FFCMS\Controllers\API\API::validateAccess()

Complexity

Conditions	28
Paths	> 20000

Size

Total Lines	131
Code Lines	74

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    protected function validateAccess()
    {
        $this->dnsbl(); // always check if dns blacklisted

        $f3 = \Base::instance();

        // return if forcing access to https and not https
        if ('http' == $f3->get('SCHEME') && !empty($f3->get('api.https'))) {
            $this->failure('api_connection_error', "Connection only allowed via HTTPS!", 400);
            $this->setOAuthError('unauthorized_client');
            return;
        }

        $oAuth2Model = Models\OAuth2::instance();
        $tokensMapper = $oAuth2Model->getTokensMapper();

        // get token from request to set the user and app
        // override if anything in basic auth or client_id/secret after
        $appLogin = false;

$appLogin is not used, you could remove the assignment.

        $token = $f3->get('REQUEST.access_token');
        if (!empty($token)) {
            $tokensMapper->load(['token = ?', $token]);
            // token does not exist!
            if (null == $tokensMapper->uuid) {
                $this->failure('authentication_error', "The token does not exist!", 401);
                $this->setOAuthError('invalid_grant');
                return false;
            }
            // check token is not out-of-date
            if (time() > strtotime($tokensMapper->expires)) {
                $this->failure('authentication_error', "The token expired!", 401);
                $this->setOAuthError('invalid_grant');
                return false;
            }
        }

        // if token found load the user for the token
        $usersModel = Models\Users::instance();
        if (null !== $tokensMapper->users_uuid) {
            $usersModel->getUserByUUID($tokensMapper->users_uuid);
        }

        // login with client_id and client_secret in request
        $clientId = $f3->get('REQUEST.client_id');
        $clientSecret = $f3->get('REQUEST.client_secret');

        $appLogin = (!empty($clientId) && !empty($clientSecret)
                && $this->authenticateClientIdSecret($clientId, $clientSecret));

        // check if login via http basic auth
        if (!empty($f3->get('REQUEST.PHP_AUTH_USER'))) {
            // try to login as email:password
            if ($this->basicAuthenticateLoginPassword()) {
                $email = $f3->get('REQUEST.PHP_AUTH_USER');
                $usersModel->getUserByEmail($email);
            } elseif ($this->basicAuthenticateClientIdSecret()) {
                $appLogin = true; // client_id:client_secret
            }
        }

        // login with app credentials: client_id/client_secret?
        // if so fetch app and user information
        $usersMapper = $usersModel->getMapper();
        $appsMapper = $oAuth2Model->getAppsMapper();
        if (!empty($appLogin)) {
            // set app in f3
            $data = $appsMapper->cast();
            $f3->set('api_app', $data);
            $usersMapper->load(['uuid = ?', $appsMapper->users_uuid]);
        }

        // check user has api access enabled
        // has to have 'api' in group
        $groups = empty($usersMapper->groups) ? [] : preg_split("/[\s,]+/", $usersMapper->groups);
        $f3->set('is_admin', 0);
        if (empty($token)) {
            if (!in_array('api', $groups)) {
                // clear authorized app as user doesn't have access
                $usersMapper->reset();
                $f3->clear('api_app');
            }
            if (in_array('admin', $groups)) {
                $f3->set('is_admin', 1);
            }
        }

        // fetch user information if available
        if (null !== $usersMapper->uuid) {
            $data = $usersMapper->cast();
            $f3->set('user', $data);
            $f3->set('uuid', $f3->set('uuid', $usersMapper->uuid));
        }

        $app = $f3->get('api_app'); // authenticated as a client app
        $user = $f3->get('user');   // authenticated as a user

        // fetch scope if available
        if (!empty($app) && !empty($user)) {
            $tokensMapper->load(['client_id = ? AND users_uuid = ?', $app['client_id'], $user['uuid']]);
        }

        // get the scopes, this might have come from the token auth
        $scope = $f3->get('REQUEST.scope');
        $scopes = empty($scope) ? [] : preg_split("/[\s,]+/", $scope);
        if (!empty($tokensMapper->users_uuid)) {
            $f3->set('user_scopes', $scopes);
            // also check the token is valid
            if (!$appLogin && time() > strtotime($tokensMapper->expires)) {
                $this->failure('authentication_error', "The token expired!", 401);
                $this->setOAuthError('invalid_grant');
                return false;
            }
        }

        // set user groups
        $f3->set('is_admin', in_array('admin', $groups));
        $groups = empty($usersMapper->groups) ? [] : preg_split("/[\s,]+/", $usersMapper->groups);
        if (!empty($groups)) {
            $f3->set('user_groups', $groups);
        }

        $userAuthenticated = (is_array($user) || is_array($app));
        if (!$userAuthenticated) {
            $this->failure('authentication_error', "Not possible to authenticate the request.", 400);
            $this->setOAuthError('invalid_credentials');

            return false;
        }

        return true;
    }