stwalkerster / waca

includes/Helpers/HttpHelper.php

Indentation +108 added lines, -108 removed lines

@@ -13,112 +13,112 @@
 
 class HttpHelper
 {
-    private $curlHandle;
-
-    /**
-     * HttpHelper constructor.
-     *
-     * @param SiteConfiguration $siteConfiguration
-     * @param string            $cookieJar
-     */
-    public function __construct($siteConfiguration, $cookieJar = null)
-    {
-        $this->curlHandle = curl_init();
-
-        curl_setopt($this->curlHandle, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($this->curlHandle, CURLOPT_USERAGENT, $siteConfiguration->getUserAgent());
-        curl_setopt($this->curlHandle, CURLOPT_FAILONERROR, true);
-
-        if ($siteConfiguration->getCurlDisableVerifyPeer()) {
-            curl_setopt($this->curlHandle, CURLOPT_SSL_VERIFYPEER, false);
-        }
-
-        if ($cookieJar !== null) {
-            curl_setopt($this->curlHandle, CURLOPT_COOKIEFILE, $cookieJar);
-            curl_setopt($this->curlHandle, CURLOPT_COOKIEJAR, $cookieJar);
-        }
-    }
-
-    public function __destruct()
-    {
-        curl_close($this->curlHandle);
-    }
-
-    /**
-     * Fetches the content of a URL, with an optional parameter set.
-     *
-     * @param string     $url        The URL to fetch.
-     * @param null|array $parameters Key/value pair of GET parameters to add to the request.
-     *                               Null lets you handle it yourself.
-     *
-     * @param array      $headers
-     * @param int        $timeout Timeout in ms
-     *
-     * @return string
-     * @throws CurlException
-     */
-    public function get($url, $parameters = null, $headers = array(), $timeout = 300000)
-    {
-        if ($parameters !== null && is_array($parameters)) {
-            $getString = '?' . http_build_query($parameters);
-            $url .= $getString;
-        }
-
-        curl_setopt($this->curlHandle, CURLOPT_URL, $url);
-
-        // Make sure we're doing a GET
-        curl_setopt($this->curlHandle, CURLOPT_POST, false);
-
-        curl_setopt($this->curlHandle, CURLOPT_HTTPHEADER, $headers);
-
-        curl_setopt($this->curlHandle, CURLOPT_CONNECTTIMEOUT_MS, $timeout);
-        curl_setopt($this->curlHandle, CURLOPT_TIMEOUT_MS, $timeout);
-
-        $result = curl_exec($this->curlHandle);
-
-        if ($result === false) {
-            $error = curl_error($this->curlHandle);
-            throw new CurlException('Remote request failed with error ' . $error);
-        }
-
-        return $result;
-    }
-
-    /**
-     * Posts data to a URL
-     *
-     * @param string $url        The URL to fetch.
-     * @param array  $parameters Key/value pair of POST parameters to add to the request.
-     * @param array  $headers
-     *
-     * @return string
-     * @throws CurlException
-     */
-    public function post($url, $parameters, $headers = array())
-    {
-        curl_setopt($this->curlHandle, CURLOPT_URL, $url);
-
-        // Make sure we're doing a POST
-        curl_setopt($this->curlHandle, CURLOPT_POST, true);
-        curl_setopt($this->curlHandle, CURLOPT_POSTFIELDS, http_build_query($parameters));
-
-        curl_setopt($this->curlHandle, CURLOPT_HTTPHEADER, $headers);
-
-        $result = curl_exec($this->curlHandle);
-
-        if ($result === false) {
-            $error = curl_error($this->curlHandle);
-            throw new CurlException('Remote request failed with error ' . $error);
-        }
-
-        return $result;
-    }
-
-    /**
-     * @return string
-     */
-    public function getError()
-    {
-        return curl_error($this->curlHandle);
-    }
+	private $curlHandle;
+
+	/**
+	 * HttpHelper constructor.
+	 *
+	 * @param SiteConfiguration $siteConfiguration
+	 * @param string            $cookieJar
+	 */
+	public function __construct($siteConfiguration, $cookieJar = null)
+	{
+		$this->curlHandle = curl_init();
+
+		curl_setopt($this->curlHandle, CURLOPT_RETURNTRANSFER, true);
+		curl_setopt($this->curlHandle, CURLOPT_USERAGENT, $siteConfiguration->getUserAgent());
+		curl_setopt($this->curlHandle, CURLOPT_FAILONERROR, true);
+
+		if ($siteConfiguration->getCurlDisableVerifyPeer()) {
+			curl_setopt($this->curlHandle, CURLOPT_SSL_VERIFYPEER, false);
+		}
+
+		if ($cookieJar !== null) {
+			curl_setopt($this->curlHandle, CURLOPT_COOKIEFILE, $cookieJar);
+			curl_setopt($this->curlHandle, CURLOPT_COOKIEJAR, $cookieJar);
+		}
+	}
+
+	public function __destruct()
+	{
+		curl_close($this->curlHandle);
+	}
+
+	/**
+	 * Fetches the content of a URL, with an optional parameter set.
+	 *
+	 * @param string     $url        The URL to fetch.
+	 * @param null|array $parameters Key/value pair of GET parameters to add to the request.
+	 *                               Null lets you handle it yourself.
+	 *
+	 * @param array      $headers
+	 * @param int        $timeout Timeout in ms
+	 *
+	 * @return string
+	 * @throws CurlException
+	 */
+	public function get($url, $parameters = null, $headers = array(), $timeout = 300000)
+	{
+		if ($parameters !== null && is_array($parameters)) {
+			$getString = '?' . http_build_query($parameters);
+			$url .= $getString;
+		}
+
+		curl_setopt($this->curlHandle, CURLOPT_URL, $url);
+
+		// Make sure we're doing a GET
+		curl_setopt($this->curlHandle, CURLOPT_POST, false);
+
+		curl_setopt($this->curlHandle, CURLOPT_HTTPHEADER, $headers);
+
+		curl_setopt($this->curlHandle, CURLOPT_CONNECTTIMEOUT_MS, $timeout);
+		curl_setopt($this->curlHandle, CURLOPT_TIMEOUT_MS, $timeout);
+
+		$result = curl_exec($this->curlHandle);
+
+		if ($result === false) {
+			$error = curl_error($this->curlHandle);
+			throw new CurlException('Remote request failed with error ' . $error);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Posts data to a URL
+	 *
+	 * @param string $url        The URL to fetch.
+	 * @param array  $parameters Key/value pair of POST parameters to add to the request.
+	 * @param array  $headers
+	 *
+	 * @return string
+	 * @throws CurlException
+	 */
+	public function post($url, $parameters, $headers = array())
+	{
+		curl_setopt($this->curlHandle, CURLOPT_URL, $url);
+
+		// Make sure we're doing a POST
+		curl_setopt($this->curlHandle, CURLOPT_POST, true);
+		curl_setopt($this->curlHandle, CURLOPT_POSTFIELDS, http_build_query($parameters));
+
+		curl_setopt($this->curlHandle, CURLOPT_HTTPHEADER, $headers);
+
+		$result = curl_exec($this->curlHandle);
+
+		if ($result === false) {
+			$error = curl_error($this->curlHandle);
+			throw new CurlException('Remote request failed with error ' . $error);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getError()
+	{
+		return curl_error($this->curlHandle);
+	}
 }

includes/Helpers/BanHelper.php

Indentation +147 added lines, -147 removed lines

@@ -19,60 +19,60 @@ 
 
 class BanHelper implements IBanHelper
 {
-    /** @var PdoDatabase */
-    private $database;
-    /** @var IXffTrustProvider */
-    private $xffTrustProvider;
-    /** @var Ban[][] */
-    private $banCache = [];
-    /**
-     * @var null|SecurityManager
-     */
-    private $securityManager;
-
-    public function __construct(
-        PdoDatabase $database,
-        IXffTrustProvider $xffTrustProvider,
-        ?SecurityManager $securityManager
-    ) {
-        $this->database = $database;
-        $this->xffTrustProvider = $xffTrustProvider;
-        $this->securityManager = $securityManager;
-    }
-
-    public function isBlockBanned(Request $request): bool
-    {
-        if (!isset($this->banCache[$request->getId()])) {
-            $this->banCache[$request->getId()] = $this->getBansForRequestFromDatabase($request);
-        }
-
-        foreach ($this->banCache[$request->getId()] as $ban) {
-            if ($ban->getAction() === Ban::ACTION_BLOCK) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    /**
-     * @param Request $request
-     *
-     * @return Ban[]
-     */
-    public function getBans(Request $request): array
-    {
-        if (!isset($this->banCache[$request->getId()])) {
-            $this->banCache[$request->getId()] = $this->getBansForRequestFromDatabase($request);
-        }
-
-        return $this->banCache[$request->getId()];
-    }
-
-    public function getBansByTarget(?string $name, ?string $email, ?string $ip, ?int $mask, ?string $useragent)
-    {
-        /** @noinspection SqlConstantCondition */
-        $query = <<<SQL
+	/** @var PdoDatabase */
+	private $database;
+	/** @var IXffTrustProvider */
+	private $xffTrustProvider;
+	/** @var Ban[][] */
+	private $banCache = [];
+	/**
+	 * @var null|SecurityManager
+	 */
+	private $securityManager;
+
+	public function __construct(
+		PdoDatabase $database,
+		IXffTrustProvider $xffTrustProvider,
+		?SecurityManager $securityManager
+	) {
+		$this->database = $database;
+		$this->xffTrustProvider = $xffTrustProvider;
+		$this->securityManager = $securityManager;
+	}
+
+	public function isBlockBanned(Request $request): bool
+	{
+		if (!isset($this->banCache[$request->getId()])) {
+			$this->banCache[$request->getId()] = $this->getBansForRequestFromDatabase($request);
+		}
+
+		foreach ($this->banCache[$request->getId()] as $ban) {
+			if ($ban->getAction() === Ban::ACTION_BLOCK) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * @param Request $request
+	 *
+	 * @return Ban[]
+	 */
+	public function getBans(Request $request): array
+	{
+		if (!isset($this->banCache[$request->getId()])) {
+			$this->banCache[$request->getId()] = $this->getBansForRequestFromDatabase($request);
+		}
+
+		return $this->banCache[$request->getId()];
+	}
+
+	public function getBansByTarget(?string $name, ?string $email, ?string $ip, ?int $mask, ?string $useragent)
+	{
+		/** @noinspection SqlConstantCondition */
+		$query = <<<SQL
 SELECT * FROM ban 
 WHERE 1 = 1
   AND ((name is null and :nname is null) OR name = :name)
@@ -84,76 +84,76 @@ 
   AND active = 1;
 SQL;
 
-        $statement = $this->database->prepare($query);
-        $statement->execute([
-            ':name'       => $name,
-            ':nname'      => $name,
-            ':email'      => $email,
-            ':nemail'     => $email,
-            ':ip'         => $ip,
-            ':nip'        => $ip,
-            ':ipmask'     => $mask,
-            ':nipmask'    => $mask,
-            ':useragent'  => $useragent,
-            ':nuseragent' => $useragent,
-        ]);
-
-        $result = array();
-
-        /** @var Ban $v */
-        foreach ($statement->fetchAll(PDO::FETCH_CLASS, Ban::class) as $v) {
-            $v->setDatabase($this->database);
-            $result[] = $v;
-        }
-
-        return $result;
-    }
-
-    public function isActive(Ban $ban): bool
-    {
-        if (!$ban->isActive()) {
-            return false;
-        }
-
-        if ($ban->getDuration() !== null && $ban->getDuration() < time()) {
-            return false;
-        }
-
-        return true;
-    }
-
-    public function canUnban(Ban $ban): bool
-    {
-        if ($this->securityManager === null) {
-            return false;
-        }
-
-        if (!$this->isActive($ban)) {
-            return false;
-        }
-
-        $user = User::getCurrent($this->database);
-
-        $allowed = true;
-        $allowed = $allowed && ($ban->getName() === null || $this->securityManager->allows('BanType', 'name', $user) === SecurityManager::ALLOWED);
-        $allowed = $allowed && ($ban->getEmail() === null || $this->securityManager->allows('BanType', 'email', $user) === SecurityManager::ALLOWED);
-        $allowed = $allowed && ($ban->getIp() === null || $this->securityManager->allows('BanType', 'ip', $user) === SecurityManager::ALLOWED);
-        $allowed = $allowed && ($ban->getUseragent() === null || $this->securityManager->allows('BanType', 'useragent', $user) === SecurityManager::ALLOWED);
-
-        $allowed = $allowed && $this->securityManager->allows('BanVisibility', $ban->getVisibility(), $user) === SecurityManager::ALLOWED;
-
-        return $allowed;
-    }
-
-    /**
-     * @param Request $request
-     *
-     * @return Ban[]
-     */
-    private function getBansForRequestFromDatabase(Request $request): array
-    {
-        /** @noinspection SqlConstantCondition - included for clarity of code */
-        $query = <<<SQL
+		$statement = $this->database->prepare($query);
+		$statement->execute([
+			':name'       => $name,
+			':nname'      => $name,
+			':email'      => $email,
+			':nemail'     => $email,
+			':ip'         => $ip,
+			':nip'        => $ip,
+			':ipmask'     => $mask,
+			':nipmask'    => $mask,
+			':useragent'  => $useragent,
+			':nuseragent' => $useragent,
+		]);
+
+		$result = array();
+
+		/** @var Ban $v */
+		foreach ($statement->fetchAll(PDO::FETCH_CLASS, Ban::class) as $v) {
+			$v->setDatabase($this->database);
+			$result[] = $v;
+		}
+
+		return $result;
+	}
+
+	public function isActive(Ban $ban): bool
+	{
+		if (!$ban->isActive()) {
+			return false;
+		}
+
+		if ($ban->getDuration() !== null && $ban->getDuration() < time()) {
+			return false;
+		}
+
+		return true;
+	}
+
+	public function canUnban(Ban $ban): bool
+	{
+		if ($this->securityManager === null) {
+			return false;
+		}
+
+		if (!$this->isActive($ban)) {
+			return false;
+		}
+
+		$user = User::getCurrent($this->database);
+
+		$allowed = true;
+		$allowed = $allowed && ($ban->getName() === null || $this->securityManager->allows('BanType', 'name', $user) === SecurityManager::ALLOWED);
+		$allowed = $allowed && ($ban->getEmail() === null || $this->securityManager->allows('BanType', 'email', $user) === SecurityManager::ALLOWED);
+		$allowed = $allowed && ($ban->getIp() === null || $this->securityManager->allows('BanType', 'ip', $user) === SecurityManager::ALLOWED);
+		$allowed = $allowed && ($ban->getUseragent() === null || $this->securityManager->allows('BanType', 'useragent', $user) === SecurityManager::ALLOWED);
+
+		$allowed = $allowed && $this->securityManager->allows('BanVisibility', $ban->getVisibility(), $user) === SecurityManager::ALLOWED;
+
+		return $allowed;
+	}
+
+	/**
+	 * @param Request $request
+	 *
+	 * @return Ban[]
+	 */
+	private function getBansForRequestFromDatabase(Request $request): array
+	{
+		/** @noinspection SqlConstantCondition - included for clarity of code */
+		$query = <<<SQL
 select b.* from ban b
 left join netmask n on 1 = 1
     and n.cidr = b.ipmask
@@ -174,27 +174,27 @@ 
     and (duration > UNIX_TIMESTAMP() or duration is null)
 SQL;
 
-        $statement = $this->database->prepare($query);
-        $trustedIp = $this->xffTrustProvider->getTrustedClientIp($request->getIp(), $request->getForwardedIp());
-
-        $statement->execute([
-            ':name'      => $request->getName(),
-            ':email'     => $request->getEmail(),
-            ':useragent' => $request->getUserAgent(),
-            ':ip4'       => $trustedIp,
-            ':ip6h'      => $trustedIp,
-            ':ip6l'      => $trustedIp,
-        ]);
-
-        /** @var Ban[] $result */
-        $result = [];
-
-        /** @var Ban $v */
-        foreach ($statement->fetchAll(PDO::FETCH_CLASS, Ban::class) as $v) {
-            $v->setDatabase($this->database);
-            $result[] = $v;
-        }
-
-        return $result;
-    }
+		$statement = $this->database->prepare($query);
+		$trustedIp = $this->xffTrustProvider->getTrustedClientIp($request->getIp(), $request->getForwardedIp());
+
+		$statement->execute([
+			':name'      => $request->getName(),
+			':email'     => $request->getEmail(),
+			':useragent' => $request->getUserAgent(),
+			':ip4'       => $trustedIp,
+			':ip6h'      => $trustedIp,
+			':ip6l'      => $trustedIp,
+		]);
+
+		/** @var Ban[] $result */
+		$result = [];
+
+		/** @var Ban $v */
+		foreach ($statement->fetchAll(PDO::FETCH_CLASS, Ban::class) as $v) {
+			$v->setDatabase($this->database);
+			$result[] = $v;
+		}
+
+		return $result;
+	}
 }

includes/Helpers/TypeAheadHelper.php

Indentation +31 added lines, -31 removed lines

@@ -12,21 +12,21 @@ 
 
 class TypeAheadHelper implements ITypeAheadHelper
 {
-    private $definedClasses = array();
+	private $definedClasses = array();
 
-    /**
-     * @param string   $class     CSS class to apply this typeahead to.
-     * @param callable $generator Generator function taking no arguments to return an array of strings.
-     */
-    public function defineTypeAheadSource($class, callable $generator)
-    {
-        $dataList = '';
-        foreach ($generator() as $dataItem) {
-            $dataList .= '"' . htmlentities($dataItem) . '", ';
-        }
-        $dataList = "[" . rtrim($dataList, ", ") . "]";
+	/**
+	 * @param string   $class     CSS class to apply this typeahead to.
+	 * @param callable $generator Generator function taking no arguments to return an array of strings.
+	 */
+	public function defineTypeAheadSource($class, callable $generator)
+	{
+		$dataList = '';
+		foreach ($generator() as $dataItem) {
+			$dataList .= '"' . htmlentities($dataItem) . '", ';
+		}
+		$dataList = "[" . rtrim($dataList, ", ") . "]";
 
-        $script = <<<JS
+		$script = <<<JS
 
 $('.{$class}').typeahead({
         hint: true,
@@ -39,32 +39,32 @@ 
 })
 ;
 JS;
-        $this->definedClasses[$class] = $script;
-    }
+		$this->definedClasses[$class] = $script;
+	}
 
-    /**
-     * @return string HTML fragment containing a JS block for typeaheads.
-     */
-    public function getTypeAheadScriptBlock()
-    {
-        $jsBlocks = '';
+	/**
+	 * @return string HTML fragment containing a JS block for typeaheads.
+	 */
+	public function getTypeAheadScriptBlock()
+	{
+		$jsBlocks = '';
 
-        if (count($this->definedClasses) === 0) {
-            return '';
-        }
+		if (count($this->definedClasses) === 0) {
+			return '';
+		}
 
-        foreach ($this->definedClasses as $class => $js) {
-            $jsBlocks = $js . "\r\n\r\n";
-        }
+		foreach ($this->definedClasses as $class => $js) {
+			$jsBlocks = $js . "\r\n\r\n";
+		}
 
-        $data = <<<HTML
+		$data = <<<HTML
 <script type="text/javascript">
 	{$jsBlocks}
 </script>
 HTML;
 
-        $this->definedClasses = array();
+		$this->definedClasses = array();
 
-        return $data;
-    }
+		return $data;
+	}
 }

includes/Helpers/Interfaces/IBlacklistHelper.php

Indentation +8 added lines, -8 removed lines

@@ -10,12 +10,12 @@
 
 interface IBlacklistHelper
 {
-    /**
-     * Returns a value indicating whether the provided username is blacklisted by the on-wiki title blacklist
-     *
-     * @param string $username
-     *
-     * @return bool
-     */
-    public function isBlacklisted($username);
+	/**
+	 * Returns a value indicating whether the provided username is blacklisted by the on-wiki title blacklist
+	 *
+	 * @param string $username
+	 *
+	 * @return bool
+	 */
+	public function isBlacklisted($username);
 }
\ No newline at end of file

includes/Helpers/Interfaces/IOAuthProtocolHelper.php

Indentation +45 added lines, -45 removed lines

@@ -15,53 +15,53 @@
 
 interface IOAuthProtocolHelper
 {
-    /**
-     * @return stdClass
-     *
-     * @throws Exception
-     * @throws CurlException
-     */
-    public function getRequestToken();
+	/**
+	 * @return stdClass
+	 *
+	 * @throws Exception
+	 * @throws CurlException
+	 */
+	public function getRequestToken();
 
-    /**
-     * @param string $requestToken
-     *
-     * @return string
-     */
-    public function getAuthoriseUrl($requestToken);
+	/**
+	 * @param string $requestToken
+	 *
+	 * @return string
+	 */
+	public function getAuthoriseUrl($requestToken);
 
-    /**
-     * @param string $oauthRequestToken
-     * @param string $oauthRequestSecret
-     * @param string $oauthVerifier
-     *
-     * @return stdClass
-     * @throws CurlException
-     * @throws Exception
-     */
-    public function callbackCompleted($oauthRequestToken, $oauthRequestSecret, $oauthVerifier);
+	/**
+	 * @param string $oauthRequestToken
+	 * @param string $oauthRequestSecret
+	 * @param string $oauthVerifier
+	 *
+	 * @return stdClass
+	 * @throws CurlException
+	 * @throws Exception
+	 */
+	public function callbackCompleted($oauthRequestToken, $oauthRequestSecret, $oauthVerifier);
 
-    /**
-     * @param string $oauthAccessToken
-     * @param string $oauthAccessSecret
-     *
-     * @return stdClass
-     * @throws CurlException
-     * @throws Exception
-     * @throws \MediaWiki\OAuthClient\Exception
-     */
-    public function getIdentityTicket($oauthAccessToken, $oauthAccessSecret);
+	/**
+	 * @param string $oauthAccessToken
+	 * @param string $oauthAccessSecret
+	 *
+	 * @return stdClass
+	 * @throws CurlException
+	 * @throws Exception
+	 * @throws \MediaWiki\OAuthClient\Exception
+	 */
+	public function getIdentityTicket($oauthAccessToken, $oauthAccessSecret);
 
-    /**
-     * @param array  $apiParams    array of parameters to send to the API
-     * @param string $accessToken  user's access token
-     * @param string $accessSecret user's secret
-     * @param string $method       HTTP method
-     *
-     * @return stdClass
-     * @throws ApplicationLogicException
-     * @throws CurlException
-     * @throws Exception
-     */
-    public function apiCall($apiParams, $accessToken, $accessSecret, $method = 'GET');
+	/**
+	 * @param array  $apiParams    array of parameters to send to the API
+	 * @param string $accessToken  user's access token
+	 * @param string $accessSecret user's secret
+	 * @param string $method       HTTP method
+	 *
+	 * @return stdClass
+	 * @throws ApplicationLogicException
+	 * @throws CurlException
+	 * @throws Exception
+	 */
+	public function apiCall($apiParams, $accessToken, $accessSecret, $method = 'GET');
 }
\ No newline at end of file

includes/Helpers/Interfaces/IMediaWikiClient.php

Indentation +1 added lines, -1 removed lines

@@ -10,5 +10,5 @@
 
 interface IMediaWikiClient
 {
-    function doApiCall($params, $method);
+	function doApiCall($params, $method);
 }
\ No newline at end of file

includes/Helpers/Interfaces/ITypeAheadHelper.php

Indentation +11 added lines, -11 removed lines

@@ -10,16 +10,16 @@
 
 interface ITypeAheadHelper
 {
-    /**
-     * @param string   $class     CSS class to apply this typeahead to.
-     * @param callable $generator Generator function taking no arguments to return an array of strings.
-     *
-     * @return void
-     */
-    public function defineTypeAheadSource($class, callable $generator);
+	/**
+	 * @param string   $class     CSS class to apply this typeahead to.
+	 * @param callable $generator Generator function taking no arguments to return an array of strings.
+	 *
+	 * @return void
+	 */
+	public function defineTypeAheadSource($class, callable $generator);
 
-    /**
-     * @return string HTML fragment containing a JS block for typeaheads.
-     */
-    public function getTypeAheadScriptBlock();
+	/**
+	 * @return string HTML fragment containing a JS block for typeaheads.
+	 */
+	public function getTypeAheadScriptBlock();
 }
\ No newline at end of file

includes/Helpers/Interfaces/IBanHelper.php

Indentation +14 added lines, -14 removed lines

@@ -13,21 +13,21 @@
 
 interface IBanHelper
 {
-    /**
-     * @param Request $request
-     *
-     * @return bool
-     */
-    public function isBlockBanned(Request $request): bool;
+	/**
+	 * @param Request $request
+	 *
+	 * @return bool
+	 */
+	public function isBlockBanned(Request $request): bool;
 
-    /**
-     * @param Request $request
-     *
-     * @return Ban[]
-     */
-    public function getBans(Request $request): array;
+	/**
+	 * @param Request $request
+	 *
+	 * @return Ban[]
+	 */
+	public function getBans(Request $request): array;
 
-    public function canUnban(Ban $ban): bool;
+	public function canUnban(Ban $ban): bool;
 
-    public function isActive(Ban $ban): bool;
+	public function isActive(Ban $ban): bool;
 }

includes/Helpers/OAuthUserHelper.php

Indentation +452 added lines, -452 removed lines

@@ -25,460 +25,460 @@
 
 class OAuthUserHelper implements IMediaWikiClient
 {
-    const TOKEN_REQUEST = 'request';
-    const TOKEN_ACCESS = 'access';
-    /** @var PDOStatement */
-    private static $tokenCountStatement = null;
-    /** @var PDOStatement */
-    private $getTokenStatement;
-    /**
-     * @var User
-     */
-    private $user;
-    /**
-     * @var PdoDatabase
-     */
-    private $database;
-    /**
-     * @var IOAuthProtocolHelper
-     */
-    private $oauthProtocolHelper;
-    /**
-     * @var bool|null Is the user linked to OAuth
-     */
-    private $linked;
-    private $partiallyLinked;
-    /** @var OAuthToken */
-    private $accessToken;
-    /** @var bool */
-    private $accessTokenLoaded = false;
-    /**
-     * @var OAuthIdentity
-     */
-    private $identity = null;
-    /**
-     * @var bool
-     */
-    private $identityLoaded = false;
-    /**
-     * @var SiteConfiguration
-     */
-    private $siteConfiguration;
-
-    private $legacyTokens;
-
-    #region Static methods
-
-    public static function findUserByRequestToken($requestToken, PdoDatabase $database)
-    {
-        $statement = $database->prepare(<<<'SQL'
+	const TOKEN_REQUEST = 'request';
+	const TOKEN_ACCESS = 'access';
+	/** @var PDOStatement */
+	private static $tokenCountStatement = null;
+	/** @var PDOStatement */
+	private $getTokenStatement;
+	/**
+	 * @var User
+	 */
+	private $user;
+	/**
+	 * @var PdoDatabase
+	 */
+	private $database;
+	/**
+	 * @var IOAuthProtocolHelper
+	 */
+	private $oauthProtocolHelper;
+	/**
+	 * @var bool|null Is the user linked to OAuth
+	 */
+	private $linked;
+	private $partiallyLinked;
+	/** @var OAuthToken */
+	private $accessToken;
+	/** @var bool */
+	private $accessTokenLoaded = false;
+	/**
+	 * @var OAuthIdentity
+	 */
+	private $identity = null;
+	/**
+	 * @var bool
+	 */
+	private $identityLoaded = false;
+	/**
+	 * @var SiteConfiguration
+	 */
+	private $siteConfiguration;
+
+	private $legacyTokens;
+
+	#region Static methods
+
+	public static function findUserByRequestToken($requestToken, PdoDatabase $database)
+	{
+		$statement = $database->prepare(<<<'SQL'
             SELECT u.* FROM user u 
             INNER JOIN oauthtoken t ON t.user = u.id 
             WHERE t.type = :type AND t.token = :token
 SQL
-        );
-        $statement->execute(array(':type' => self::TOKEN_REQUEST, ':token' => $requestToken));
-
-        /** @var User $user */
-        $user = $statement->fetchObject(User::class);
-        $statement->closeCursor();
-
-        if ($user === false) {
-            throw new ApplicationLogicException('Token not found in store, please try again');
-        }
-
-        $user->setDatabase($database);
-
-        return $user;
-    }
-
-    public static function userIsFullyLinked(User $user, PdoDatabase $database = null)
-    {
-        if (self::$tokenCountStatement === null && $database === null) {
-            throw new ApplicationLogicException('Static link request without initialised statement');
-        }
-
-        return self::runTokenCount($user->getId(), $database, self::TOKEN_ACCESS);
-    }
-
-    public static function userIsPartiallyLinked(User $user, PdoDatabase $database = null)
-    {
-        if (self::$tokenCountStatement === null && $database === null) {
-            throw new ApplicationLogicException('Static link request without initialised statement');
-        }
-
-        if (self::userIsFullyLinked($user, $database)) {
-            return false;
-        }
-
-        return self::runTokenCount($user->getId(), $database, self::TOKEN_REQUEST)
-            || $user->getOnWikiName() == null;
-    }
-
-    /**
-     * @param PdoDatabase $database
-     */
-    public static function prepareTokenCountStatement(PdoDatabase $database)
-    {
-        if (self::$tokenCountStatement === null) {
-            self::$tokenCountStatement = $database->prepare('SELECT COUNT(*) FROM oauthtoken WHERE user = :user AND type = :type');
-        }
-    }
-
-    private static function runTokenCount($userId, $database, $tokenType)
-    {
-        if (self::$tokenCountStatement === null) {
-            self::prepareTokenCountStatement($database);
-        }
-
-        self::$tokenCountStatement->execute(array(
-            ':user' => $userId,
-            ':type' => $tokenType,
-        ));
-
-        $tokenCount = self::$tokenCountStatement->fetchColumn();
-        $linked = $tokenCount > 0;
-        self::$tokenCountStatement->closeCursor();
-
-        return $linked;
-    }
-
-    #endregion Static methods
-
-    /**
-     * OAuthUserHelper constructor.
-     *
-     * @param User                 $user
-     * @param PdoDatabase          $database
-     * @param IOAuthProtocolHelper $oauthProtocolHelper
-     * @param SiteConfiguration    $siteConfiguration
-     */
-    public function __construct(
-        User $user,
-        PdoDatabase $database,
-        IOAuthProtocolHelper $oauthProtocolHelper,
-        SiteConfiguration $siteConfiguration
-    ) {
-        $this->user = $user;
-        $this->database = $database;
-        $this->oauthProtocolHelper = $oauthProtocolHelper;
-
-        $this->linked = null;
-        $this->partiallyLinked = null;
-        $this->siteConfiguration = $siteConfiguration;
-
-        self::prepareTokenCountStatement($database);
-        $this->getTokenStatement = $this->database->prepare('SELECT * FROM oauthtoken WHERE user = :user AND type = :type');
-
-        $this->legacyTokens = $this->siteConfiguration->getOauthLegacyConsumerTokens();
-    }
-
-    /**
-     * Determines if the user is fully connected to OAuth.
-     *
-     * @return bool
-     */
-    public function isFullyLinked()
-    {
-        if ($this->linked === null) {
-            $this->linked = self::userIsFullyLinked($this->user, $this->database);
-        }
-
-        return $this->linked;
-    }
-
-    /**
-     * Attempts to figure out if a user is partially linked to OAuth, and therefore needs to complete the OAuth
-     * procedure before configuring.
-     * @return bool
-     */
-    public function isPartiallyLinked()
-    {
-        if ($this->partiallyLinked === null) {
-            $this->partiallyLinked = self::userIsPartiallyLinked($this->user, $this->database);
-        }
-
-        return $this->partiallyLinked;
-    }
-
-    public function canCreateAccount()
-    {
-        return $this->isFullyLinked()
-            && $this->getIdentity(true)->getGrantBasic()
-            && $this->getIdentity(true)->getGrantHighVolume()
-            && $this->getIdentity(true)->getGrantCreateAccount();
-    }
-
-    public function canWelcome()
-    {
-        return $this->isFullyLinked()
-            && $this->getIdentity(true)->getGrantBasic()
-            && $this->getIdentity(true)->getGrantHighVolume()
-            && $this->getIdentity(true)->getGrantCreateEditMovePage();
-    }
-
-    /**
-     * @throws OAuthException
-     * @throws CurlException
-     * @throws OptimisticLockFailedException
-     * @throws Exception
-     */
-    public function refreshIdentity()
-    {
-        $this->loadIdentity();
-
-        if ($this->identity === null) {
-            $this->identity = new OAuthIdentity();
-            $this->identity->setUserId($this->user->getId());
-            $this->identity->setDatabase($this->database);
-        }
-
-        $token = $this->loadAccessToken();
-
-        try {
-            $rawTicket = $this->oauthProtocolHelper->getIdentityTicket($token->getToken(), $token->getSecret());
-        }
-        catch (Exception $ex) {
-            if (strpos($ex->getMessage(), "mwoauthdatastore-access-token-not-found") !== false) {
-                throw new OAuthException('No approved grants for this access token.', -1, $ex);
-            }
-
-            throw $ex;
-        }
-
-        $this->identity->populate($rawTicket);
-
-        if (!$this->identityIsValid()) {
-            throw new OAuthException('Identity ticket is not valid!');
-        }
-
-        $this->identity->save();
-
-        $this->user->setOnWikiName($this->identity->getUsername());
-        $this->user->save();
-    }
-
-    /**
-     * @return string
-     * @throws CurlException
-     */
-    public function getRequestToken()
-    {
-        $token = $this->oauthProtocolHelper->getRequestToken();
-
-        $this->partiallyLinked = true;
-        $this->linked = false;
-
-        $this->database
-            ->prepare('DELETE FROM oauthtoken WHERE user = :user AND type = :type')
-            ->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
-
-        $this->database
-            ->prepare('INSERT INTO oauthtoken (user, type, token, secret, expiry) VALUES (:user, :type, :token, :secret, DATE_ADD(NOW(), INTERVAL 1 DAY))')
-            ->execute(array(
-                ':user'   => $this->user->getId(),
-                ':type'   => self::TOKEN_REQUEST,
-                ':token'  => $token->key,
-                ':secret' => $token->secret,
-            ));
-
-        return $this->oauthProtocolHelper->getAuthoriseUrl($token->key);
-    }
-
-    /**
-     * @param $verificationToken
-     *
-     * @throws ApplicationLogicException
-     * @throws CurlException
-     * @throws OAuthException
-     * @throws OptimisticLockFailedException
-     */
-    public function completeHandshake($verificationToken)
-    {
-        $this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
-
-        /** @var OAuthToken $token */
-        $token = $this->getTokenStatement->fetchObject(OAuthToken::class);
-        $this->getTokenStatement->closeCursor();
-
-        if ($token === false) {
-            throw new ApplicationLogicException('Cannot find request token');
-        }
-
-        $token->setDatabase($this->database);
-
-        $accessToken = $this->oauthProtocolHelper->callbackCompleted($token->getToken(), $token->getSecret(),
-            $verificationToken);
-
-        $clearStatement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :u AND type = :t');
-        $clearStatement->execute(array(':u' => $this->user->getId(), ':t' => self::TOKEN_ACCESS));
-
-        $token->setToken($accessToken->key);
-        $token->setSecret($accessToken->secret);
-        $token->setType(self::TOKEN_ACCESS);
-        $token->setExpiry(null);
-        $token->save();
-
-        $this->partiallyLinked = false;
-        $this->linked = true;
-
-        $this->refreshIdentity();
-    }
-
-    public function detach()
-    {
-        $this->loadIdentity();
-
-        $this->identity->delete();
-        $statement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :user');
-        $statement->execute(array(':user' => $this->user->getId()));
-
-        $this->identity = null;
-        $this->linked = false;
-        $this->partiallyLinked = false;
-    }
-
-    /**
-     * @param bool $expiredOk
-     *
-     * @return OAuthIdentity
-     * @throws OAuthException
-     */
-    public function getIdentity($expiredOk = false)
-    {
-        $this->loadIdentity();
-
-        if (!$this->identityIsValid($expiredOk)) {
-            throw new OAuthException('Stored identity is not valid.');
-        }
-
-        return $this->identity;
-    }
-
-    public function doApiCall($params, $method)
-    {
-        // Ensure we're logged in
-        $params['assert'] = 'user';
-
-        $token = $this->loadAccessToken();
-        return $this->oauthProtocolHelper->apiCall($params, $token->getToken(), $token->getSecret(), $method);
-    }
-
-    /**
-     * @param bool $expiredOk
-     *
-     * @return bool
-     */
-    private function identityIsValid($expiredOk = false)
-    {
-        $this->loadIdentity();
-
-        if ($this->identity === null) {
-            return false;
-        }
-
-        if ($this->identity->getIssuedAtTime() === false
-            || $this->identity->getExpirationTime() === false
-            || $this->identity->getAudience() === false
-            || $this->identity->getIssuer() === false
-        ) {
-            // this isn't populated properly.
-            return false;
-        }
-
-        $issue = DateTimeImmutable::createFromFormat("U", $this->identity->getIssuedAtTime());
-        $now = new DateTimeImmutable();
-
-        if ($issue > $now) {
-            // wat.
-            return false;
-        }
-
-        if ($this->identityExpired() && !$expiredOk) {
-            // soz.
-            return false;
-        }
-
-        if ($this->identity->getAudience() !== $this->siteConfiguration->getOAuthConsumerToken()) {
-            // token not issued for us
-
-            // we allow cases where the cache is expired and the cache is for a legacy token
-            if (!($expiredOk && in_array($this->identity->getAudience(), $this->legacyTokens))) {
-                return false;
-            }
-        }
-
-        if ($this->identity->getIssuer() !== $this->siteConfiguration->getOauthMediaWikiCanonicalServer()) {
-            // token not issued by the right person
-            return false;
-        }
-
-        // can't find a reason to not trust it
-        return true;
-    }
-
-    /**
-     * @return bool
-     */
-    public function identityExpired()
-    {
-        // allowed max age
-        $gracePeriod = $this->siteConfiguration->getOauthIdentityGraceTime();
-
-        $expiry = DateTimeImmutable::createFromFormat("U", $this->identity->getExpirationTime());
-        $graceExpiry = $expiry->modify($gracePeriod);
-        $now = new DateTimeImmutable();
-
-        return $graceExpiry < $now;
-    }
-
-    /**
-     * Loads the OAuth identity from the database for the current user.
-     */
-    private function loadIdentity()
-    {
-        if ($this->identityLoaded) {
-            return;
-        }
-
-        $statement = $this->database->prepare('SELECT * FROM oauthidentity WHERE user = :user');
-        $statement->execute(array(':user' => $this->user->getId()));
-        /** @var OAuthIdentity $obj */
-        $obj = $statement->fetchObject(OAuthIdentity::class);
-
-        if ($obj === false) {
-            // failed to load identity.
-            $this->identityLoaded = true;
-            $this->identity = null;
-
-            return;
-        }
-
-        $obj->setDatabase($this->database);
-        $this->identityLoaded = true;
-        $this->identity = $obj;
-    }
-
-    /**
-     * @return OAuthToken
-     * @throws OAuthException
-     */
-    private function loadAccessToken()
-    {
-        if (!$this->accessTokenLoaded) {
-            $this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_ACCESS));
-            /** @var OAuthToken $token */
-            $token = $this->getTokenStatement->fetchObject(OAuthToken::class);
-            $this->getTokenStatement->closeCursor();
-
-            if ($token === false) {
-                throw new OAuthException('Access token not found!');
-            }
-
-            $this->accessToken = $token;
-            $this->accessTokenLoaded = true;
-        }
-
-        return $this->accessToken;
-    }
+		);
+		$statement->execute(array(':type' => self::TOKEN_REQUEST, ':token' => $requestToken));
+
+		/** @var User $user */
+		$user = $statement->fetchObject(User::class);
+		$statement->closeCursor();
+
+		if ($user === false) {
+			throw new ApplicationLogicException('Token not found in store, please try again');
+		}
+
+		$user->setDatabase($database);
+
+		return $user;
+	}
+
+	public static function userIsFullyLinked(User $user, PdoDatabase $database = null)
+	{
+		if (self::$tokenCountStatement === null && $database === null) {
+			throw new ApplicationLogicException('Static link request without initialised statement');
+		}
+
+		return self::runTokenCount($user->getId(), $database, self::TOKEN_ACCESS);
+	}
+
+	public static function userIsPartiallyLinked(User $user, PdoDatabase $database = null)
+	{
+		if (self::$tokenCountStatement === null && $database === null) {
+			throw new ApplicationLogicException('Static link request without initialised statement');
+		}
+
+		if (self::userIsFullyLinked($user, $database)) {
+			return false;
+		}
+
+		return self::runTokenCount($user->getId(), $database, self::TOKEN_REQUEST)
+			|| $user->getOnWikiName() == null;
+	}
+
+	/**
+	 * @param PdoDatabase $database
+	 */
+	public static function prepareTokenCountStatement(PdoDatabase $database)
+	{
+		if (self::$tokenCountStatement === null) {
+			self::$tokenCountStatement = $database->prepare('SELECT COUNT(*) FROM oauthtoken WHERE user = :user AND type = :type');
+		}
+	}
+
+	private static function runTokenCount($userId, $database, $tokenType)
+	{
+		if (self::$tokenCountStatement === null) {
+			self::prepareTokenCountStatement($database);
+		}
+
+		self::$tokenCountStatement->execute(array(
+			':user' => $userId,
+			':type' => $tokenType,
+		));
+
+		$tokenCount = self::$tokenCountStatement->fetchColumn();
+		$linked = $tokenCount > 0;
+		self::$tokenCountStatement->closeCursor();
+
+		return $linked;
+	}
+
+	#endregion Static methods
+
+	/**
+	 * OAuthUserHelper constructor.
+	 *
+	 * @param User                 $user
+	 * @param PdoDatabase          $database
+	 * @param IOAuthProtocolHelper $oauthProtocolHelper
+	 * @param SiteConfiguration    $siteConfiguration
+	 */
+	public function __construct(
+		User $user,
+		PdoDatabase $database,
+		IOAuthProtocolHelper $oauthProtocolHelper,
+		SiteConfiguration $siteConfiguration
+	) {
+		$this->user = $user;
+		$this->database = $database;
+		$this->oauthProtocolHelper = $oauthProtocolHelper;
+
+		$this->linked = null;
+		$this->partiallyLinked = null;
+		$this->siteConfiguration = $siteConfiguration;
+
+		self::prepareTokenCountStatement($database);
+		$this->getTokenStatement = $this->database->prepare('SELECT * FROM oauthtoken WHERE user = :user AND type = :type');
+
+		$this->legacyTokens = $this->siteConfiguration->getOauthLegacyConsumerTokens();
+	}
+
+	/**
+	 * Determines if the user is fully connected to OAuth.
+	 *
+	 * @return bool
+	 */
+	public function isFullyLinked()
+	{
+		if ($this->linked === null) {
+			$this->linked = self::userIsFullyLinked($this->user, $this->database);
+		}
+
+		return $this->linked;
+	}
+
+	/**
+	 * Attempts to figure out if a user is partially linked to OAuth, and therefore needs to complete the OAuth
+	 * procedure before configuring.
+	 * @return bool
+	 */
+	public function isPartiallyLinked()
+	{
+		if ($this->partiallyLinked === null) {
+			$this->partiallyLinked = self::userIsPartiallyLinked($this->user, $this->database);
+		}
+
+		return $this->partiallyLinked;
+	}
+
+	public function canCreateAccount()
+	{
+		return $this->isFullyLinked()
+			&& $this->getIdentity(true)->getGrantBasic()
+			&& $this->getIdentity(true)->getGrantHighVolume()
+			&& $this->getIdentity(true)->getGrantCreateAccount();
+	}
+
+	public function canWelcome()
+	{
+		return $this->isFullyLinked()
+			&& $this->getIdentity(true)->getGrantBasic()
+			&& $this->getIdentity(true)->getGrantHighVolume()
+			&& $this->getIdentity(true)->getGrantCreateEditMovePage();
+	}
+
+	/**
+	 * @throws OAuthException
+	 * @throws CurlException
+	 * @throws OptimisticLockFailedException
+	 * @throws Exception
+	 */
+	public function refreshIdentity()
+	{
+		$this->loadIdentity();
+
+		if ($this->identity === null) {
+			$this->identity = new OAuthIdentity();
+			$this->identity->setUserId($this->user->getId());
+			$this->identity->setDatabase($this->database);
+		}
+
+		$token = $this->loadAccessToken();
+
+		try {
+			$rawTicket = $this->oauthProtocolHelper->getIdentityTicket($token->getToken(), $token->getSecret());
+		}
+		catch (Exception $ex) {
+			if (strpos($ex->getMessage(), "mwoauthdatastore-access-token-not-found") !== false) {
+				throw new OAuthException('No approved grants for this access token.', -1, $ex);
+			}
+
+			throw $ex;
+		}
+
+		$this->identity->populate($rawTicket);
+
+		if (!$this->identityIsValid()) {
+			throw new OAuthException('Identity ticket is not valid!');
+		}
+
+		$this->identity->save();
+
+		$this->user->setOnWikiName($this->identity->getUsername());
+		$this->user->save();
+	}
+
+	/**
+	 * @return string
+	 * @throws CurlException
+	 */
+	public function getRequestToken()
+	{
+		$token = $this->oauthProtocolHelper->getRequestToken();
+
+		$this->partiallyLinked = true;
+		$this->linked = false;
+
+		$this->database
+			->prepare('DELETE FROM oauthtoken WHERE user = :user AND type = :type')
+			->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
+
+		$this->database
+			->prepare('INSERT INTO oauthtoken (user, type, token, secret, expiry) VALUES (:user, :type, :token, :secret, DATE_ADD(NOW(), INTERVAL 1 DAY))')
+			->execute(array(
+				':user'   => $this->user->getId(),
+				':type'   => self::TOKEN_REQUEST,
+				':token'  => $token->key,
+				':secret' => $token->secret,
+			));
+
+		return $this->oauthProtocolHelper->getAuthoriseUrl($token->key);
+	}
+
+	/**
+	 * @param $verificationToken
+	 *
+	 * @throws ApplicationLogicException
+	 * @throws CurlException
+	 * @throws OAuthException
+	 * @throws OptimisticLockFailedException
+	 */
+	public function completeHandshake($verificationToken)
+	{
+		$this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_REQUEST));
+
+		/** @var OAuthToken $token */
+		$token = $this->getTokenStatement->fetchObject(OAuthToken::class);
+		$this->getTokenStatement->closeCursor();
+
+		if ($token === false) {
+			throw new ApplicationLogicException('Cannot find request token');
+		}
+
+		$token->setDatabase($this->database);
+
+		$accessToken = $this->oauthProtocolHelper->callbackCompleted($token->getToken(), $token->getSecret(),
+			$verificationToken);
+
+		$clearStatement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :u AND type = :t');
+		$clearStatement->execute(array(':u' => $this->user->getId(), ':t' => self::TOKEN_ACCESS));
+
+		$token->setToken($accessToken->key);
+		$token->setSecret($accessToken->secret);
+		$token->setType(self::TOKEN_ACCESS);
+		$token->setExpiry(null);
+		$token->save();
+
+		$this->partiallyLinked = false;
+		$this->linked = true;
+
+		$this->refreshIdentity();
+	}
+
+	public function detach()
+	{
+		$this->loadIdentity();
+
+		$this->identity->delete();
+		$statement = $this->database->prepare('DELETE FROM oauthtoken WHERE user = :user');
+		$statement->execute(array(':user' => $this->user->getId()));
+
+		$this->identity = null;
+		$this->linked = false;
+		$this->partiallyLinked = false;
+	}
+
+	/**
+	 * @param bool $expiredOk
+	 *
+	 * @return OAuthIdentity
+	 * @throws OAuthException
+	 */
+	public function getIdentity($expiredOk = false)
+	{
+		$this->loadIdentity();
+
+		if (!$this->identityIsValid($expiredOk)) {
+			throw new OAuthException('Stored identity is not valid.');
+		}
+
+		return $this->identity;
+	}
+
+	public function doApiCall($params, $method)
+	{
+		// Ensure we're logged in
+		$params['assert'] = 'user';
+
+		$token = $this->loadAccessToken();
+		return $this->oauthProtocolHelper->apiCall($params, $token->getToken(), $token->getSecret(), $method);
+	}
+
+	/**
+	 * @param bool $expiredOk
+	 *
+	 * @return bool
+	 */
+	private function identityIsValid($expiredOk = false)
+	{
+		$this->loadIdentity();
+
+		if ($this->identity === null) {
+			return false;
+		}
+
+		if ($this->identity->getIssuedAtTime() === false
+			|| $this->identity->getExpirationTime() === false
+			|| $this->identity->getAudience() === false
+			|| $this->identity->getIssuer() === false
+		) {
+			// this isn't populated properly.
+			return false;
+		}
+
+		$issue = DateTimeImmutable::createFromFormat("U", $this->identity->getIssuedAtTime());
+		$now = new DateTimeImmutable();
+
+		if ($issue > $now) {
+			// wat.
+			return false;
+		}
+
+		if ($this->identityExpired() && !$expiredOk) {
+			// soz.
+			return false;
+		}
+
+		if ($this->identity->getAudience() !== $this->siteConfiguration->getOAuthConsumerToken()) {
+			// token not issued for us
+
+			// we allow cases where the cache is expired and the cache is for a legacy token
+			if (!($expiredOk && in_array($this->identity->getAudience(), $this->legacyTokens))) {
+				return false;
+			}
+		}
+
+		if ($this->identity->getIssuer() !== $this->siteConfiguration->getOauthMediaWikiCanonicalServer()) {
+			// token not issued by the right person
+			return false;
+		}
+
+		// can't find a reason to not trust it
+		return true;
+	}
+
+	/**
+	 * @return bool
+	 */
+	public function identityExpired()
+	{
+		// allowed max age
+		$gracePeriod = $this->siteConfiguration->getOauthIdentityGraceTime();
+
+		$expiry = DateTimeImmutable::createFromFormat("U", $this->identity->getExpirationTime());
+		$graceExpiry = $expiry->modify($gracePeriod);
+		$now = new DateTimeImmutable();
+
+		return $graceExpiry < $now;
+	}
+
+	/**
+	 * Loads the OAuth identity from the database for the current user.
+	 */
+	private function loadIdentity()
+	{
+		if ($this->identityLoaded) {
+			return;
+		}
+
+		$statement = $this->database->prepare('SELECT * FROM oauthidentity WHERE user = :user');
+		$statement->execute(array(':user' => $this->user->getId()));
+		/** @var OAuthIdentity $obj */
+		$obj = $statement->fetchObject(OAuthIdentity::class);
+
+		if ($obj === false) {
+			// failed to load identity.
+			$this->identityLoaded = true;
+			$this->identity = null;
+
+			return;
+		}
+
+		$obj->setDatabase($this->database);
+		$this->identityLoaded = true;
+		$this->identity = $obj;
+	}
+
+	/**
+	 * @return OAuthToken
+	 * @throws OAuthException
+	 */
+	private function loadAccessToken()
+	{
+		if (!$this->accessTokenLoaded) {
+			$this->getTokenStatement->execute(array(':user' => $this->user->getId(), ':type' => self::TOKEN_ACCESS));
+			/** @var OAuthToken $token */
+			$token = $this->getTokenStatement->fetchObject(OAuthToken::class);
+			$this->getTokenStatement->closeCursor();
+
+			if ($token === false) {
+				throw new OAuthException('Access token not found!');
+			}
+
+			$this->accessToken = $token;
+			$this->accessTokenLoaded = true;
+		}
+
+		return $this->accessToken;
+	}
 }