wedevBr /
mati-laravel
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace WeDevBr\Mati; |
||
| 4 | |||
| 5 | use Illuminate\Http\Client\RequestException; |
||
| 6 | use Illuminate\Http\Client\Response; |
||
| 7 | use Illuminate\Support\Collection; |
||
| 8 | use Illuminate\Support\Facades\Http; |
||
| 9 | use LogicException; |
||
| 10 | use TypeError; |
||
| 11 | use WeDevBr\Mati\Support\Contracts\IdentityInputInterface; |
||
| 12 | use WeDevBr\Mati\Support\Contracts\MatiClientInterface; |
||
| 13 | |||
| 14 | /** |
||
| 15 | * Mati HTTP client |
||
| 16 | * |
||
| 17 | * @author Gabriel Mineiro <[email protected]> |
||
| 18 | */ |
||
| 19 | class MatiHttpClient implements MatiClientInterface |
||
| 20 | { |
||
| 21 | /** |
||
| 22 | * Bearer token used in API calls |
||
| 23 | * |
||
| 24 | * @var string |
||
| 25 | */ |
||
| 26 | protected $access_token; |
||
| 27 | |||
| 28 | public function __construct(string $access_token = null) |
||
| 29 | { |
||
| 30 | $this->access_token = $access_token; |
||
| 31 | } |
||
| 32 | |||
| 33 | /** |
||
| 34 | * Set an access token to be used by the requests |
||
| 35 | * |
||
| 36 | * @param string $access_token |
||
| 37 | * @return self |
||
| 38 | */ |
||
| 39 | public function withToken(string $access_token): MatiClientInterface |
||
| 40 | { |
||
| 41 | $this->access_token = $access_token; |
||
| 42 | return $this; |
||
| 43 | } |
||
| 44 | |||
| 45 | /** |
||
| 46 | * Get an access token from the OAuth service |
||
| 47 | * |
||
| 48 | * @param string $client_id |
||
| 49 | * @param string $client_secret |
||
| 50 | * @return Response |
||
| 51 | * @throws RequestException |
||
| 52 | */ |
||
| 53 | public function getAccessToken(string $client_id, string $client_secret): Response |
||
| 54 | { |
||
| 55 | return Http::withBasicAuth($client_id, $client_secret) |
||
| 56 | ->asForm() |
||
| 57 | ->post( |
||
| 58 | $this->getAuthURL(), |
||
| 59 | ['grant_type' => 'client_credentials', 'scope' => 'verification_flow'] |
||
| 60 | ) |
||
| 61 | ->throw(); |
||
| 62 | } |
||
| 63 | |||
| 64 | /** |
||
| 65 | * Create a new verification process |
||
| 66 | * |
||
| 67 | * @param array|null $metadata Key/Value pair of data to identify the user |
||
| 68 | * @param string|null $flowId |
||
| 69 | * @param string|null $user_ip |
||
| 70 | * @param string|null $user_agent |
||
| 71 | * @return Response |
||
| 72 | * @throws RequestException|LogicException |
||
| 73 | */ |
||
| 74 | public function createVerification( |
||
| 75 | $metadata = null, |
||
| 76 | $flowId = null, |
||
| 77 | $user_ip = null, |
||
| 78 | $user_agent = null |
||
| 79 | ): Response { |
||
| 80 | if (!$this->access_token) { |
||
| 81 | throw new LogicException('No access token given to create identity'); |
||
| 82 | } |
||
| 83 | |||
| 84 | $payload = []; |
||
| 85 | $request = Http::withToken($this->access_token); |
||
| 86 | |||
| 87 | if ($metadata) { |
||
| 88 | $payload['metadata'] = $metadata; |
||
| 89 | } |
||
| 90 | |||
| 91 | if ($flowId) { |
||
|
0 ignored issues
–
show
|
|||
| 92 | $payload['flowId'] = $flowId; |
||
| 93 | } |
||
| 94 | |||
| 95 | if ($user_ip) { |
||
|
0 ignored issues
–
show
The expression
$user_ip of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.
In PHP, under loose comparison (like For '' == false // true
'' == null // true
'ab' == false // false
'ab' == null // false
// It is often better to use strict comparison
'' === false // false
'' === null // false
Loading history...
|
|||
| 96 | $request->withHeaders(['X-Forwarded-For' => $user_ip]); |
||
| 97 | } |
||
| 98 | |||
| 99 | if ($user_agent) { |
||
|
0 ignored issues
–
show
The expression
$user_agent of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.
In PHP, under loose comparison (like For '' == false // true
'' == null // true
'ab' == false // false
'ab' == null // false
// It is often better to use strict comparison
'' === false // false
'' === null // false
Loading history...
|
|||
| 100 | $request->withHeaders(['User-Agent' => $user_agent]); |
||
| 101 | } |
||
| 102 | |||
| 103 | return $request->post($this->getApiUrl() . '/verifications', $payload) |
||
| 104 | ->throw(); |
||
| 105 | } |
||
| 106 | |||
| 107 | /** |
||
| 108 | * Send an input for a document, selfie or other file required during a process |
||
| 109 | * |
||
| 110 | * @param string $identity_id |
||
| 111 | * @param IdentityInputInterface[]|Collection $inputs |
||
| 112 | * |
||
| 113 | * @throws LogicException|RequestException|TypeError |
||
| 114 | * @return Response |
||
| 115 | */ |
||
| 116 | public function sendInput(string $identity_id, $inputs): Response |
||
| 117 | { |
||
| 118 | if (!$this->access_token) { |
||
| 119 | throw new LogicException('No access token given to send input'); |
||
| 120 | } |
||
| 121 | |||
| 122 | $inputs_collection = null; |
||
| 123 | |||
| 124 | if (is_array($inputs)) { |
||
| 125 | $inputs_collection = collect($inputs); |
||
| 126 | } elseif ($inputs instanceof Collection) { |
||
| 127 | $inputs_collection = $inputs; |
||
| 128 | } else { |
||
| 129 | throw new TypeError('Inputs param must be an array or a Collection'); |
||
| 130 | } |
||
| 131 | |||
| 132 | if ( |
||
| 133 | !$inputs_collection->every(function ($input) { |
||
| 134 | return $input instanceof IdentityInputInterface; |
||
| 135 | }) |
||
| 136 | ) { |
||
| 137 | throw new TypeError('Every item of inputs must be instance of IdentityInputInterface'); |
||
| 138 | } |
||
| 139 | |||
| 140 | $request = Http::withToken($this->access_token) |
||
| 141 | ->asMultipart(); |
||
| 142 | |||
| 143 | foreach ($inputs_collection as $input) { |
||
| 144 | $request->attach('document', $input->getFileContents(), $input->getFileName()); |
||
| 145 | } |
||
| 146 | |||
| 147 | return $request->post( |
||
| 148 | $this->getApiUrl() . "/identities/$identity_id/send-input", |
||
| 149 | ['inputs' => $inputs_collection->toJson()] |
||
| 150 | ) |
||
| 151 | ->throw(); |
||
| 152 | } |
||
| 153 | |||
| 154 | /** |
||
| 155 | * Retrieve info about a verification process |
||
| 156 | * |
||
| 157 | * @param string $resource_url URL received by webhook |
||
| 158 | * |
||
| 159 | * @throws RequestException |
||
| 160 | * @return Response |
||
| 161 | */ |
||
| 162 | public function retrieveResourceDataFromUrl(string $resource_url) |
||
| 163 | { |
||
| 164 | return Http::withToken($this->access_token) |
||
| 165 | ->get($resource_url) |
||
| 166 | ->throw(); |
||
| 167 | } |
||
| 168 | |||
| 169 | /** |
||
| 170 | * Retrieve info about a verification process |
||
| 171 | * |
||
| 172 | * @param string $verification_id |
||
| 173 | * |
||
| 174 | * @throws RequestException |
||
| 175 | * @return Response |
||
| 176 | */ |
||
| 177 | public function retrieveResourceDataByVerificationId(string $verification_id) |
||
| 178 | { |
||
| 179 | return $this->retrieveResourceDataFromUrl( |
||
| 180 | $this->getApiUrl() . "/verifications/$verification_id" |
||
| 181 | ); |
||
| 182 | } |
||
| 183 | |||
| 184 | /** |
||
| 185 | * Download the file sent by the user during the verification process |
||
| 186 | * |
||
| 187 | * @param string $media_url |
||
| 188 | * |
||
| 189 | * @throws RequestException |
||
| 190 | * @return Response |
||
| 191 | */ |
||
| 192 | public function downloadVerificationMedia(string $media_url) |
||
| 193 | { |
||
| 194 | return Http::withToken($this->access_token) |
||
| 195 | ->get($media_url) |
||
| 196 | ->throw(); |
||
| 197 | } |
||
| 198 | |||
| 199 | /** |
||
| 200 | * Get auth API URL |
||
| 201 | * |
||
| 202 | * @return string |
||
| 203 | */ |
||
| 204 | protected function getAuthUrl() |
||
| 205 | { |
||
| 206 | return config('mati')['auth_url']; |
||
| 207 | } |
||
| 208 | |||
| 209 | /** |
||
| 210 | * Get REST API URL |
||
| 211 | * |
||
| 212 | * @return string |
||
| 213 | */ |
||
| 214 | protected function getApiUrl() |
||
| 215 | { |
||
| 216 | return config('mati')['api_url']; |
||
| 217 | } |
||
| 218 | } |
||
| 219 |
In PHP, under loose comparison (like
==, or!=, orswitchconditions), values of different types might be equal.For
stringvalues, the empty string''is a special case, in particular the following results might be unexpected: