AuthHelper.php

Go to the documentation of this file.

<?php
/*
 SPDX-FileCopyrightText: © 2018, 2021 Siemens AG
 SPDX-FileCopyrightText: © 2021-2022 Orange
 Contributors: Piotr Pszczola, Bartlomiej Drozdz
 
 SPDX-License-Identifier: GPL-2.0-only
*/
 
namespace Fossology\UI\Api\Helper;
 
use Firebase\JWT\CachedKeySet;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Fossology\Lib\Auth\Auth;
use Fossology\Lib\Dao\UserDao;
use Fossology\UI\Api\Exceptions\HttpBadRequestException;
use Fossology\UI\Api\Exceptions\HttpForbiddenException;
use GuzzleHttp\Client;
use GuzzleHttp\Psr7\HttpFactory;
use Symfony\Component\Cache\Adapter\FilesystemAdapter;
use Symfony\Component\HttpFoundation\Session\Session;
use UnexpectedValueException;
 
class AuthHelper
{
  private $session;
  private $userDao;
  private $dbHelper;
 
  public function __construct(UserDao $userDao, Session $session,
    DbHelper $dbhelper)
  {
    $this->userDao = $userDao;
    $this->session = $session;
    $this->dbHelper = $dbhelper;
    if (!$this->session->isStarted()) {
      $this->session->setName('Login');
      $this->session->start();
    }
    JWT::$leeway = 30; // Set 30 seconds of leeway
  }
 
  public function checkUsernameAndPassword($userName, $password)
  {
    $authPlugin = $GLOBALS["container"]->get("helper.restHelper")->getPlugin('auth');
    return $authPlugin->checkUsernameAndPassword($userName, $password);
  }
 
  public function verifyAuthToken($authHeader, &$userId, &$tokenScope)
  {
    global $SysConf;
    $jwtTokenMatch = null;
    $headerValid = preg_match(
      "/^bearer (([a-zA-Z0-9\-\_\+\/\=]+)\.([a-zA-Z0-9\-\_\+\/\=]+)\.([a-zA-Z0-9\-\_\+\/\=]+))$/i",
      $authHeader, $jwtTokenMatch);
    if (! $headerValid) {
      throw new HttpBadRequestException(
        "Authorization header is malformed or empty.");
    }
    $jwtToken           = $jwtTokenMatch[1];
    $jwtTokenPayload    = $jwtTokenMatch[3];
    $jwtTokenPayloadDecoded = JWT::jsonDecode(
      JWT::urlsafeB64Decode($jwtTokenPayload));
 
    $restToken = Auth::getRestTokenType();
    if (($restToken & Auth::TOKEN_OAUTH) == Auth::TOKEN_OAUTH &&
      property_exists($jwtTokenPayloadDecoded, 'iss') &&
      $jwtTokenPayloadDecoded->{'iss'} == $SysConf['SYSCONFIG']['OidcIssuer']
    ) {
      $this->validateOauthLogin(
        $jwtToken,
        $userId,
        $tokenScope
      );
    } else if (($restToken & Auth::TOKEN_TOKEN) == Auth::TOKEN_TOKEN &&
      ! property_exists($jwtTokenPayloadDecoded, 'iss')
    ) {
      $this->validateTokenLogin(
        $jwtToken,
        $jwtTokenPayloadDecoded,
        $userId,
        $tokenScope
      );
    } else {
      throw new HttpForbiddenException("Invalid token type sent.");
    }
 
    $isUserActive = $this->userDao->isUserIdActive($userId);
    if (!$isUserActive) {
      throw new HttpForbiddenException("User inactive.");
    }
  }
 
  private function isDateExpired($date)
  {
    if (empty($date)) { // oauth clients do not have expiry
      return false;
    }
    return strtotime("today") > strtotime($date);
  }
 
  public function isTokenActive($valuesFromDb, $tokenId)
  {
    if ($valuesFromDb['active'] == "f") {
      throw new HttpForbiddenException("Token expired.");
    } elseif ($this->isDateExpired($valuesFromDb['expire_on']) &&
      $valuesFromDb['active'] == "t") {
      $this->dbHelper->invalidateToken($tokenId);
      throw new HttpForbiddenException("Token expired.");
    }
  }
 
  public function getSession()
  {
    return $this->session;
  }
 
  public function updateUserSession($userId, $scope, $groupName = null)
  {
    $authPlugin = $GLOBALS["container"]->get("helper.restHelper")->getPlugin('auth');
    $user = $this->userDao->getUserByPk($userId);
    $row = $this->userDao->getUserAndDefaultGroupByUserName($user["user_name"]);
    if ($groupName !== null) {
      $row['group_fk'] = $this->userDao->getGroupIdByName($groupName);
      $row['group_name'] = $groupName;
    }
    $authPlugin->updateSession($row);
    $this->getSession()->set('token_scope', $scope);
  }
 
  public function generateJwtToken($expire, $created, $jti, $scope, $key)
  {
    $scope = array_search($scope, RestHelper::SCOPE_DB_MAP);
    $newJwtToken = [
      "exp" => strtotime($expire . " +1 day -1 second"),  // To allow day level granularity
      "nbf" => strtotime($created),
      "jti" => base64_encode($jti),
      "scope" => $scope
    ];
    return JWT::encode($newJwtToken, $key, 'HS256');
  }
 
  public function getMaxTokenValidity()
  {
    return $this->dbHelper->getMaxTokenValidity();
  }
 
  public function userHasGroupAccess($userId, $groupName)
  {
    $this->isGroupExisting($groupName);
    $groupMap = $this->userDao->getUserGroupMap($userId);
    $userHasGroupAccess = in_array($groupName, $groupMap, true);
 
    if (!$userHasGroupAccess) {
      throw new HttpForbiddenException(
        "User has no access to " . $groupName . " group");
    }
  }
 
  public function isGroupExisting($groupName)
  {
    if (empty($this->userDao->getGroupIdByName($groupName))) {
      throw new HttpForbiddenException(
        "Provided group:" . $groupName . " does not exist");
    }
  }
 
  private function validateOauthLogin($jwtToken, &$userId, &$tokenScope)
  {
    global $SysConf;
    $jwks = $this->loadJwks();
    try {
      try {
        $jwtTokenDecoded = JWT::decode(
          $jwtToken,
          $jwks
        );
      } catch (\Exception $e) {
        throw new \UnexpectedValueException("JWKS: " . $e->getMessage());
      }
      $clientId = $jwtTokenDecoded->{$SysConf['SYSCONFIG']['OidcClientIdClaim']};
      $tokenId = $this->dbHelper->getTokenIdFromClientId($clientId);
      $dbRows = $this->dbHelper->getTokenKey($tokenId);
 
      if (empty($dbRows)) {
        throw new \UnexpectedValueException("Invalid token sent.", 403);
      }
      $this->isTokenActive($dbRows, $tokenId);
      $userId = $dbRows['user_fk'];
      $tokenScope = $dbRows['token_scope'];
      if ($tokenScope == "w") {
        $tokenScope = "write";
      } elseif ($tokenScope == "r") {
        $tokenScope = "read";
      }
    } catch (\UnexpectedValueException $e) {
      throw new HttpForbiddenException($e->getMessage(), $e);
    }
  }
 
  public static function loadJwks()
  {
    global $SysConf;
    $cacheDir = array_key_exists('CACHEDIR', $GLOBALS) ? $GLOBALS['CACHEDIR'] : null;
    $cacheDuration = 60 * 60 * 24; // 24 hours
    $algInject = $SysConf['SYSCONFIG']['OidcJwkAlgInject'];
    if (empty($algInject)) {
      $algInject = null;
    }
 
    $proxy = [];
 
    if (
      array_key_exists('http_proxy', $SysConf['FOSSOLOGY']) &&
      !empty($SysConf['FOSSOLOGY']['http_proxy'])
    ) {
      $proxy['http'] = $SysConf['FOSSOLOGY']['http_proxy'];
    }
    if (
      array_key_exists('https_proxy', $SysConf['FOSSOLOGY']) &&
      !empty($SysConf['FOSSOLOGY']['https_proxy'])
    ) {
      $proxy['https'] = $SysConf['FOSSOLOGY']['https_proxy'];
    }
    if (
      array_key_exists('no_proxy', $SysConf['FOSSOLOGY']) &&
      !empty($SysConf['FOSSOLOGY']['no_proxy'])
    ) {
      $proxy['no'] = explode(',', $SysConf['FOSSOLOGY']['no_proxy']);
    }
 
    $version = $SysConf['BUILD']['VERSION'];
    $headers = ['User-Agent' => "fossology/$version"];
 
    $guzzleClient = new Client([
      'http_errors' => false,
      'proxy' => $proxy,
      'headers' => $headers
    ]);
 
    $httpFactory = new HttpFactory();
 
    $cacheItemPool = new FilesystemAdapter('rest', $cacheDuration, $cacheDir);
 
    return new CachedKeySet(
      $SysConf['SYSCONFIG']['OidcJwksURL'],
      $guzzleClient,
      $httpFactory,
      $cacheItemPool,
      $cacheDuration,
      true,
      $algInject
    );
  }
 
  private function validateTokenLogin($jwtToken, $jwtTokenPayloadDecoded,
                                      &$userId, &$tokenScope)
  {
    $jwtJti = $jwtTokenPayloadDecoded->{'jti'};
    $jwtJti = base64_decode($jwtJti, true);
    list ($tokenId, $userId) = explode(".", $jwtJti);
 
    $dbRows = $this->dbHelper->getTokenKey($tokenId);
    if (empty($dbRows)) {
      throw new HttpForbiddenException("Invalid token sent.");
    }
    $this->isTokenActive($dbRows, $tokenId);
    try {
      $jwtTokenDecoded = JWT::decode($jwtToken,
        new Key($dbRows["token_key"], 'HS256'));
      $tokenScope = $jwtTokenDecoded->{'scope'};
    } catch (\UnexpectedValueException $e) {
      throw new HttpForbiddenException($e->getMessage(), $e);
    }
  }
}