1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace Zemit\Provider\Jwt; |
4
|
|
|
|
5
|
|
|
use Phalcon\Security\JWT\Builder; |
6
|
|
|
use Phalcon\Security\JWT\Exceptions\ValidatorException; |
7
|
|
|
use Phalcon\Security\JWT\Signer\Hmac; |
8
|
|
|
use Phalcon\Security\JWT\Token\Parser; |
9
|
|
|
use Phalcon\Security\JWT\Signer\AbstractSigner; |
10
|
|
|
use Phalcon\Security\JWT\Token\Token; |
11
|
|
|
use Phalcon\Security\JWT\Validator; |
12
|
|
|
|
13
|
|
|
/** |
14
|
|
|
* allow you to issue, parse and validate JSON Web Tokens as described in RFC 7519. |
15
|
|
|
* |
16
|
|
|
* Builder (Phalcon\Security\JWT\Builder) |
17
|
|
|
* Parser (Phalcon\Security\JWT\Token\Parser) |
18
|
|
|
* Validator (Phalcon\Security\JWT\Validator) |
19
|
|
|
*/ |
20
|
|
|
class Jwt |
21
|
|
|
{ |
22
|
|
|
public array $options; |
23
|
|
|
public Builder $builder; |
24
|
|
|
public Parser $parser; |
25
|
|
|
public Validator $validator; |
26
|
|
|
public AbstractSigner $signer; |
27
|
|
|
public Token $token; |
28
|
|
|
|
29
|
|
|
/** |
30
|
|
|
* @throws \Exception |
31
|
|
|
*/ |
32
|
|
|
public function __construct(array $defaultOptions = []) |
33
|
|
|
{ |
34
|
|
|
$this->options = $defaultOptions; |
35
|
|
|
$this->signer(); |
36
|
|
|
} |
37
|
|
|
|
38
|
|
|
/** |
39
|
|
|
* Initialize JWT Signer |
40
|
|
|
* @param string|null $signer |
41
|
|
|
* @param string|null $algo |
42
|
|
|
* @return AbstractSigner |
43
|
|
|
* @throws \Exception |
44
|
|
|
*/ |
45
|
|
|
public function signer(string $signer = null, string $algo = null): AbstractSigner { |
46
|
|
|
$signer ??= $this->options['signer'] ?? Hmac::class; |
47
|
|
|
$algo ??= $this->options['algo'] ?? 'sha512'; |
48
|
|
|
|
49
|
|
|
$this->signer = new $signer($algo); |
50
|
|
|
|
51
|
|
|
if (!($this->signer instanceof AbstractSigner)) { |
|
|
|
|
52
|
|
|
throw new \Exception('Signer must be an instance of `' . AbstractSigner::class . '`.'); |
53
|
|
|
} |
54
|
|
|
|
55
|
|
|
return $this->signer; |
56
|
|
|
} |
57
|
|
|
|
58
|
|
|
/** |
59
|
|
|
* Initialize JWT Builder |
60
|
|
|
* @param array $options |
61
|
|
|
* @return Builder |
62
|
|
|
* @throws ValidatorException |
63
|
|
|
*/ |
64
|
|
|
public function builder(array $options = []): Builder { |
65
|
|
|
$options = $this->getDefaultOptions($options); |
66
|
|
|
|
67
|
|
|
$this->builder = new Builder($this->signer); |
68
|
|
|
$this->builder->setPassphrase($options['passphrase']); |
|
|
|
|
69
|
|
|
$this->builder->setExpirationTime($options['expiration']); |
|
|
|
|
70
|
|
|
$this->builder->setNotBefore($options['notBefore']); |
|
|
|
|
71
|
|
|
$this->builder->setIssuedAt($options['issuedAt']); |
|
|
|
|
72
|
|
|
$this->builder->setIssuer($options['issuer']); |
|
|
|
|
73
|
|
|
$this->builder->setAudience($options['audience']); |
74
|
|
|
$this->builder->setContentType($options['contentType']); |
|
|
|
|
75
|
|
|
$this->builder->setId($options['id']); |
|
|
|
|
76
|
|
|
$this->builder->setSubject($options['subject']); |
|
|
|
|
77
|
|
|
|
78
|
|
|
return $this->builder; |
79
|
|
|
} |
80
|
|
|
|
81
|
|
|
/** |
82
|
|
|
* Initialize JWT Parser |
83
|
|
|
* @return Parser |
84
|
|
|
*/ |
85
|
|
|
public function parser(): Parser { |
86
|
|
|
$this->parser = new Parser(); |
87
|
|
|
return $this->parser; |
88
|
|
|
} |
89
|
|
|
|
90
|
|
|
/** |
91
|
|
|
* Initialize JWT Validator |
92
|
|
|
* @param Token|null $token |
93
|
|
|
* @param int $timeShift |
94
|
|
|
* @return Validator' |
|
|
|
|
95
|
|
|
*/ |
96
|
|
|
public function validator(Token $token = null, int $timeShift = 0): Validator { |
97
|
|
|
$token ??= $this->token; |
98
|
|
|
|
99
|
|
|
$this->validator = new Validator($token, $timeShift); |
100
|
|
|
|
101
|
|
|
return $this->validator; |
102
|
|
|
} |
103
|
|
|
|
104
|
|
|
/** |
105
|
|
|
* @param Builder|null $builder |
106
|
|
|
* @return Token |
107
|
|
|
* @throws ValidatorException |
108
|
|
|
*/ |
109
|
|
|
public function buildToken(Builder $builder = null): Token { |
110
|
|
|
$builder ??= $this->builder; |
111
|
|
|
|
112
|
|
|
$this->token = $builder->getToken(); |
113
|
|
|
|
114
|
|
|
return $this->token; |
115
|
|
|
} |
116
|
|
|
|
117
|
|
|
/** |
118
|
|
|
* @param string $token |
119
|
|
|
* @return Token |
120
|
|
|
*/ |
121
|
|
|
public function parseToken(string $token): Token { |
122
|
|
|
$parser = $this->parser(); |
123
|
|
|
|
124
|
|
|
$this->token = $parser->parse($token); |
125
|
|
|
|
126
|
|
|
return $this->token; |
127
|
|
|
} |
128
|
|
|
|
129
|
|
|
/** |
130
|
|
|
* @param Token|null $token |
131
|
|
|
* @param int $timeShift |
132
|
|
|
* @param array $options |
133
|
|
|
* @param AbstractSigner|null $signer |
134
|
|
|
* @return void |
135
|
|
|
* @throws ValidatorException |
136
|
|
|
*/ |
137
|
|
|
public function validateToken(Token $token = null, int $timeShift = 0, array $options = [], AbstractSigner $signer = null): void { |
138
|
|
|
$token ??= $this->token; |
139
|
|
|
$signer ??= $this->signer; |
140
|
|
|
$now = new \DateTimeImmutable(); |
141
|
|
|
$options['expiration'] ??= $now->getTimestamp(); |
142
|
|
|
$options['notBefore'] ??= $now->modify('-10 second')->getTimestamp(); |
143
|
|
|
$options['issuedAt'] ??= $now->modify('+10 second')->getTimestamp(); |
144
|
|
|
$options = $this->getDefaultOptions($options); |
145
|
|
|
|
146
|
|
|
$this->validator = $this->validator($token, $timeShift); |
147
|
|
|
|
148
|
|
|
$this->validator->validateId($options['id']); |
|
|
|
|
149
|
|
|
$this->validator->validateIssuer($options['issuer']); |
|
|
|
|
150
|
|
|
$this->validator->validateAudience($options['audience']); |
|
|
|
|
151
|
|
|
$this->validator->validateNotBefore($options['notBefore']); |
|
|
|
|
152
|
|
|
$this->validator->validateExpiration($options['expiration']); |
|
|
|
|
153
|
|
|
$this->validator->validateIssuedAt($options['issuedAt']); |
|
|
|
|
154
|
|
|
$this->validator->validateSignature($signer, $options['passphrase']); |
|
|
|
|
155
|
|
|
} |
156
|
|
|
|
157
|
|
|
/** |
158
|
|
|
* Get default JWT Builder Options |
159
|
|
|
* @param array $options |
160
|
|
|
* @return array |
161
|
|
|
*/ |
162
|
|
|
public function getDefaultOptions(array $options = []): array { |
163
|
|
|
|
164
|
|
|
$options['expiration'] ??= $this->options['expiration'] ?? null; |
165
|
|
|
$options['notBefore'] ??= $this->options['notBefore'] ?? null; |
166
|
|
|
$options['issuedAt'] ??= $this->options['issuedAt'] ?? null; |
167
|
|
|
$options['issuer'] ??= $this->options['issuer'] ?? null; |
168
|
|
|
$options['audience'] ??= $this->options['audience'] ?? null; |
169
|
|
|
$options['contentType'] ??= $this->options['contentType'] ?? null; |
170
|
|
|
$options['passphrase'] ??= $this->options['passphrase'] ?? null; |
171
|
|
|
$options['id'] ??= $this->options['id'] ?? null; |
172
|
|
|
$options['subject'] ??= $this->options['subject'] ?? null; |
173
|
|
|
|
174
|
|
|
return $options; |
175
|
|
|
} |
176
|
|
|
} |
177
|
|
|
|