Merge pull request #9540 from nextcloud/backport/9517/stable13
[stable13] Improve OAuth
This commit is contained in:
commit
2f059d1caf
|
@ -6,7 +6,7 @@
|
||||||
<licence>agpl</licence>
|
<licence>agpl</licence>
|
||||||
<author>Lukas Reschke</author>
|
<author>Lukas Reschke</author>
|
||||||
<namespace>OAuth2</namespace>
|
<namespace>OAuth2</namespace>
|
||||||
<version>1.1.0</version>
|
<version>1.1.1</version>
|
||||||
<default_enable/>
|
<default_enable/>
|
||||||
<types>
|
<types>
|
||||||
<authentication/>
|
<authentication/>
|
||||||
|
@ -15,6 +15,12 @@
|
||||||
<nextcloud min-version="13" max-version="13" />
|
<nextcloud min-version="13" max-version="13" />
|
||||||
</dependencies>
|
</dependencies>
|
||||||
|
|
||||||
|
<repair-steps>
|
||||||
|
<post-migration>
|
||||||
|
<step>OCA\OAuth2\Migration\SetTokenExpiration</step>
|
||||||
|
</post-migration>
|
||||||
|
</repair-steps>
|
||||||
|
|
||||||
<settings>
|
<settings>
|
||||||
<admin>OCA\OAuth2\Settings\Admin</admin>
|
<admin>OCA\OAuth2\Settings\Admin</admin>
|
||||||
</settings>
|
</settings>
|
||||||
|
|
|
@ -15,5 +15,6 @@ return array(
|
||||||
'OCA\\OAuth2\\Db\\ClientMapper' => $baseDir . '/../lib/Db/ClientMapper.php',
|
'OCA\\OAuth2\\Db\\ClientMapper' => $baseDir . '/../lib/Db/ClientMapper.php',
|
||||||
'OCA\\OAuth2\\Exceptions\\AccessTokenNotFoundException' => $baseDir . '/../lib/Exceptions/AccessTokenNotFoundException.php',
|
'OCA\\OAuth2\\Exceptions\\AccessTokenNotFoundException' => $baseDir . '/../lib/Exceptions/AccessTokenNotFoundException.php',
|
||||||
'OCA\\OAuth2\\Exceptions\\ClientNotFoundException' => $baseDir . '/../lib/Exceptions/ClientNotFoundException.php',
|
'OCA\\OAuth2\\Exceptions\\ClientNotFoundException' => $baseDir . '/../lib/Exceptions/ClientNotFoundException.php',
|
||||||
|
'OCA\\OAuth2\\Migration\\SetTokenExpiration' => $baseDir . '/../lib/Migration/SetTokenExpiration.php',
|
||||||
'OCA\\OAuth2\\Settings\\Admin' => $baseDir . '/../lib/Settings/Admin.php',
|
'OCA\\OAuth2\\Settings\\Admin' => $baseDir . '/../lib/Settings/Admin.php',
|
||||||
);
|
);
|
||||||
|
|
|
@ -27,6 +27,7 @@ class ComposerStaticInitOAuth2
|
||||||
'OCA\\OAuth2\\Db\\ClientMapper' => __DIR__ . '/..' . '/../lib/Db/ClientMapper.php',
|
'OCA\\OAuth2\\Db\\ClientMapper' => __DIR__ . '/..' . '/../lib/Db/ClientMapper.php',
|
||||||
'OCA\\OAuth2\\Exceptions\\AccessTokenNotFoundException' => __DIR__ . '/..' . '/../lib/Exceptions/AccessTokenNotFoundException.php',
|
'OCA\\OAuth2\\Exceptions\\AccessTokenNotFoundException' => __DIR__ . '/..' . '/../lib/Exceptions/AccessTokenNotFoundException.php',
|
||||||
'OCA\\OAuth2\\Exceptions\\ClientNotFoundException' => __DIR__ . '/..' . '/../lib/Exceptions/ClientNotFoundException.php',
|
'OCA\\OAuth2\\Exceptions\\ClientNotFoundException' => __DIR__ . '/..' . '/../lib/Exceptions/ClientNotFoundException.php',
|
||||||
|
'OCA\\OAuth2\\Migration\\SetTokenExpiration' => __DIR__ . '/..' . '/../lib/Migration/SetTokenExpiration.php',
|
||||||
'OCA\\OAuth2\\Settings\\Admin' => __DIR__ . '/..' . '/../lib/Settings/Admin.php',
|
'OCA\\OAuth2\\Settings\\Admin' => __DIR__ . '/..' . '/../lib/Settings/Admin.php',
|
||||||
);
|
);
|
||||||
|
|
||||||
|
|
|
@ -61,11 +61,20 @@ class LoginRedirectorController extends Controller {
|
||||||
*
|
*
|
||||||
* @param string $client_id
|
* @param string $client_id
|
||||||
* @param string $state
|
* @param string $state
|
||||||
|
* @param string $response_type
|
||||||
* @return RedirectResponse
|
* @return RedirectResponse
|
||||||
*/
|
*/
|
||||||
public function authorize($client_id,
|
public function authorize($client_id,
|
||||||
$state) {
|
$state,
|
||||||
|
$response_type) {
|
||||||
$client = $this->clientMapper->getByIdentifier($client_id);
|
$client = $this->clientMapper->getByIdentifier($client_id);
|
||||||
|
|
||||||
|
if ($response_type !== 'code') {
|
||||||
|
//Fail
|
||||||
|
$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
|
||||||
|
return new RedirectResponse($url);
|
||||||
|
}
|
||||||
|
|
||||||
$this->session->set('oauth.state', $state);
|
$this->session->set('oauth.state', $state);
|
||||||
|
|
||||||
$targetUrl = $this->urlGenerator->linkToRouteAbsolute(
|
$targetUrl = $this->urlGenerator->linkToRouteAbsolute(
|
||||||
|
|
|
@ -21,10 +21,17 @@
|
||||||
|
|
||||||
namespace OCA\OAuth2\Controller;
|
namespace OCA\OAuth2\Controller;
|
||||||
|
|
||||||
use OC\Authentication\Token\DefaultTokenMapper;
|
use OC\Authentication\Exceptions\InvalidTokenException;
|
||||||
|
use OC\Authentication\Token\ExpiredTokenException;
|
||||||
|
use OC\Authentication\Token\IProvider as TokenProvider;
|
||||||
use OCA\OAuth2\Db\AccessTokenMapper;
|
use OCA\OAuth2\Db\AccessTokenMapper;
|
||||||
|
use OCA\OAuth2\Db\ClientMapper;
|
||||||
|
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
|
||||||
|
use OCA\OAuth2\Exceptions\ClientNotFoundException;
|
||||||
use OCP\AppFramework\Controller;
|
use OCP\AppFramework\Controller;
|
||||||
|
use OCP\AppFramework\Http;
|
||||||
use OCP\AppFramework\Http\JSONResponse;
|
use OCP\AppFramework\Http\JSONResponse;
|
||||||
|
use OCP\AppFramework\Utility\ITimeFactory;
|
||||||
use OCP\IRequest;
|
use OCP\IRequest;
|
||||||
use OCP\Security\ICrypto;
|
use OCP\Security\ICrypto;
|
||||||
use OCP\Security\ISecureRandom;
|
use OCP\Security\ISecureRandom;
|
||||||
|
@ -32,56 +39,133 @@ use OCP\Security\ISecureRandom;
|
||||||
class OauthApiController extends Controller {
|
class OauthApiController extends Controller {
|
||||||
/** @var AccessTokenMapper */
|
/** @var AccessTokenMapper */
|
||||||
private $accessTokenMapper;
|
private $accessTokenMapper;
|
||||||
|
/** @var ClientMapper */
|
||||||
|
private $clientMapper;
|
||||||
/** @var ICrypto */
|
/** @var ICrypto */
|
||||||
private $crypto;
|
private $crypto;
|
||||||
/** @var DefaultTokenMapper */
|
/** @var TokenProvider */
|
||||||
private $defaultTokenMapper;
|
private $tokenProvider;
|
||||||
/** @var ISecureRandom */
|
/** @var ISecureRandom */
|
||||||
private $secureRandom;
|
private $secureRandom;
|
||||||
|
/** @var ITimeFactory */
|
||||||
|
private $time;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @param string $appName
|
* @param string $appName
|
||||||
* @param IRequest $request
|
* @param IRequest $request
|
||||||
* @param ICrypto $crypto
|
* @param ICrypto $crypto
|
||||||
* @param AccessTokenMapper $accessTokenMapper
|
* @param AccessTokenMapper $accessTokenMapper
|
||||||
* @param DefaultTokenMapper $defaultTokenMapper
|
* @param ClientMapper $clientMapper
|
||||||
|
* @param TokenProvider $tokenProvider
|
||||||
* @param ISecureRandom $secureRandom
|
* @param ISecureRandom $secureRandom
|
||||||
|
* @param ITimeFactory $time
|
||||||
*/
|
*/
|
||||||
public function __construct($appName,
|
public function __construct($appName,
|
||||||
IRequest $request,
|
IRequest $request,
|
||||||
ICrypto $crypto,
|
ICrypto $crypto,
|
||||||
AccessTokenMapper $accessTokenMapper,
|
AccessTokenMapper $accessTokenMapper,
|
||||||
DefaultTokenMapper $defaultTokenMapper,
|
ClientMapper $clientMapper,
|
||||||
ISecureRandom $secureRandom) {
|
TokenProvider $tokenProvider,
|
||||||
|
ISecureRandom $secureRandom,
|
||||||
|
ITimeFactory $time) {
|
||||||
parent::__construct($appName, $request);
|
parent::__construct($appName, $request);
|
||||||
$this->crypto = $crypto;
|
$this->crypto = $crypto;
|
||||||
$this->accessTokenMapper = $accessTokenMapper;
|
$this->accessTokenMapper = $accessTokenMapper;
|
||||||
$this->defaultTokenMapper = $defaultTokenMapper;
|
$this->clientMapper = $clientMapper;
|
||||||
|
$this->tokenProvider = $tokenProvider;
|
||||||
$this->secureRandom = $secureRandom;
|
$this->secureRandom = $secureRandom;
|
||||||
|
$this->time = $time;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @PublicPage
|
* @PublicPage
|
||||||
* @NoCSRFRequired
|
* @NoCSRFRequired
|
||||||
*
|
*
|
||||||
|
* @param string $grant_type
|
||||||
* @param string $code
|
* @param string $code
|
||||||
|
* @param string $refresh_token
|
||||||
|
* @param string $client_id
|
||||||
|
* @param string $client_secret
|
||||||
* @return JSONResponse
|
* @return JSONResponse
|
||||||
*/
|
*/
|
||||||
public function getToken($code) {
|
public function getToken($grant_type, $code, $refresh_token, $client_id, $client_secret) {
|
||||||
|
|
||||||
|
// We only handle two types
|
||||||
|
if ($grant_type !== 'authorization_code' && $grant_type !== 'refresh_token') {
|
||||||
|
return new JSONResponse([
|
||||||
|
'error' => 'invalid_grant',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
// We handle the initial and refresh tokens the same way
|
||||||
|
if ($grant_type === 'refresh_token' ) {
|
||||||
|
$code = $refresh_token;
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
$accessToken = $this->accessTokenMapper->getByCode($code);
|
$accessToken = $this->accessTokenMapper->getByCode($code);
|
||||||
|
} catch (AccessTokenNotFoundException $e) {
|
||||||
|
return new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
$client = $this->clientMapper->getByUid($accessToken->getClientId());
|
||||||
|
} catch (ClientNotFoundException $e) {
|
||||||
|
return new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
// The client id and secret must match. Else we don't provide an access token!
|
||||||
|
if ($client->getClientIdentifier() !== $client_id || $client->getSecret() !== $client_secret) {
|
||||||
|
return new JSONResponse([
|
||||||
|
'error' => 'invalid_client',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
$decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code);
|
$decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code);
|
||||||
$newCode = $this->secureRandom->generate(128);
|
|
||||||
|
// Obtain the appToken assoicated
|
||||||
|
try {
|
||||||
|
$appToken = $this->tokenProvider->getTokenById($accessToken->getTokenId());
|
||||||
|
} catch (ExpiredTokenException $e) {
|
||||||
|
$appToken = $e->getToken();
|
||||||
|
} catch (InvalidTokenException $e) {
|
||||||
|
//We can't do anything...
|
||||||
|
$this->accessTokenMapper->delete($accessToken);
|
||||||
|
return new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Rotate the apptoken (so the old one becomes invalid basically)
|
||||||
|
$newToken = $this->secureRandom->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
|
||||||
|
|
||||||
|
$appToken = $this->tokenProvider->rotate(
|
||||||
|
$appToken,
|
||||||
|
$decryptedToken,
|
||||||
|
$newToken
|
||||||
|
);
|
||||||
|
|
||||||
|
// Expiration is in 1 hour again
|
||||||
|
$appToken->setExpires($this->time->getTime() + 3600);
|
||||||
|
$this->tokenProvider->updateToken($appToken);
|
||||||
|
|
||||||
|
// Generate a new refresh token and encrypt the new apptoken in the DB
|
||||||
|
$newCode = $this->secureRandom->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
|
||||||
$accessToken->setHashedCode(hash('sha512', $newCode));
|
$accessToken->setHashedCode(hash('sha512', $newCode));
|
||||||
$accessToken->setEncryptedToken($this->crypto->encrypt($decryptedToken, $newCode));
|
$accessToken->setEncryptedToken($this->crypto->encrypt($newToken, $newCode));
|
||||||
$this->accessTokenMapper->update($accessToken);
|
$this->accessTokenMapper->update($accessToken);
|
||||||
|
|
||||||
return new JSONResponse(
|
return new JSONResponse(
|
||||||
[
|
[
|
||||||
'access_token' => $decryptedToken,
|
'access_token' => $newToken,
|
||||||
'token_type' => 'Bearer',
|
'token_type' => 'Bearer',
|
||||||
'expires_in' => 3600,
|
'expires_in' => 3600,
|
||||||
'refresh_token' => $newCode,
|
'refresh_token' => $newCode,
|
||||||
'user_id' => $this->defaultTokenMapper->getTokenById($accessToken->getTokenId())->getUID(),
|
'user_id' => $appToken->getUID(),
|
||||||
]
|
]
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -0,0 +1,77 @@
|
||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* @copyright Copyright 2018, Roeland Jago Douma <roeland@famdouma.nl>
|
||||||
|
*
|
||||||
|
* @author Roeland Jago Douma <roeland@famdouma.nl>
|
||||||
|
*
|
||||||
|
* @license GNU AGPL version 3 or any later version
|
||||||
|
*
|
||||||
|
* This program is free software: you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU Affero General Public License as
|
||||||
|
* published by the Free Software Foundation, either version 3 of the
|
||||||
|
* License, or (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU Affero General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU Affero General Public License
|
||||||
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
|
namespace OCA\OAuth2\Migration;
|
||||||
|
|
||||||
|
use OC\Authentication\Exceptions\InvalidTokenException;
|
||||||
|
use OC\Authentication\Token\IProvider as TokenProvider;
|
||||||
|
use OCA\OAuth2\Db\AccessToken;
|
||||||
|
use OCP\AppFramework\Utility\ITimeFactory;
|
||||||
|
use OCP\IDBConnection;
|
||||||
|
use OCP\Migration\IOutput;
|
||||||
|
use OCP\Migration\IRepairStep;
|
||||||
|
|
||||||
|
class SetTokenExpiration implements IRepairStep {
|
||||||
|
|
||||||
|
/** @var IDBConnection */
|
||||||
|
private $connection;
|
||||||
|
|
||||||
|
/** @var ITimeFactory */
|
||||||
|
private $time;
|
||||||
|
|
||||||
|
/** @var TokenProvider */
|
||||||
|
private $tokenProvider;
|
||||||
|
|
||||||
|
public function __construct(IDBConnection $connection,
|
||||||
|
ITimeFactory $timeFactory,
|
||||||
|
TokenProvider $tokenProvider) {
|
||||||
|
$this->connection = $connection;
|
||||||
|
$this->time = $timeFactory;
|
||||||
|
$this->tokenProvider = $tokenProvider;
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getName() {
|
||||||
|
return 'Update OAuth token expiration times';
|
||||||
|
}
|
||||||
|
|
||||||
|
public function run(IOutput $output) {
|
||||||
|
$qb = $this->connection->getQueryBuilder();
|
||||||
|
$qb->select('*')
|
||||||
|
->from('oauth2_access_tokens');
|
||||||
|
|
||||||
|
$cursor = $qb->execute();
|
||||||
|
|
||||||
|
while($row = $cursor->fetch()) {
|
||||||
|
$token = AccessToken::fromRow($row);
|
||||||
|
try {
|
||||||
|
$appToken = $this->tokenProvider->getTokenById($token->getTokenId());
|
||||||
|
$appToken->setExpires($this->time->getTime() + 3600);
|
||||||
|
$this->tokenProvider->updateToken($appToken);
|
||||||
|
} catch (InvalidTokenException $e) {
|
||||||
|
//Skip this token
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$cursor->closeCursor();
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
|
@ -86,6 +86,24 @@ class LoginRedirectorControllerTest extends TestCase {
|
||||||
->willReturn('https://example.com/?clientIdentifier=foo');
|
->willReturn('https://example.com/?clientIdentifier=foo');
|
||||||
|
|
||||||
$expected = new RedirectResponse('https://example.com/?clientIdentifier=foo');
|
$expected = new RedirectResponse('https://example.com/?clientIdentifier=foo');
|
||||||
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState'));
|
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState', 'code'));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testAuthorizeWrongResponseType() {
|
||||||
|
$client = new Client();
|
||||||
|
$client->setClientIdentifier('MyClientIdentifier');
|
||||||
|
$client->setRedirectUri('http://foo.bar');
|
||||||
|
$this->clientMapper
|
||||||
|
->expects($this->once())
|
||||||
|
->method('getByIdentifier')
|
||||||
|
->with('MyClientId')
|
||||||
|
->willReturn($client);
|
||||||
|
$this->session
|
||||||
|
->expects($this->never())
|
||||||
|
->method('set');
|
||||||
|
|
||||||
|
|
||||||
|
$expected = new RedirectResponse('http://foo.bar?error=unsupported_response_type&state=MyState');
|
||||||
|
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState', 'wrongcode'));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -21,12 +21,22 @@
|
||||||
|
|
||||||
namespace OCA\OAuth2\Tests\Controller;
|
namespace OCA\OAuth2\Tests\Controller;
|
||||||
|
|
||||||
|
use OC\Authentication\Exceptions\InvalidTokenException;
|
||||||
use OC\Authentication\Token\DefaultToken;
|
use OC\Authentication\Token\DefaultToken;
|
||||||
use OC\Authentication\Token\DefaultTokenMapper;
|
use OC\Authentication\Token\DefaultTokenMapper;
|
||||||
|
use OC\Authentication\Token\ExpiredTokenException;
|
||||||
|
use OC\Authentication\Token\IProvider as TokenProvider;
|
||||||
|
use OC\Authentication\Token\IToken;
|
||||||
use OCA\OAuth2\Controller\OauthApiController;
|
use OCA\OAuth2\Controller\OauthApiController;
|
||||||
use OCA\OAuth2\Db\AccessToken;
|
use OCA\OAuth2\Db\AccessToken;
|
||||||
use OCA\OAuth2\Db\AccessTokenMapper;
|
use OCA\OAuth2\Db\AccessTokenMapper;
|
||||||
|
use OCA\OAuth2\Db\Client;
|
||||||
|
use OCA\OAuth2\Db\ClientMapper;
|
||||||
|
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
|
||||||
|
use OCA\OAuth2\Exceptions\ClientNotFoundException;
|
||||||
|
use OCP\AppFramework\Http;
|
||||||
use OCP\AppFramework\Http\JSONResponse;
|
use OCP\AppFramework\Http\JSONResponse;
|
||||||
|
use OCP\AppFramework\Utility\ITimeFactory;
|
||||||
use OCP\IRequest;
|
use OCP\IRequest;
|
||||||
use OCP\Security\ICrypto;
|
use OCP\Security\ICrypto;
|
||||||
use OCP\Security\ISecureRandom;
|
use OCP\Security\ISecureRandom;
|
||||||
|
@ -39,10 +49,14 @@ class OauthApiControllerTest extends TestCase {
|
||||||
private $crypto;
|
private $crypto;
|
||||||
/** @var AccessTokenMapper|\PHPUnit_Framework_MockObject_MockObject */
|
/** @var AccessTokenMapper|\PHPUnit_Framework_MockObject_MockObject */
|
||||||
private $accessTokenMapper;
|
private $accessTokenMapper;
|
||||||
/** @var DefaultTokenMapper|\PHPUnit_Framework_MockObject_MockObject */
|
/** @var ClientMapper|\PHPUnit_Framework_MockObject_MockObject */
|
||||||
private $defaultTokenMapper;
|
private $clientMapper;
|
||||||
|
/** @var TokenProvider|\PHPUnit_Framework_MockObject_MockObject */
|
||||||
|
private $tokenProvider;
|
||||||
/** @var ISecureRandom|\PHPUnit_Framework_MockObject_MockObject */
|
/** @var ISecureRandom|\PHPUnit_Framework_MockObject_MockObject */
|
||||||
private $secureRandom;
|
private $secureRandom;
|
||||||
|
/** @var ITimeFactory|\PHPUnit_Framework_MockObject_MockObject */
|
||||||
|
private $time;
|
||||||
/** @var OauthApiController */
|
/** @var OauthApiController */
|
||||||
private $oauthApiController;
|
private $oauthApiController;
|
||||||
|
|
||||||
|
@ -52,55 +66,307 @@ class OauthApiControllerTest extends TestCase {
|
||||||
$this->request = $this->createMock(IRequest::class);
|
$this->request = $this->createMock(IRequest::class);
|
||||||
$this->crypto = $this->createMock(ICrypto::class);
|
$this->crypto = $this->createMock(ICrypto::class);
|
||||||
$this->accessTokenMapper = $this->createMock(AccessTokenMapper::class);
|
$this->accessTokenMapper = $this->createMock(AccessTokenMapper::class);
|
||||||
$this->defaultTokenMapper = $this->createMock(DefaultTokenMapper::class);
|
$this->clientMapper = $this->createMock(ClientMapper::class);
|
||||||
|
$this->tokenProvider = $this->createMock(TokenProvider::class);
|
||||||
$this->secureRandom = $this->createMock(ISecureRandom::class);
|
$this->secureRandom = $this->createMock(ISecureRandom::class);
|
||||||
|
$this->time = $this->createMock(ITimeFactory::class);
|
||||||
|
|
||||||
$this->oauthApiController = new OauthApiController(
|
$this->oauthApiController = new OauthApiController(
|
||||||
'oauth2',
|
'oauth2',
|
||||||
$this->request,
|
$this->request,
|
||||||
$this->crypto,
|
$this->crypto,
|
||||||
$this->accessTokenMapper,
|
$this->accessTokenMapper,
|
||||||
$this->defaultTokenMapper,
|
$this->clientMapper,
|
||||||
$this->secureRandom
|
$this->tokenProvider,
|
||||||
|
$this->secureRandom,
|
||||||
|
$this->time
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
public function testGetToken() {
|
public function testGetTokenInvalidGrantType() {
|
||||||
$accessToken = new AccessToken();
|
$expected = new JSONResponse([
|
||||||
$accessToken->setEncryptedToken('MyEncryptedToken');
|
'error' => 'invalid_grant',
|
||||||
$accessToken->setTokenId(123);
|
], Http::STATUS_BAD_REQUEST);
|
||||||
$this->accessTokenMapper
|
|
||||||
->expects($this->once())
|
|
||||||
->method('getByCode')
|
|
||||||
->willReturn($accessToken);
|
|
||||||
$this->crypto
|
|
||||||
->expects($this->once())
|
|
||||||
->method('decrypt')
|
|
||||||
->with('MyEncryptedToken', 'MySecretCode')
|
|
||||||
->willReturn('MyDecryptedToken');
|
|
||||||
$this->secureRandom
|
|
||||||
->expects($this->once())
|
|
||||||
->method('generate')
|
|
||||||
->with(128)
|
|
||||||
->willReturn('NewToken');
|
|
||||||
$token = new DefaultToken();
|
|
||||||
$token->setUid('JohnDoe');
|
|
||||||
$this->defaultTokenMapper
|
|
||||||
->expects($this->once())
|
|
||||||
->method('getTokenById')
|
|
||||||
->with(123)
|
|
||||||
->willReturn($token);
|
|
||||||
|
|
||||||
$expected = new JSONResponse(
|
$this->assertEquals($expected, $this->oauthApiController->getToken('foo', null, null, null, null));
|
||||||
[
|
}
|
||||||
'access_token' => 'MyDecryptedToken',
|
|
||||||
|
public function testGetTokenInvalidCode() {
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('invalidcode')
|
||||||
|
->willThrowException(new AccessTokenNotFoundException());
|
||||||
|
|
||||||
|
$this->assertEquals($expected, $this->oauthApiController->getToken('authorization_code', 'invalidcode', null, null, null));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testGetTokenInvalidRefreshToken() {
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('invalidrefresh')
|
||||||
|
->willThrowException(new AccessTokenNotFoundException());
|
||||||
|
|
||||||
|
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'invalidrefresh', null, null));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testGetTokenClientDoesNotExist() {
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
|
||||||
|
$accessToken = new AccessToken();
|
||||||
|
$accessToken->setClientId(42);
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('validrefresh')
|
||||||
|
->willReturn($accessToken);
|
||||||
|
|
||||||
|
$this->clientMapper->method('getByUid')
|
||||||
|
->with(42)
|
||||||
|
->willThrowException(new ClientNotFoundException());
|
||||||
|
|
||||||
|
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', null, null));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function invalidClientProvider() {
|
||||||
|
return [
|
||||||
|
['invalidClientId', 'invalidClientSecret'],
|
||||||
|
['clientId', 'invalidClientSecret'],
|
||||||
|
['invalidClientId', 'clientSecret'],
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @dataProvider invalidClientProvider
|
||||||
|
*
|
||||||
|
* @param string $clientId
|
||||||
|
* @param string $clientSecret
|
||||||
|
*/
|
||||||
|
public function testGetTokenInvalidClient($clientId, $clientSecret) {
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'error' => 'invalid_client',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
|
||||||
|
$accessToken = new AccessToken();
|
||||||
|
$accessToken->setClientId(42);
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('validrefresh')
|
||||||
|
->willReturn($accessToken);
|
||||||
|
|
||||||
|
$client = new Client();
|
||||||
|
$client->setClientIdentifier('clientId');
|
||||||
|
$client->setSecret('clientSecret');
|
||||||
|
$this->clientMapper->method('getByUid')
|
||||||
|
->with(42)
|
||||||
|
->willReturn($client);
|
||||||
|
|
||||||
|
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', $clientId, $clientSecret));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testGetTokenInvalidAppToken() {
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'error' => 'invalid_request',
|
||||||
|
], Http::STATUS_BAD_REQUEST);
|
||||||
|
|
||||||
|
$accessToken = new AccessToken();
|
||||||
|
$accessToken->setClientId(42);
|
||||||
|
$accessToken->setTokenId(1337);
|
||||||
|
$accessToken->setEncryptedToken('encryptedToken');
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('validrefresh')
|
||||||
|
->willReturn($accessToken);
|
||||||
|
|
||||||
|
$client = new Client();
|
||||||
|
$client->setClientIdentifier('clientId');
|
||||||
|
$client->setSecret('clientSecret');
|
||||||
|
$this->clientMapper->method('getByUid')
|
||||||
|
->with(42)
|
||||||
|
->willReturn($client);
|
||||||
|
|
||||||
|
$this->crypto->method('decrypt')
|
||||||
|
->with(
|
||||||
|
'encryptedToken',
|
||||||
|
'validrefresh'
|
||||||
|
)->willReturn('decryptedToken');
|
||||||
|
|
||||||
|
$this->tokenProvider->method('getTokenById')
|
||||||
|
->with(1337)
|
||||||
|
->willThrowException(new InvalidTokenException());
|
||||||
|
|
||||||
|
$this->accessTokenMapper->expects($this->once())
|
||||||
|
->method('delete')
|
||||||
|
->with($accessToken);
|
||||||
|
|
||||||
|
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testGetTokenValidAppToken() {
|
||||||
|
$accessToken = new AccessToken();
|
||||||
|
$accessToken->setClientId(42);
|
||||||
|
$accessToken->setTokenId(1337);
|
||||||
|
$accessToken->setEncryptedToken('encryptedToken');
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('validrefresh')
|
||||||
|
->willReturn($accessToken);
|
||||||
|
|
||||||
|
$client = new Client();
|
||||||
|
$client->setClientIdentifier('clientId');
|
||||||
|
$client->setSecret('clientSecret');
|
||||||
|
$this->clientMapper->method('getByUid')
|
||||||
|
->with(42)
|
||||||
|
->willReturn($client);
|
||||||
|
|
||||||
|
$this->crypto->method('decrypt')
|
||||||
|
->with(
|
||||||
|
'encryptedToken',
|
||||||
|
'validrefresh'
|
||||||
|
)->willReturn('decryptedToken');
|
||||||
|
|
||||||
|
$appToken = new DefaultToken();
|
||||||
|
$appToken->setUid('userId');
|
||||||
|
$this->tokenProvider->method('getTokenById')
|
||||||
|
->with(1337)
|
||||||
|
->willThrowException(new ExpiredTokenException($appToken));
|
||||||
|
|
||||||
|
$this->accessTokenMapper->expects($this->never())
|
||||||
|
->method('delete')
|
||||||
|
->with($accessToken);
|
||||||
|
|
||||||
|
$this->secureRandom->method('generate')
|
||||||
|
->will($this->returnCallback(function ($len) {
|
||||||
|
return 'random'.$len;
|
||||||
|
}));
|
||||||
|
|
||||||
|
$this->tokenProvider->expects($this->once())
|
||||||
|
->method('rotate')
|
||||||
|
->with(
|
||||||
|
$appToken,
|
||||||
|
'decryptedToken',
|
||||||
|
'random72'
|
||||||
|
)->willReturn($appToken);
|
||||||
|
|
||||||
|
$this->time->method('getTime')
|
||||||
|
->willReturn(1000);
|
||||||
|
|
||||||
|
$this->tokenProvider->expects($this->once())
|
||||||
|
->method('updateToken')
|
||||||
|
->with(
|
||||||
|
$this->callback(function (DefaultToken $token) {
|
||||||
|
return $token->getExpires() === 4600;
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
$this->crypto->method('encrypt')
|
||||||
|
->with('random72', 'random128')
|
||||||
|
->willReturn('newEncryptedToken');
|
||||||
|
|
||||||
|
$this->accessTokenMapper->expects($this->once())
|
||||||
|
->method('update')
|
||||||
|
->with(
|
||||||
|
$this->callback(function (AccessToken $token) {
|
||||||
|
return $token->getHashedCode() === hash('sha512', 'random128') &&
|
||||||
|
$token->getEncryptedToken() === 'newEncryptedToken';
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'access_token' => 'random72',
|
||||||
'token_type' => 'Bearer',
|
'token_type' => 'Bearer',
|
||||||
'expires_in' => 3600,
|
'expires_in' => 3600,
|
||||||
'refresh_token' => 'NewToken',
|
'refresh_token' => 'random128',
|
||||||
'user_id' => 'JohnDoe',
|
'user_id' => 'userId',
|
||||||
]
|
]);
|
||||||
);
|
|
||||||
$this->assertEquals($expected, $this->oauthApiController->getToken('MySecretCode'));
|
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public function testGetTokenExpiredAppToken() {
|
||||||
|
$accessToken = new AccessToken();
|
||||||
|
$accessToken->setClientId(42);
|
||||||
|
$accessToken->setTokenId(1337);
|
||||||
|
$accessToken->setEncryptedToken('encryptedToken');
|
||||||
|
|
||||||
|
$this->accessTokenMapper->method('getByCode')
|
||||||
|
->with('validrefresh')
|
||||||
|
->willReturn($accessToken);
|
||||||
|
|
||||||
|
$client = new Client();
|
||||||
|
$client->setClientIdentifier('clientId');
|
||||||
|
$client->setSecret('clientSecret');
|
||||||
|
$this->clientMapper->method('getByUid')
|
||||||
|
->with(42)
|
||||||
|
->willReturn($client);
|
||||||
|
|
||||||
|
$this->crypto->method('decrypt')
|
||||||
|
->with(
|
||||||
|
'encryptedToken',
|
||||||
|
'validrefresh'
|
||||||
|
)->willReturn('decryptedToken');
|
||||||
|
|
||||||
|
$appToken = new DefaultToken();
|
||||||
|
$appToken->setUid('userId');
|
||||||
|
$this->tokenProvider->method('getTokenById')
|
||||||
|
->with(1337)
|
||||||
|
->willReturn($appToken);
|
||||||
|
|
||||||
|
$this->accessTokenMapper->expects($this->never())
|
||||||
|
->method('delete')
|
||||||
|
->with($accessToken);
|
||||||
|
|
||||||
|
$this->secureRandom->method('generate')
|
||||||
|
->will($this->returnCallback(function ($len) {
|
||||||
|
return 'random'.$len;
|
||||||
|
}));
|
||||||
|
|
||||||
|
$this->tokenProvider->expects($this->once())
|
||||||
|
->method('rotate')
|
||||||
|
->with(
|
||||||
|
$appToken,
|
||||||
|
'decryptedToken',
|
||||||
|
'random72'
|
||||||
|
)->willReturn($appToken);
|
||||||
|
|
||||||
|
$this->time->method('getTime')
|
||||||
|
->willReturn(1000);
|
||||||
|
|
||||||
|
$this->tokenProvider->expects($this->once())
|
||||||
|
->method('updateToken')
|
||||||
|
->with(
|
||||||
|
$this->callback(function (DefaultToken $token) {
|
||||||
|
return $token->getExpires() === 4600;
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
$this->crypto->method('encrypt')
|
||||||
|
->with('random72', 'random128')
|
||||||
|
->willReturn('newEncryptedToken');
|
||||||
|
|
||||||
|
$this->accessTokenMapper->expects($this->once())
|
||||||
|
->method('update')
|
||||||
|
->with(
|
||||||
|
$this->callback(function (AccessToken $token) {
|
||||||
|
return $token->getHashedCode() === hash('sha512', 'random128') &&
|
||||||
|
$token->getEncryptedToken() === 'newEncryptedToken';
|
||||||
|
})
|
||||||
|
);
|
||||||
|
|
||||||
|
$expected = new JSONResponse([
|
||||||
|
'access_token' => 'random72',
|
||||||
|
'token_type' => 'Bearer',
|
||||||
|
'expires_in' => 3600,
|
||||||
|
'refresh_token' => 'random128',
|
||||||
|
'user_id' => 'userId',
|
||||||
|
]);
|
||||||
|
|
||||||
|
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -291,7 +291,7 @@ class ClientFlowLoginController extends Controller {
|
||||||
);
|
);
|
||||||
|
|
||||||
if($client) {
|
if($client) {
|
||||||
$code = $this->random->generate(128);
|
$code = $this->random->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
|
||||||
$accessToken = new AccessToken();
|
$accessToken = new AccessToken();
|
||||||
$accessToken->setClientId($client->getId());
|
$accessToken->setClientId($client->getId());
|
||||||
$accessToken->setEncryptedToken($this->crypto->encrypt($token, $code));
|
$accessToken->setEncryptedToken($this->crypto->encrypt($token, $code));
|
||||||
|
|
|
@ -0,0 +1,56 @@
|
||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* @copyright Copyright (c) 2018 Roeland Jago Douma <roeland@famdouma.nl>
|
||||||
|
*
|
||||||
|
* @author Roeland Jago Douma <roeland@famdouma.nl>
|
||||||
|
*
|
||||||
|
* @license GNU AGPL version 3 or any later version
|
||||||
|
*
|
||||||
|
* This program is free software: you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU Affero General Public License as
|
||||||
|
* published by the Free Software Foundation, either version 3 of the
|
||||||
|
* License, or (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU Affero General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU Affero General Public License
|
||||||
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
|
namespace OC\Core\Migrations;
|
||||||
|
|
||||||
|
use OCP\DB\ISchemaWrapper;
|
||||||
|
use OCP\Migration\SimpleMigrationStep;
|
||||||
|
use OCP\Migration\IOutput;
|
||||||
|
|
||||||
|
class Version13000Date20180516101403 extends SimpleMigrationStep {
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param IOutput $output
|
||||||
|
* @param \Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
|
||||||
|
* @param array $options
|
||||||
|
* @return null|ISchemaWrapper
|
||||||
|
*/
|
||||||
|
public function changeSchema(IOutput $output, \Closure $schemaClosure, array $options) {
|
||||||
|
/** @var ISchemaWrapper $schema */
|
||||||
|
$schema = $schemaClosure();
|
||||||
|
|
||||||
|
$table = $schema->getTable('authtoken');
|
||||||
|
|
||||||
|
if (!$table->hasColumn('expires')) {
|
||||||
|
$table->addColumn('expires', 'integer', [
|
||||||
|
'notnull' => false,
|
||||||
|
'length' => 4,
|
||||||
|
'default' => null,
|
||||||
|
'unsigned' => true,
|
||||||
|
]);
|
||||||
|
|
||||||
|
return $schema;
|
||||||
|
}
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
|
@ -43,8 +43,7 @@ namespace Composer\Autoload;
|
||||||
class ClassLoader
|
class ClassLoader
|
||||||
{
|
{
|
||||||
// PSR-4
|
// PSR-4
|
||||||
private $firstCharsPsr4 = array();
|
private $prefixLengthsPsr4 = array();
|
||||||
private $prefixLengthsPsr4 = array(); // For BC with legacy static maps
|
|
||||||
private $prefixDirsPsr4 = array();
|
private $prefixDirsPsr4 = array();
|
||||||
private $fallbackDirsPsr4 = array();
|
private $fallbackDirsPsr4 = array();
|
||||||
|
|
||||||
|
@ -171,10 +170,11 @@ class ClassLoader
|
||||||
}
|
}
|
||||||
} elseif (!isset($this->prefixDirsPsr4[$prefix])) {
|
} elseif (!isset($this->prefixDirsPsr4[$prefix])) {
|
||||||
// Register directories for a new namespace.
|
// Register directories for a new namespace.
|
||||||
if ('\\' !== substr($prefix, -1)) {
|
$length = strlen($prefix);
|
||||||
|
if ('\\' !== $prefix[$length - 1]) {
|
||||||
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
|
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
|
||||||
}
|
}
|
||||||
$this->firstCharsPsr4[$prefix[0]] = true;
|
$this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
|
||||||
$this->prefixDirsPsr4[$prefix] = (array) $paths;
|
$this->prefixDirsPsr4[$prefix] = (array) $paths;
|
||||||
} elseif ($prepend) {
|
} elseif ($prepend) {
|
||||||
// Prepend directories for an already registered namespace.
|
// Prepend directories for an already registered namespace.
|
||||||
|
@ -221,10 +221,11 @@ class ClassLoader
|
||||||
if (!$prefix) {
|
if (!$prefix) {
|
||||||
$this->fallbackDirsPsr4 = (array) $paths;
|
$this->fallbackDirsPsr4 = (array) $paths;
|
||||||
} else {
|
} else {
|
||||||
if ('\\' !== substr($prefix, -1)) {
|
$length = strlen($prefix);
|
||||||
|
if ('\\' !== $prefix[$length - 1]) {
|
||||||
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
|
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
|
||||||
}
|
}
|
||||||
$this->firstCharsPsr4[$prefix[0]] = true;
|
$this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
|
||||||
$this->prefixDirsPsr4[$prefix] = (array) $paths;
|
$this->prefixDirsPsr4[$prefix] = (array) $paths;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -372,7 +373,7 @@ class ClassLoader
|
||||||
$logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext;
|
$logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext;
|
||||||
|
|
||||||
$first = $class[0];
|
$first = $class[0];
|
||||||
if (isset($this->firstCharsPsr4[$first]) || isset($this->prefixLengthsPsr4[$first])) {
|
if (isset($this->prefixLengthsPsr4[$first])) {
|
||||||
$subPath = $class;
|
$subPath = $class;
|
||||||
while (false !== $lastPos = strrpos($subPath, '\\')) {
|
while (false !== $lastPos = strrpos($subPath, '\\')) {
|
||||||
$subPath = substr($subPath, 0, $lastPos);
|
$subPath = substr($subPath, 0, $lastPos);
|
||||||
|
|
|
@ -394,6 +394,7 @@ return array(
|
||||||
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
|
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
|
||||||
'OC\\Authentication\\Token\\DefaultTokenMapper' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
|
'OC\\Authentication\\Token\\DefaultTokenMapper' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
|
||||||
'OC\\Authentication\\Token\\DefaultTokenProvider' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
|
'OC\\Authentication\\Token\\DefaultTokenProvider' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
|
||||||
|
'OC\\Authentication\\Token\\ExpiredTokenException' => $baseDir . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
|
||||||
'OC\\Authentication\\Token\\IProvider' => $baseDir . '/lib/private/Authentication/Token/IProvider.php',
|
'OC\\Authentication\\Token\\IProvider' => $baseDir . '/lib/private/Authentication/Token/IProvider.php',
|
||||||
'OC\\Authentication\\Token\\IToken' => $baseDir . '/lib/private/Authentication/Token/IToken.php',
|
'OC\\Authentication\\Token\\IToken' => $baseDir . '/lib/private/Authentication/Token/IToken.php',
|
||||||
'OC\\Authentication\\TwoFactorAuth\\Manager' => $baseDir . '/lib/private/Authentication/TwoFactorAuth/Manager.php',
|
'OC\\Authentication\\TwoFactorAuth\\Manager' => $baseDir . '/lib/private/Authentication/TwoFactorAuth/Manager.php',
|
||||||
|
@ -537,6 +538,7 @@ return array(
|
||||||
'OC\\Core\\Migrations\\Version13000Date20170814074715' => $baseDir . '/core/Migrations/Version13000Date20170814074715.php',
|
'OC\\Core\\Migrations\\Version13000Date20170814074715' => $baseDir . '/core/Migrations/Version13000Date20170814074715.php',
|
||||||
'OC\\Core\\Migrations\\Version13000Date20170919121250' => $baseDir . '/core/Migrations/Version13000Date20170919121250.php',
|
'OC\\Core\\Migrations\\Version13000Date20170919121250' => $baseDir . '/core/Migrations/Version13000Date20170919121250.php',
|
||||||
'OC\\Core\\Migrations\\Version13000Date20170926101637' => $baseDir . '/core/Migrations/Version13000Date20170926101637.php',
|
'OC\\Core\\Migrations\\Version13000Date20170926101637' => $baseDir . '/core/Migrations/Version13000Date20170926101637.php',
|
||||||
|
'OC\\Core\\Migrations\\Version13000Date20180516101403' => $baseDir . '/core/Migrations/Version13000Date20180516101403.php',
|
||||||
'OC\\DB\\Adapter' => $baseDir . '/lib/private/DB/Adapter.php',
|
'OC\\DB\\Adapter' => $baseDir . '/lib/private/DB/Adapter.php',
|
||||||
'OC\\DB\\AdapterMySQL' => $baseDir . '/lib/private/DB/AdapterMySQL.php',
|
'OC\\DB\\AdapterMySQL' => $baseDir . '/lib/private/DB/AdapterMySQL.php',
|
||||||
'OC\\DB\\AdapterOCI8' => $baseDir . '/lib/private/DB/AdapterOCI8.php',
|
'OC\\DB\\AdapterOCI8' => $baseDir . '/lib/private/DB/AdapterOCI8.php',
|
||||||
|
|
|
@ -6,8 +6,14 @@ namespace Composer\Autoload;
|
||||||
|
|
||||||
class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
|
class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
|
||||||
{
|
{
|
||||||
public static $firstCharsPsr4 = array (
|
public static $prefixLengthsPsr4 = array (
|
||||||
'O' => true,
|
'O' =>
|
||||||
|
array (
|
||||||
|
'OC\\Settings\\' => 12,
|
||||||
|
'OC\\Core\\' => 8,
|
||||||
|
'OC\\' => 3,
|
||||||
|
'OCP\\' => 4,
|
||||||
|
),
|
||||||
);
|
);
|
||||||
|
|
||||||
public static $prefixDirsPsr4 = array (
|
public static $prefixDirsPsr4 = array (
|
||||||
|
@ -418,6 +424,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
|
||||||
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
|
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
|
||||||
'OC\\Authentication\\Token\\DefaultTokenMapper' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
|
'OC\\Authentication\\Token\\DefaultTokenMapper' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
|
||||||
'OC\\Authentication\\Token\\DefaultTokenProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
|
'OC\\Authentication\\Token\\DefaultTokenProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
|
||||||
|
'OC\\Authentication\\Token\\ExpiredTokenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
|
||||||
'OC\\Authentication\\Token\\IProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IProvider.php',
|
'OC\\Authentication\\Token\\IProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IProvider.php',
|
||||||
'OC\\Authentication\\Token\\IToken' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IToken.php',
|
'OC\\Authentication\\Token\\IToken' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IToken.php',
|
||||||
'OC\\Authentication\\TwoFactorAuth\\Manager' => __DIR__ . '/../../..' . '/lib/private/Authentication/TwoFactorAuth/Manager.php',
|
'OC\\Authentication\\TwoFactorAuth\\Manager' => __DIR__ . '/../../..' . '/lib/private/Authentication/TwoFactorAuth/Manager.php',
|
||||||
|
@ -561,6 +568,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
|
||||||
'OC\\Core\\Migrations\\Version13000Date20170814074715' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170814074715.php',
|
'OC\\Core\\Migrations\\Version13000Date20170814074715' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170814074715.php',
|
||||||
'OC\\Core\\Migrations\\Version13000Date20170919121250' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170919121250.php',
|
'OC\\Core\\Migrations\\Version13000Date20170919121250' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170919121250.php',
|
||||||
'OC\\Core\\Migrations\\Version13000Date20170926101637' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170926101637.php',
|
'OC\\Core\\Migrations\\Version13000Date20170926101637' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170926101637.php',
|
||||||
|
'OC\\Core\\Migrations\\Version13000Date20180516101403' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20180516101403.php',
|
||||||
'OC\\DB\\Adapter' => __DIR__ . '/../../..' . '/lib/private/DB/Adapter.php',
|
'OC\\DB\\Adapter' => __DIR__ . '/../../..' . '/lib/private/DB/Adapter.php',
|
||||||
'OC\\DB\\AdapterMySQL' => __DIR__ . '/../../..' . '/lib/private/DB/AdapterMySQL.php',
|
'OC\\DB\\AdapterMySQL' => __DIR__ . '/../../..' . '/lib/private/DB/AdapterMySQL.php',
|
||||||
'OC\\DB\\AdapterOCI8' => __DIR__ . '/../../..' . '/lib/private/DB/AdapterOCI8.php',
|
'OC\\DB\\AdapterOCI8' => __DIR__ . '/../../..' . '/lib/private/DB/AdapterOCI8.php',
|
||||||
|
@ -986,7 +994,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
|
||||||
public static function getInitializer(ClassLoader $loader)
|
public static function getInitializer(ClassLoader $loader)
|
||||||
{
|
{
|
||||||
return \Closure::bind(function () use ($loader) {
|
return \Closure::bind(function () use ($loader) {
|
||||||
$loader->firstCharsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$firstCharsPsr4;
|
$loader->prefixLengthsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$prefixLengthsPsr4;
|
||||||
$loader->prefixDirsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$prefixDirsPsr4;
|
$loader->prefixDirsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$prefixDirsPsr4;
|
||||||
$loader->classMap = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$classMap;
|
$loader->classMap = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$classMap;
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,40 @@
|
||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* @copyright Copyright (c) 2018 Roeland Jago Douma <roeland@famdouma.nl>
|
||||||
|
*
|
||||||
|
* @author Roeland Jago Douma <roeland@famdouma.nl>
|
||||||
|
*
|
||||||
|
* @license GNU AGPL version 3 or any later version
|
||||||
|
*
|
||||||
|
* This program is free software: you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU Affero General Public License as
|
||||||
|
* published by the Free Software Foundation, either version 3 of the
|
||||||
|
* License, or (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU Affero General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU Affero General Public License
|
||||||
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
namespace OC\Authentication\Token;
|
||||||
|
|
||||||
|
use OC\Authentication\Exceptions\InvalidTokenException;
|
||||||
|
|
||||||
|
class ExpiredTokenException extends InvalidTokenException {
|
||||||
|
/** @var IToken */
|
||||||
|
private $token;
|
||||||
|
|
||||||
|
public function __construct(IToken $token) {
|
||||||
|
parent::__construct();
|
||||||
|
|
||||||
|
$this->token = $token;
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getToken() {
|
||||||
|
return $this->token;
|
||||||
|
}
|
||||||
|
}
|
|
@ -29,10 +29,8 @@ use OCP\AppFramework\Db\Entity;
|
||||||
* @method void setId(int $id)
|
* @method void setId(int $id)
|
||||||
* @method void setUid(string $uid);
|
* @method void setUid(string $uid);
|
||||||
* @method void setLoginName(string $loginName)
|
* @method void setLoginName(string $loginName)
|
||||||
* @method void setPassword(string $password)
|
|
||||||
* @method void setName(string $name)
|
* @method void setName(string $name)
|
||||||
* @method string getName()
|
* @method string getName()
|
||||||
* @method void setToken(string $token)
|
|
||||||
* @method string getToken()
|
* @method string getToken()
|
||||||
* @method void setType(string $type)
|
* @method void setType(string $type)
|
||||||
* @method int getType()
|
* @method int getType()
|
||||||
|
@ -93,10 +91,15 @@ class DefaultToken extends Entity implements IToken {
|
||||||
*/
|
*/
|
||||||
protected $scope;
|
protected $scope;
|
||||||
|
|
||||||
|
/** @var int */
|
||||||
|
protected $expires;
|
||||||
|
|
||||||
public function __construct() {
|
public function __construct() {
|
||||||
$this->addType('type', 'int');
|
$this->addType('type', 'int');
|
||||||
$this->addType('lastActivity', 'int');
|
$this->addType('lastActivity', 'int');
|
||||||
$this->addType('lastCheck', 'int');
|
$this->addType('lastCheck', 'int');
|
||||||
|
$this->addType('scope', 'string');
|
||||||
|
$this->addType('expires', 'int');
|
||||||
}
|
}
|
||||||
|
|
||||||
public function getId() {
|
public function getId() {
|
||||||
|
@ -174,4 +177,23 @@ class DefaultToken extends Entity implements IToken {
|
||||||
parent::setScope((string)$scope);
|
parent::setScope((string)$scope);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public function setToken($token) {
|
||||||
|
parent::setToken($token);
|
||||||
|
}
|
||||||
|
|
||||||
|
public function setPassword($password = null) {
|
||||||
|
parent::setPassword($password);
|
||||||
|
}
|
||||||
|
|
||||||
|
public function setExpires($expires) {
|
||||||
|
parent::setExpires($expires);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @return int|null
|
||||||
|
*/
|
||||||
|
public function getExpires() {
|
||||||
|
return parent::getExpires();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -78,7 +78,7 @@ class DefaultTokenMapper extends Mapper {
|
||||||
public function getToken($token) {
|
public function getToken($token) {
|
||||||
/* @var $qb IQueryBuilder */
|
/* @var $qb IQueryBuilder */
|
||||||
$qb = $this->db->getQueryBuilder();
|
$qb = $this->db->getQueryBuilder();
|
||||||
$result = $qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'remember', 'token', 'last_activity', 'last_check', 'scope')
|
$result = $qb->select('*')
|
||||||
->from('authtoken')
|
->from('authtoken')
|
||||||
->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
|
->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
|
||||||
->execute();
|
->execute();
|
||||||
|
@ -101,7 +101,7 @@ class DefaultTokenMapper extends Mapper {
|
||||||
public function getTokenById($id) {
|
public function getTokenById($id) {
|
||||||
/* @var $qb IQueryBuilder */
|
/* @var $qb IQueryBuilder */
|
||||||
$qb = $this->db->getQueryBuilder();
|
$qb = $this->db->getQueryBuilder();
|
||||||
$result = $qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'token', 'last_activity', 'last_check', 'scope')
|
$result = $qb->select('*')
|
||||||
->from('authtoken')
|
->from('authtoken')
|
||||||
->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
|
->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
|
||||||
->execute();
|
->execute();
|
||||||
|
@ -126,7 +126,7 @@ class DefaultTokenMapper extends Mapper {
|
||||||
public function getTokenByUser(IUser $user) {
|
public function getTokenByUser(IUser $user) {
|
||||||
/* @var $qb IQueryBuilder */
|
/* @var $qb IQueryBuilder */
|
||||||
$qb = $this->db->getQueryBuilder();
|
$qb = $this->db->getQueryBuilder();
|
||||||
$qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'remember', 'token', 'last_activity', 'last_check', 'scope')
|
$qb->select('*')
|
||||||
->from('authtoken')
|
->from('authtoken')
|
||||||
->where($qb->expr()->eq('uid', $qb->createNamedParameter($user->getUID())))
|
->where($qb->expr()->eq('uid', $qb->createNamedParameter($user->getUID())))
|
||||||
->setMaxResults(1000);
|
->setMaxResults(1000);
|
||||||
|
|
|
@ -155,13 +155,20 @@ class DefaultTokenProvider implements IProvider {
|
||||||
* @param string $tokenId
|
* @param string $tokenId
|
||||||
* @throws InvalidTokenException
|
* @throws InvalidTokenException
|
||||||
* @return DefaultToken
|
* @return DefaultToken
|
||||||
|
* @throws ExpiredTokenException
|
||||||
*/
|
*/
|
||||||
public function getToken($tokenId) {
|
public function getToken($tokenId) {
|
||||||
try {
|
try {
|
||||||
return $this->mapper->getToken($this->hashToken($tokenId));
|
$token = $this->mapper->getToken($this->hashToken($tokenId));
|
||||||
} catch (DoesNotExistException $ex) {
|
} catch (DoesNotExistException $ex) {
|
||||||
throw new InvalidTokenException();
|
throw new InvalidTokenException();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if ($token->getExpires() !== null && $token->getExpires() < $this->time->getTime()) {
|
||||||
|
throw new ExpiredTokenException($token);
|
||||||
|
}
|
||||||
|
|
||||||
|
return $token;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -170,13 +177,21 @@ class DefaultTokenProvider implements IProvider {
|
||||||
* @param string $tokenId
|
* @param string $tokenId
|
||||||
* @throws InvalidTokenException
|
* @throws InvalidTokenException
|
||||||
* @return DefaultToken
|
* @return DefaultToken
|
||||||
|
* @throws ExpiredTokenException
|
||||||
|
* @return IToken
|
||||||
*/
|
*/
|
||||||
public function getTokenById($tokenId) {
|
public function getTokenById($tokenId) {
|
||||||
try {
|
try {
|
||||||
return $this->mapper->getTokenById($tokenId);
|
$token = $this->mapper->getTokenById($tokenId);
|
||||||
} catch (DoesNotExistException $ex) {
|
} catch (DoesNotExistException $ex) {
|
||||||
throw new InvalidTokenException();
|
throw new InvalidTokenException();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if ($token->getExpires() !== null && $token->getExpires() < $this->time->getTime()) {
|
||||||
|
throw new ExpiredTokenException($token);
|
||||||
|
}
|
||||||
|
|
||||||
|
return $token;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -266,6 +281,28 @@ class DefaultTokenProvider implements IProvider {
|
||||||
$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
|
$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Rotate the token. Usefull for for example oauth tokens
|
||||||
|
*
|
||||||
|
* @param IToken $token
|
||||||
|
* @param string $oldTokenId
|
||||||
|
* @param string $newTokenId
|
||||||
|
* @return IToken
|
||||||
|
*/
|
||||||
|
public function rotate(IToken $token, $oldTokenId, $newTokenId) {
|
||||||
|
try {
|
||||||
|
$password = $this->getPassword($token, $oldTokenId);
|
||||||
|
$token->setPassword($this->encryptPassword($password, $newTokenId));
|
||||||
|
} catch (PasswordlessTokenException $e) {
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
$token->setToken($this->hashToken($newTokenId));
|
||||||
|
$this->updateToken($token);
|
||||||
|
|
||||||
|
return $token;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @param string $token
|
* @param string $token
|
||||||
* @return string
|
* @return string
|
||||||
|
|
|
@ -51,6 +51,7 @@ interface IProvider {
|
||||||
*
|
*
|
||||||
* @param string $tokenId
|
* @param string $tokenId
|
||||||
* @throws InvalidTokenException
|
* @throws InvalidTokenException
|
||||||
|
* @throws ExpiredTokenException
|
||||||
* @return IToken
|
* @return IToken
|
||||||
*/
|
*/
|
||||||
public function getToken($tokenId);
|
public function getToken($tokenId);
|
||||||
|
@ -61,6 +62,7 @@ interface IProvider {
|
||||||
* @param string $tokenId
|
* @param string $tokenId
|
||||||
* @throws InvalidTokenException
|
* @throws InvalidTokenException
|
||||||
* @return DefaultToken
|
* @return DefaultToken
|
||||||
|
* @throws ExpiredTokenException
|
||||||
*/
|
*/
|
||||||
public function getTokenById($tokenId);
|
public function getTokenById($tokenId);
|
||||||
|
|
||||||
|
@ -138,4 +140,14 @@ interface IProvider {
|
||||||
* @throws InvalidTokenException
|
* @throws InvalidTokenException
|
||||||
*/
|
*/
|
||||||
public function setPassword(IToken $token, $tokenId, $password);
|
public function setPassword(IToken $token, $tokenId, $password);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Rotate the token. Usefull for for example oauth tokens
|
||||||
|
*
|
||||||
|
* @param IToken $token
|
||||||
|
* @param string $oldTokenId
|
||||||
|
* @param string $newTokenId
|
||||||
|
* @return IToken
|
||||||
|
*/
|
||||||
|
public function rotate(IToken $token, $oldTokenId, $newTokenId);
|
||||||
}
|
}
|
||||||
|
|
|
@ -94,4 +94,25 @@ interface IToken extends JsonSerializable {
|
||||||
* @param array $scope
|
* @param array $scope
|
||||||
*/
|
*/
|
||||||
public function setScope($scope);
|
public function setScope($scope);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set the token
|
||||||
|
*
|
||||||
|
* @param string $token
|
||||||
|
*/
|
||||||
|
public function setToken($token);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set the password
|
||||||
|
*
|
||||||
|
* @param string $password
|
||||||
|
*/
|
||||||
|
public function setPassword($password);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set the expiration time of the token
|
||||||
|
*
|
||||||
|
* @param int|null $expires
|
||||||
|
*/
|
||||||
|
public function setExpires($expires);
|
||||||
}
|
}
|
||||||
|
|
|
@ -25,6 +25,7 @@ namespace Test\Authentication\Token;
|
||||||
use OC\Authentication\Exceptions\InvalidTokenException;
|
use OC\Authentication\Exceptions\InvalidTokenException;
|
||||||
use OC\Authentication\Token\DefaultToken;
|
use OC\Authentication\Token\DefaultToken;
|
||||||
use OC\Authentication\Token\DefaultTokenProvider;
|
use OC\Authentication\Token\DefaultTokenProvider;
|
||||||
|
use OC\Authentication\Token\ExpiredTokenException;
|
||||||
use OC\Authentication\Token\IToken;
|
use OC\Authentication\Token\IToken;
|
||||||
use OCP\AppFramework\Db\DoesNotExistException;
|
use OCP\AppFramework\Db\DoesNotExistException;
|
||||||
use OCP\AppFramework\Db\Mapper;
|
use OCP\AppFramework\Db\Mapper;
|
||||||
|
@ -397,6 +398,63 @@ class DefaultTokenProviderTest extends TestCase {
|
||||||
$this->tokenProvider->renewSessionToken('oldId', 'newId');
|
$this->tokenProvider->renewSessionToken('oldId', 'newId');
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public function testGetToken() {
|
||||||
|
$token = new DefaultToken();
|
||||||
|
|
||||||
|
$this->config->method('getSystemValue')
|
||||||
|
->with('secret')
|
||||||
|
->willReturn('mysecret');
|
||||||
|
|
||||||
|
$this->mapper->method('getToken')
|
||||||
|
->with(
|
||||||
|
$this->callback(function ($token) {
|
||||||
|
return hash('sha512', 'unhashedTokenmysecret') === $token;
|
||||||
|
})
|
||||||
|
)->willReturn($token);
|
||||||
|
|
||||||
|
$this->assertSame($token, $this->tokenProvider->getToken('unhashedToken'));
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testGetInvalidToken() {
|
||||||
|
$this->expectException(InvalidTokenException::class);
|
||||||
|
|
||||||
|
$this->config->method('getSystemValue')
|
||||||
|
->with('secret')
|
||||||
|
->willReturn('mysecret');
|
||||||
|
|
||||||
|
$this->mapper->method('getToken')
|
||||||
|
->with(
|
||||||
|
$this->callback(function ($token) {
|
||||||
|
return hash('sha512', 'unhashedTokenmysecret') === $token;
|
||||||
|
})
|
||||||
|
)->willThrowException(new InvalidTokenException());
|
||||||
|
|
||||||
|
$this->tokenProvider->getToken('unhashedToken');
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testGetExpiredToken() {
|
||||||
|
$token = new DefaultToken();
|
||||||
|
$token->setExpires(42);
|
||||||
|
|
||||||
|
$this->config->method('getSystemValue')
|
||||||
|
->with('secret')
|
||||||
|
->willReturn('mysecret');
|
||||||
|
|
||||||
|
$this->mapper->method('getToken')
|
||||||
|
->with(
|
||||||
|
$this->callback(function ($token) {
|
||||||
|
return hash('sha512', 'unhashedTokenmysecret') === $token;
|
||||||
|
})
|
||||||
|
)->willReturn($token);
|
||||||
|
|
||||||
|
try {
|
||||||
|
$this->tokenProvider->getToken('unhashedToken');
|
||||||
|
} catch (ExpiredTokenException $e) {
|
||||||
|
$this->assertSame($token, $e->getToken());
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
public function testGetTokenById() {
|
public function testGetTokenById() {
|
||||||
$token = $this->createMock(DefaultToken::class);
|
$token = $this->createMock(DefaultToken::class);
|
||||||
|
|
||||||
|
@ -418,4 +476,63 @@ class DefaultTokenProviderTest extends TestCase {
|
||||||
|
|
||||||
$this->tokenProvider->getTokenById(42);
|
$this->tokenProvider->getTokenById(42);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public function testGetExpiredTokenById() {
|
||||||
|
$token = new DefaultToken();
|
||||||
|
$token->setExpires(42);
|
||||||
|
|
||||||
|
$this->mapper->expects($this->once())
|
||||||
|
->method('getTokenById')
|
||||||
|
->with($this->equalTo(42))
|
||||||
|
->willReturn($token);
|
||||||
|
|
||||||
|
try {
|
||||||
|
$this->tokenProvider->getTokenById(42);
|
||||||
|
$this->fail();
|
||||||
|
} catch (ExpiredTokenException $e) {
|
||||||
|
$this->assertSame($token, $e->getToken());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testRotate() {
|
||||||
|
$token = new DefaultToken();
|
||||||
|
$token->setPassword('oldencryptedpassword');
|
||||||
|
|
||||||
|
$this->config->method('getSystemValue')
|
||||||
|
->with('secret')
|
||||||
|
->willReturn('mysecret');
|
||||||
|
|
||||||
|
$this->crypto->method('decrypt')
|
||||||
|
->with('oldencryptedpassword', 'oldtokenmysecret')
|
||||||
|
->willReturn('mypassword');
|
||||||
|
$this->crypto->method('encrypt')
|
||||||
|
->with('mypassword', 'newtokenmysecret')
|
||||||
|
->willReturn('newencryptedpassword');
|
||||||
|
|
||||||
|
$this->mapper->expects($this->once())
|
||||||
|
->method('update')
|
||||||
|
->with($this->callback(function (DefaultToken $token) {
|
||||||
|
return $token->getPassword() === 'newencryptedpassword' &&
|
||||||
|
$token->getToken() === hash('sha512', 'newtokenmysecret');
|
||||||
|
}));
|
||||||
|
|
||||||
|
$this->tokenProvider->rotate($token, 'oldtoken', 'newtoken');
|
||||||
|
}
|
||||||
|
|
||||||
|
public function testRotateNoPassword() {
|
||||||
|
$token = new DefaultToken();
|
||||||
|
|
||||||
|
$this->config->method('getSystemValue')
|
||||||
|
->with('secret')
|
||||||
|
->willReturn('mysecret');
|
||||||
|
|
||||||
|
$this->mapper->expects($this->once())
|
||||||
|
->method('update')
|
||||||
|
->with($this->callback(function (DefaultToken $token) {
|
||||||
|
return $token->getPassword() === null &&
|
||||||
|
$token->getToken() === hash('sha512', 'newtokenmysecret');
|
||||||
|
}));
|
||||||
|
|
||||||
|
$this->tokenProvider->rotate($token, 'oldtoken', 'newtoken');
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -29,7 +29,7 @@
|
||||||
// between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel
|
// between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel
|
||||||
// when updating major/minor version number.
|
// when updating major/minor version number.
|
||||||
|
|
||||||
$OC_Version = array(13, 0, 2, 1);
|
$OC_Version = array(13, 0, 2, 2);
|
||||||
|
|
||||||
// The human readable string
|
// The human readable string
|
||||||
$OC_VersionString = '13.0.2';
|
$OC_VersionString = '13.0.2';
|
||||||
|
|
Loading…
Reference in New Issue