jwtValidate::signature() - Code Metrics - Inspection of "Refactoring JWT validate payload" - vince-scarpa/responsibleAPI - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 1b4e40...151dda )

by Vince

created 2020-06-20 00:06 UTC

jwtValidate::signature() A

↳ Parent: jwtValidate

Complexity

Conditions	6
Paths	4

Size

Total Lines	28
Code Lines	19

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
cc	6
eloc	19
c	1
b	0
f	0
nc	4
nop	4
dl	0
loc	28
rs	9.0111

<?php
/**
 * ==================================
 * Responsible PHP API
 * ==================================
 *
 * @link Git https://github.com/vince-scarpa/responsibleAPI.git
 *
 * @api Responible API
 * @package responsible\core\oauth
 *
 * @author Vince scarpa <[email protected]>
 *
 */
namespace responsible\core\auth;

use responsible\core\server;
use responsible\core\encoder;
use responsible\core\exception;
use responsible\core\route;
use responsible\core\user;

class jwtValidate extends jwt
{
    /**
     * [$TIMESTAMP]
     * @var int
     */
    protected static $TIMESTAMP;

    /**
     * [$LEEWAY]
     * @var int
     */
    protected static $LEEWAY = 0;

    /**
     * [$ALGORITHM]
     * @var string
     */
    private static $ALGORITHM;

    /**
     * [$isPayloadValid Validation placeholders]
     * @var array
     */
    protected static $isPayloadValid = [
        "iss" => false,
        "sub" => false,
        "iat" => false,
        "nbf" => false,
        "exp" => false,
    ];

    /**
     * [header Validate the header object]
     * First segment of the token
     * @return bool
     */
    public static function header(array $headObject = [])
    {
        if (
            empty($headObject) ||
            !self::typ($headObject) ||
            !self::alg($headObject)
        ) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('denied_token'))
                ->error('UNAUTHORIZED');
        }
    }

    /**
     * [payload Validate the payload object]
     * Second segment of the token
     * @return bool
     */
    public static function payload(array $payloadObject = [])
    {
        if( self::isAnonymousScope($payloadObject) ) {
            return true;
        }

        self::iss($payloadObject);
        self::sub($payloadObject);
        self::iat($payloadObject);
        self::nbf($payloadObject);
        self::exp($payloadObject);

        if ((true === in_array(false, self::$isPayloadValid))) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('denied_token'))
                ->error('UNAUTHORIZED');
        }
    }

    /**
     * Check if the scope is anonymous
     * @return boolean
     */
    private static function isAnonymousScope($payloadObject)
    {
        return (isset($payloadObject['scope']) && $payloadObject['scope'] == 'anonymous');
    }

    /**
     * [signature - Validate the signature object]
     * Third segment of the token
     * @return bool
     */
    public static function signature($jwtHead, $jwtPayload, $signature, $key)
    {
        if (empty($jwtHead) ||
            empty($jwtPayload) ||
            empty($signature) ||
            empty($key)
        ) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('denied_token'))
                ->error('UNAUTHORIZED');
        }

        $cipher = new encoder\cipher;

        $hashed = $cipher->encode(
            $cipher->hash(
                self::$ALGORITHM,
                $jwtHead . '.' . $jwtPayload,
                $key
            )
        );

        if (!$cipher->hashCompare($signature, $hashed)) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('denied_token'))
                ->error('UNAUTHORIZED');
        }
    }

    /**
     * [typ Issuer claim]
     *
     * @return bool
     */
    public static function typ($headObject)
    {
        if (!isset($headObject['typ']) ||
            (isset($headObject['typ']) && empty($headObject))
        ) {
            return;
        }
        return true;
    }

    /**
     * [alg Issuer claim]
     *
     * @return bool
     */
    public static function alg($headObject)
    {
        if (!isset($headObject['alg']) ||
            (isset($headObject['alg']) && empty($headObject)) &&
            self::getAlgorithm($headObject['alg'])
        ) {
            return;
        }

        self::algorithm($headObject['alg']);

        return true;
    }

    /**
     * [iss Issuer claim]
     *
     * @return bool
     */
    public static function iss($payloadObject)
    {
        if (!isset($payloadObject['iss']) ||
            (isset($payloadObject['iss']) && empty($payloadObject))
        ) {
            return;
        }

        $router = new route\router;
        $router->route();

        if ($payloadObject['iss'] !== $router->getIssuer(true)) {
            return;
        }

        self::$isPayloadValid['iss'] = true;
        return true;
    }

    /**
     * [sub Subject claim]
     * The Responsible API uses the "Subject" claim as a placeholder for account Ids
     *
     * @return bool
     */
    public static function sub($payloadObject)
    {
        $server = new server([], parent::$options);
        if ($server->isMockTest()) {
            self::$isPayloadValid['sub'] = true;
            return true;
        }

        if (!isset($payloadObject['sub']) ||
            (isset($payloadObject['sub']) && empty($payloadObject))
        ) {
            return;
        }

        $account = (object) (new user\user)
            ->setOptions(parent::$options)
            ->load($payloadObject['sub'], ['refreshToken' => false])
        ;

        if (empty($account)) {
            return;
        } else {
            if (!isset($account->account_id)) {
                return;
            }

            if ((int) $account->account_id !== (int) $payloadObject['sub']) {
                return;
            }
        }

        self::$isPayloadValid['sub'] = true;
        return true;
    }

    /**
     * [iat Issued at claim]
     *
     * @return bool
     */
    public static function iat($payloadObject)
    {
        if (!isset($payloadObject['iat']) ||
            (isset($payloadObject['iat']) && empty($payloadObject))
        ) {
            return;
        }

        if ($payloadObject['iat'] > self::getTimestamp()) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('not_ready'))
                ->error('NO_CONTENT');
        }

        self::$isPayloadValid['iat'] = true;
        return true;
    }

    /**
     * [nbf Not before claim]
     *
     * @return bool
     */
    public static function nbf($payloadObject)
    {
        if (!isset($payloadObject['nbf']) ||
            (isset($payloadObject['nbf']) && empty($payloadObject))
        ) {
            return;
        }

        if ($payloadObject['nbf'] > self::getTimestamp()) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('not_ready'))
                ->error('NO_CONTENT');
        }

        self::$isPayloadValid['nbf'] = true;
        return true;
    }

    /**
     * [exp Expiration claim this optional so if its not set return true]
     *
     * @return bool
     */
    public static function exp($payloadObject)
    {
        if (!isset($payloadObject['exp']) ||
            (isset($payloadObject['exp']) && empty($payloadObject))
        ) {
            return;
        }

        if ($payloadObject['exp'] <= (int) (self::$TIMESTAMP - self::$LEEWAY)) {
            (new exception\errorException)
                ->setOptions(parent::$options)
                ->message(self::messages('expired'))
                ->error('UNAUTHORIZED');
        }

        self::$isPayloadValid['exp'] = true;
        return true;
    }

    /**
     * [leeway Inherit the leeway offset]
     * @param  int $leeway [integer in seconds]
     * @return void
     */
    public static function leeway($leeway)
    {
        self::$LEEWAY = $leeway;
    }

    /**
     * [timestamp Inherit the current timestamp (now)]
     * @param  int $timestamp [integer in seconds]
     * @return void
     */
    public static function timestamp($timestamp)
    {
        self::$TIMESTAMP = $timestamp;
    }

    /**
     * [getTimestamp Add both the timestamp (now) and the leeway]
     * @return int
     */
    private static function getTimestamp()
    {
        return (int) (self::$TIMESTAMP + self::$LEEWAY);
    }

    /**
     * [algorithm Set the requested hash algorithm]
     * @return string
     */
    public static function algorithm($algo = 'SHA256')
    {
        if ($algo == 'HS256') {
            $algo = 'sha256';
        }
        self::$ALGORITHM = $algo;
    }
}


1			<?php
2			/**
3			* ==================================
4			* Responsible PHP API
5			* ==================================
6			*
7			* @link Git https://github.com/vince-scarpa/responsibleAPI.git
8			*
9			* @api Responible API
10			* @package responsible\core\oauth
11			*
12			* @author Vince scarpa <[email protected]>
13			*
14			*/
15			namespace responsible\core\auth;
16
17			use responsible\core\server;
18			use responsible\core\encoder;
19			use responsible\core\exception;
20			use responsible\core\route;
21			use responsible\core\user;
22
23			class jwtValidate extends jwt
24			{
25			/**
26			* [$TIMESTAMP]
27			* @var int
28			*/
29			protected static $TIMESTAMP;
30
31			/**
32			* [$LEEWAY]
33			* @var int
34			*/
35			protected static $LEEWAY = 0;
36
37			/**
38			* [$ALGORITHM]
39			* @var string
40			*/
41			private static $ALGORITHM;
42
43			/**
44			* [$isPayloadValid Validation placeholders]
45			* @var array
46			*/
47			protected static $isPayloadValid = [
48			"iss" => false,
49			"sub" => false,
50			"iat" => false,
51			"nbf" => false,
52			"exp" => false,
53			];
54
55			/**
56			* [header Validate the header object]
57			* First segment of the token
58			* @return bool
59			*/
60			public static function header(array $headObject = [])
61			{
62			if (
63			empty($headObject) \|\|
64			!self::typ($headObject) \|\|
65			!self::alg($headObject)
66			) {
67			(new exception\errorException)
68			->setOptions(parent::$options)
69			->message(self::messages('denied_token'))
70			->error('UNAUTHORIZED');
71			}
72			}
73
74			/**
75			* [payload Validate the payload object]
76			* Second segment of the token
77			* @return bool
78			*/
79			public static function payload(array $payloadObject = [])
80			{
81			if( self::isAnonymousScope($payloadObject) ) {
82			return true;
83			}
84
85			self::iss($payloadObject);
86			self::sub($payloadObject);
87			self::iat($payloadObject);
88			self::nbf($payloadObject);
89			self::exp($payloadObject);
90
91			if ((true === in_array(false, self::$isPayloadValid))) {
92			(new exception\errorException)
93			->setOptions(parent::$options)
94			->message(self::messages('denied_token'))
95			->error('UNAUTHORIZED');
96			}
97			}
98
99			/**
100			* Check if the scope is anonymous
101			* @return boolean
102			*/
103			private static function isAnonymousScope($payloadObject)
104			{
105			return (isset($payloadObject['scope']) && $payloadObject['scope'] == 'anonymous');
106			}
107
108			/**
109			* [signature - Validate the signature object]
110			* Third segment of the token
111			* @return bool
112			*/
113			public static function signature($jwtHead, $jwtPayload, $signature, $key)
114			{
115			if (empty($jwtHead) \|\|
116			empty($jwtPayload) \|\|
117			empty($signature) \|\|
118			empty($key)
119			) {
120			(new exception\errorException)
121			->setOptions(parent::$options)
122			->message(self::messages('denied_token'))
123			->error('UNAUTHORIZED');
124			}
125
126			$cipher = new encoder\cipher;
127
128			$hashed = $cipher->encode(
129			$cipher->hash(
130			self::$ALGORITHM,
131			$jwtHead . '.' . $jwtPayload,
132			$key
133			)
134			);
135
136			if (!$cipher->hashCompare($signature, $hashed)) {
137			(new exception\errorException)
138			->setOptions(parent::$options)
139			->message(self::messages('denied_token'))
140			->error('UNAUTHORIZED');
141			}
142			}
143
144			/**
145			* [typ Issuer claim]
146			*
147			* @return bool
148			*/
149			public static function typ($headObject)
150			{
151			if (!isset($headObject['typ']) \|\|
152			(isset($headObject['typ']) && empty($headObject))
153			) {
154			return;
155			}
156			return true;
157			}
158
159			/**
160			* [alg Issuer claim]
161			*
162			* @return bool
163			*/
164			public static function alg($headObject)
165			{
166			if (!isset($headObject['alg']) \|\|
167			(isset($headObject['alg']) && empty($headObject)) &&
168			self::getAlgorithm($headObject['alg'])
169			) {
170			return;
171			}
172
173			self::algorithm($headObject['alg']);
174
175			return true;
176			}
177
178			/**
179			* [iss Issuer claim]
180			*
181			* @return bool
182			*/
183			public static function iss($payloadObject)
184			{
185			if (!isset($payloadObject['iss']) \|\|
186			(isset($payloadObject['iss']) && empty($payloadObject))
187			) {
188			return;
189			}
190
191			$router = new route\router;
192			$router->route();
193
194			if ($payloadObject['iss'] !== $router->getIssuer(true)) {
195			return;
196			}
197
198			self::$isPayloadValid['iss'] = true;
199			return true;
200			}
201
202			/**
203			* [sub Subject claim]
204			* The Responsible API uses the "Subject" claim as a placeholder for account Ids
205			*
206			* @return bool
207			*/
208			public static function sub($payloadObject)
209			{
210			$server = new server([], parent::$options);
211			if ($server->isMockTest()) {
212			self::$isPayloadValid['sub'] = true;
213			return true;
214			}
215
216			if (!isset($payloadObject['sub']) \|\|
217			(isset($payloadObject['sub']) && empty($payloadObject))
218			) {
219			return;
220			}
221
222			$account = (object) (new user\user)
223			->setOptions(parent::$options)
224			->load($payloadObject['sub'], ['refreshToken' => false])
225			;
226
227			if (empty($account)) {
228			return;
229			} else {
230			if (!isset($account->account_id)) {
231			return;
232			}
233
234			if ((int) $account->account_id !== (int) $payloadObject['sub']) {
235			return;
236			}
237			}
238
239			self::$isPayloadValid['sub'] = true;
240			return true;
241			}
242
243			/**
244			* [iat Issued at claim]
245			*
246			* @return bool
247			*/
248			public static function iat($payloadObject)
249			{
250			if (!isset($payloadObject['iat']) \|\|
251			(isset($payloadObject['iat']) && empty($payloadObject))
252			) {
253			return;
254			}
255
256			if ($payloadObject['iat'] > self::getTimestamp()) {
257			(new exception\errorException)
258			->setOptions(parent::$options)
259			->message(self::messages('not_ready'))
260			->error('NO_CONTENT');
261			}
262
263			self::$isPayloadValid['iat'] = true;
264			return true;
265			}
266
267			/**
268			* [nbf Not before claim]
269			*
270			* @return bool
271			*/
272			public static function nbf($payloadObject)
273			{
274			if (!isset($payloadObject['nbf']) \|\|
275			(isset($payloadObject['nbf']) && empty($payloadObject))
276			) {
277			return;
278			}
279
280			if ($payloadObject['nbf'] > self::getTimestamp()) {
281			(new exception\errorException)
282			->setOptions(parent::$options)
283			->message(self::messages('not_ready'))
284			->error('NO_CONTENT');
285			}
286
287			self::$isPayloadValid['nbf'] = true;
288			return true;
289			}
290
291			/**
292			* [exp Expiration claim this optional so if its not set return true]
293			*
294			* @return bool
295			*/
296			public static function exp($payloadObject)
297			{
298			if (!isset($payloadObject['exp']) \|\|
299			(isset($payloadObject['exp']) && empty($payloadObject))
300			) {
301			return;
302			}
303
304			if ($payloadObject['exp'] <= (int) (self::$TIMESTAMP - self::$LEEWAY)) {
305			(new exception\errorException)
306			->setOptions(parent::$options)
307			->message(self::messages('expired'))
308			->error('UNAUTHORIZED');
309			}
310
311			self::$isPayloadValid['exp'] = true;
312			return true;
313			}
314
315			/**
316			* [leeway Inherit the leeway offset]
317			* @param int $leeway [integer in seconds]
318			* @return void
319			*/
320			public static function leeway($leeway)
321			{
322			self::$LEEWAY = $leeway;
323			}
324
325			/**
326			* [timestamp Inherit the current timestamp (now)]
327			* @param int $timestamp [integer in seconds]
328			* @return void
329			*/
330			public static function timestamp($timestamp)
331			{
332			self::$TIMESTAMP = $timestamp;
333			}
334
335			/**
336			* [getTimestamp Add both the timestamp (now) and the leeway]
337			* @return int
338			*/
339			private static function getTimestamp()
340			{
341			return (int) (self::$TIMESTAMP + self::$LEEWAY);
342			}
343
344			/**
345			* [algorithm Set the requested hash algorithm]
346			* @return string
347			*/
348			public static function algorithm($algo = 'SHA256')
349			{
350			if ($algo == 'HS256') {
351			$algo = 'sha256';
352			}
353			self::$ALGORITHM = $algo;
354			}
355			}
356

vince-scarpa / responsibleAPI

Push — master ( 1b4e40...151dda )

jwtValidate::signature() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like