src/Model/TwoFactor/AppSpecificPassword.php

   1 <?php
   2
   3 namespace Friendica\Model\TwoFactor;
   4
   5 use Friendica\Database\DBA;
   6 use Friendica\Model\User;
   7 use Friendica\Util\DateTimeFormat;
   8 use Friendica\Util\Temporal;
   9 use PragmaRX\Random\Random;
  10
  11 /**
  12  * Manages users' two-factor recovery hashed_passwords in the 2fa_app_specific_passwords table
  13  *
  14  * @package Friendica\Model
  15  */
  16 class AppSpecificPassword
  17 {
  18         public static function countForUser($uid)
  19         {
  20                 return DBA::count('2fa_app_specific_password', ['uid' => $uid]);
  21         }
  22
  23         public static function checkDuplicateForUser($uid, $description)
  24         {
  25                 return DBA::exists('2fa_app_specific_password', ['uid' => $uid, 'description' => $description]);
  26         }
  27
  28         /**
  29          * Checks the provided hashed_password is available to use for login by the provided user
  30          *
  31          * @param int    $uid User ID
  32          * @param string $plaintextPassword
  33          * @return bool
  34          * @throws \Exception
  35          */
  36         public static function authenticateUser($uid, $plaintextPassword)
  37         {
  38                 $appSpecificPasswords = self::getListForUser($uid);
  39
  40                 $return = false;
  41
  42                 foreach ($appSpecificPasswords as $appSpecificPassword) {
  43                         if (password_verify($plaintextPassword, $appSpecificPassword['hashed_password'])) {
  44                                 $fields = ['last_used' => DateTimeFormat::utcNow()];
  45                                 if (password_needs_rehash($appSpecificPassword['hashed_password'], PASSWORD_DEFAULT)) {
  46                                         $fields['hashed_password'] = User::hashPassword($plaintextPassword);
  47                                 }
  48
  49                                 self::update($appSpecificPassword['id'], $fields);
  50
  51                                 $return |= true;
  52                         }
  53                 }
  54
  55                 return $return;
  56         }
  57
  58     /**
  59      * Returns a complete list of all recovery hashed_passwords for the provided user, including the used status
  60      *
  61      * @param  int $uid User ID
  62      * @return array
  63      * @throws \Exception
  64      */
  65         public static function getListForUser($uid)
  66         {
  67                 $appSpecificPasswordsStmt = DBA::select('2fa_app_specific_password', ['id', 'description', 'hashed_password', 'last_used'], ['uid' => $uid]);
  68
  69                 $appSpecificPasswords = DBA::toArray($appSpecificPasswordsStmt);
  70
  71                 array_walk($appSpecificPasswords, function (&$value) {
  72                         $value['ago'] = Temporal::getRelativeDate($value['last_used']);
  73                 });
  74
  75                 return $appSpecificPasswords;
  76         }
  77
  78     /**
  79      * Generates a new app specific password for the provided user and hashes it in the database.
  80      *
  81      * @param  int    $uid         User ID
  82      * @param  string $description Password description
  83      * @return array The new app-specific password data structure with the plaintext password added
  84      * @throws \Exception
  85      */
  86         public static function generateForUser(int $uid, $description)
  87         {
  88                 $Random = (new Random())->size(40);
  89
  90                 $plaintextPassword = $Random->get();
  91
  92                 $generated = DateTimeFormat::utcNow();
  93
  94                 $fields = [
  95                         'uid' => $uid,
  96                         'description' => $description,
  97                         'hashed_password' => User::hashPassword($plaintextPassword),
  98                         'generated' => $generated,
  99                 ];
 100
 101                 DBA::insert('2fa_app_specific_password', $fields);
 102
 103                 $fields['id'] = DBA::lastInsertId();
 104                 $fields['plaintext_password'] = $plaintextPassword;
 105
 106                 return $fields;
 107         }
 108
 109         private static function update($appSpecificPasswordId, $fields)
 110         {
 111                 return DBA::update('2fa_app_specific_password', $fields, ['id' => $appSpecificPasswordId]);
 112         }
 113
 114         /**
 115          * Deletes all the recovery hashed_passwords for the provided user.
 116          *
 117          * @param int $uid User ID
 118          * @return bool
 119          * @throws \Exception
 120          */
 121         public static function deleteAllForUser(int $uid)
 122         {
 123                 return DBA::delete('2fa_app_specific_password', ['uid' => $uid]);
 124         }
 125
 126         /**
 127          * @param int $uid
 128          * @param int $app_specific_password_id
 129          * @return bool
 130          * @throws \Exception
 131          */
 132         public static function deleteForUser(int $uid, int $app_specific_password_id)
 133         {
 134                 return DBA::delete('2fa_app_specific_password', ['id' => $app_specific_password_id, 'uid' => $uid]);
 135         }
 136 }