * @param string|array $cookie
     *
     * @return array|mixed|null
     */
    private function decodeCookie($cookie)
    {
        if ($this->httpConfig->cookieProtection() == HttpConfig::COOKIE_ENCRYPT) {
            try {
                if (is_array($cookie)) {
                    return array_map([$this, 'decodeCookie'], $cookie);
                }

                return $this->getEncrypter()->decrypt($cookie);
            } catch (DecryptException $exception) {
                return null;
            }
        }

        //HMAC
        $hmac = substr($cookie, -1 * HttpConfig::MAC_LENGTH);
        $value = substr($cookie, 0, strlen($cookie) - strlen($hmac));

        if ($this->hmacSign($value) != $hmac) {
            return null;
        }

        return $value;
    }

    /**
     * Get or create encrypter instance.
     *
     * @return EncrypterInterface
     */
    protected function getEncrypter()
    {
        if (empty($this->encrypter)) {
            //On demand creation (speed up app when no cookies were set)
            $this->encrypter = $this->container->get(EncrypterInterface::class);
        }

        return $this->encrypter;
    }

    /**
     * @param Cookie $cookie
     *
     * @return Cookie
     */
    private function encodeCookie(Cookie $cookie): Cookie
    {
        if ($this->httpConfig->cookieProtection() == HttpConfig::COOKIE_ENCRYPT) {
            return $cookie->withValue(
                $this->getEncrypter()->encrypt($cookie->getValue())
            );
        }

        //VALUE.HMAC
        return $cookie->withValue($cookie->getValue() . $this->hmacSign($cookie->getValue()));
    }

    /**
     * Sign string.
     *
     * @param string|null $value
     *
     * @return string
     */
    private function hmacSign($value): string
    {
        return hash_hmac(
            HttpConfig::HMAC_ALGORITHM,
            $value,
            $this->getEncrypter()->getKey()
        );
    }
}