Yiisoft\Yii\AuthClient\AbstractOpenId::discover()

Complexity

Conditions	26
Paths	147

Size

Total Lines	165
Code Lines	97

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function discover(string $url): array
    {
        if (empty($url)) {
            throw new \RuntimeException('No identity supplied.');
        }
        $result = [
            'url' => null,
            'version' => null,
            'identity' => $url,
            'identifier_select' => false,
            'ax' => false,
            'sreg' => false,
        ];

        // Use xri.net proxy to resolve i-name identities
        if (!preg_match('#^https?:#', $url)) {
            $url = 'https://xri.net/' . $url;
        }

        /* We save the original url in case of Yadis discovery failure.
        It can happen when we'll be lead to an XRDS document
        which does not have any OpenID2 services.*/
        $originalUrl = $url;

        // A flag to disable yadis discovery in case of failure in headers.
        $yadis = true;

        // We'll jump a maximum of 5 times, to avoid endless redirections.
        for ($i = 0; $i < 5; $i++) {
            if ($yadis) {
                $request = $this->createRequest('HEAD', $url);
                $headers = [];
                $response = $this->sendRequest($request);
                foreach ($response->getHeaders() as $name => $values) {
                    $headers[strtolower($name)] = array_pop($values);
                }

                $next = false;
                if (isset($headers['x-xrds-location'])) {
                    $url = $this->buildUrl($url, trim($headers['x-xrds-location']));
                    $next = true;
                }

                if (isset($headers['content-type'])
                    && (strpos($headers['content-type'], 'application/xrds+xml') !== false
                        || strpos($headers['content-type'], 'text/xml') !== false)
                ) {
                    /* Apparently, some providers return XRDS documents as text/html.
                    While it is against the spec, allowing this here shouldn't break
                    compatibility with anything.
                    ---
                    Found an XRDS document, now let's find the server, and optionally delegate.*/
                    $content = $this->sendRequest(
                        $request->withMethod('GET')->withUri($request->getUri()->withPath($url))
                    )->getBody()->getContents();

                    preg_match_all('#<Service.*?>(.*?)</Service>#s', $content, $m);
                    foreach ($m[1] as $content) {
                        $content = ' ' . $content; // The space is added, so that strpos doesn't return 0.

                        // OpenID 2
                        $ns = preg_quote('http://specs.openid.net/auth/2.0/', '#');
                        if (preg_match('#<Type>\s*' . $ns . '(server|signon)\s*</Type>#s', $content, $type)) {
                            if ($type[1] === 'server') {
                                $result['identifier_select'] = true;
                            }

                            preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
                            preg_match('#<(Local|Canonical)ID>(.*)</\1ID>#', $content, $delegate);
                            if (empty($server)) {
                                throw new \RuntimeException('No servers found!');
                            }
                            // Does the server advertise support for either AX or SREG?
                            $result['ax'] = (bool)strpos($content, '<Type>http://openid.net/srv/ax/1.0</Type>');
                            $result['sreg'] = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
                                || strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');

                            $server = $server[1];
                            if (isset($delegate[2])) {
                                $result['identity'] = trim($delegate[2]);
                            }

                            $result['url'] = $server;
                            $result['version'] = 2;

                            return $result;
                        }

                        // OpenID 1.1
                        $ns = preg_quote('http://openid.net/signon/1.1', '#');
                        if (preg_match('#<Type>\s*' . $ns . '\s*</Type>#s', $content)) {
                            preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
                            preg_match('#<.*?Delegate>(.*)</.*?Delegate>#', $content, $delegate);
                            if (empty($server)) {
                                throw new \RuntimeException('No servers found!');
                            }
                            // AX can be used only with OpenID 2.0, so checking only SREG
                            $result['sreg'] = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
                                || strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');

                            $server = $server[1];
                            if (isset($delegate[1])) {
                                $result['identity'] = $delegate[1];
                            }

                            $result['url'] = $server;
                            $result['version'] = 1;

                            return $result;
                        }
                    }

                    $next = true;

The assignment to $next is dead and can be removed.

                    $yadis = false;

The assignment to $yadis is dead and can be removed.

                    $url = $originalUrl;

The assignment to $url is dead and can be removed.

                    $content = null;

The assignment to $content is dead and can be removed.

                    break;
                }
                if ($next) {
                    continue;
                }

                // There are no relevant information in headers, so we search the body.
                $content = $this->sendRequest(
                    $request->withMethod('GET')->withUri($request->getUri()->withPath($url))
                )->getBody()->getContents();

                $location = $this->extractHtmlTagValue($content, 'meta', 'http-equiv', 'X-XRDS-Location', 'content');
                if ($location) {
                    $url = $this->buildUrl($url, $location);

It seems like $location can also be of type true; however, parameter $additionalUrl of Yiisoft\Yii\AuthClient\AbstractOpenId::buildUrl() does only seem to accept array|string, maybe add an additional type check?

                    continue;
                }
            }

            if (!isset($content)) {
                $request = $this->createRequest('GET', $url);
                $content = $this->sendRequest($request);
            }

            // At this point, the YADIS Discovery has failed, so we'll switch to openid2 HTML discovery, then fallback to openid 1.1 discovery.
            $server = $this->extractHtmlTagValue($content, 'link', 'rel', 'openid2.provider', 'href');
            if (!$server) {
                // The same with openid 1.1
                $server = $this->extractHtmlTagValue($content, 'link', 'rel', 'openid.server', 'href');
                $delegate = $this->extractHtmlTagValue($content, 'link', 'rel', 'openid.delegate', 'href');
                $version = 1;
            } else {
                $delegate = $this->extractHtmlTagValue($content, 'link', 'rel', 'openid2.local_id', 'href');
                $version = 2;
            }

            if ($server) {
                // We found an OpenID2 OP Endpoint
                if ($delegate) {
                    // We have also found an OP-Local ID.
                    $result['identity'] = $delegate;
                }
                $result['url'] = $server;
                $result['version'] = $version;

                return $result;
            }
            throw new \RuntimeException('No servers found!');
        }
        throw new \RuntimeException('Endless redirection!');
    }