src/Model/TwoFactor/AppSpecificPassword.php

   1 <?php
   2
   3 namespace Friendica\Model\TwoFactor;
   4
   5 use Friendica\BaseObject;
   6 use Friendica\Database\DBA;
   7 use Friendica\Model\User;
   8 use Friendica\Util\DateTimeFormat;
   9 use Friendica\Util\Temporal;
  10 use PragmaRX\Random\Random;
  11
  12 /**
  13  * Manages users' two-factor recovery hashed_passwords in the 2fa_app_specific_passwords table
  14  *
  15  * @package Friendica\Model
  16  */
  17 class AppSpecificPassword extends BaseObject
  18 {
  19         public static function countForUser($uid)
  20         {
  21                 return DBA::count('2fa_app_specific_password', ['uid' => $uid]);
  22         }
  23
  24         public static function checkDuplicateForUser($uid, $description)
  25         {
  26                 return DBA::exists('2fa_app_specific_password', ['uid' => $uid, 'description' => $description]);
  27         }
  28
  29         /**
  30          * Checks the provided hashed_password is available to use for login by the provided user
  31          *
  32          * @param int    $uid User ID
  33          * @param string $plaintextPassword
  34          * @return bool
  35          * @throws \Exception
  36          */
  37         public static function authenticateUser($uid, $plaintextPassword)
  38         {
  39                 $appSpecificPasswords = self::getListForUser($uid);
  40
  41                 $return = false;
  42
  43                 foreach ($appSpecificPasswords as $appSpecificPassword) {
  44                         if (password_verify($plaintextPassword, $appSpecificPassword['hashed_password'])) {
  45                                 $fields = ['last_used' => DateTimeFormat::utcNow()];
  46                                 if (password_needs_rehash($appSpecificPassword['hashed_password'], PASSWORD_DEFAULT)) {
  47                                         $fields['hashed_password'] = User::hashPassword($plaintextPassword);
  48                                 }
  49
  50                                 self::update($appSpecificPassword['id'], $fields);
  51
  52                                 $return |= true;
  53                         }
  54                 }
  55
  56                 return $return;
  57         }
  58
  59     /**
  60      * Returns a complete list of all recovery hashed_passwords for the provided user, including the used status
  61      *
  62      * @param  int $uid User ID
  63      * @return array
  64      * @throws \Exception
  65      */
  66         public static function getListForUser($uid)
  67         {
  68                 $appSpecificPasswordsStmt = DBA::select('2fa_app_specific_password', ['id', 'description', 'hashed_password', 'last_used'], ['uid' => $uid]);
  69
  70                 $appSpecificPasswords = DBA::toArray($appSpecificPasswordsStmt);
  71
  72                 array_walk($appSpecificPasswords, function (&$value) {
  73                         $value['ago'] = Temporal::getRelativeDate($value['last_used']);
  74                 });
  75
  76                 return $appSpecificPasswords;
  77         }
  78
  79     /**
  80      * Generates a new app specific password for the provided user and hashes it in the database.
  81      *
  82      * @param  int    $uid         User ID
  83      * @param  string $description Password description
  84      * @return array The new app-specific password data structure with the plaintext password added
  85      * @throws \Exception
  86      */
  87         public static function generateForUser(int $uid, $description)
  88         {
  89                 $Random = (new Random())->size(40);
  90
  91                 $plaintextPassword = $Random->get();
  92
  93                 $generated = DateTimeFormat::utcNow();
  94
  95                 $fields = [
  96                         'uid' => $uid,
  97                         'description' => $description,
  98                         'hashed_password' => User::hashPassword($plaintextPassword),
  99                         'generated' => $generated,
 100                 ];
 101
 102                 DBA::insert('2fa_app_specific_password', $fields);
 103
 104                 $fields['id'] = DBA::lastInsertId();
 105                 $fields['plaintext_password'] = $plaintextPassword;
 106
 107                 return $fields;
 108         }
 109
 110         private static function update($appSpecificPasswordId, $fields)
 111         {
 112                 return DBA::update('2fa_app_specific_password', $fields, ['id' => $appSpecificPasswordId]);
 113         }
 114
 115         /**
 116          * Deletes all the recovery hashed_passwords for the provided user.
 117          *
 118          * @param int $uid User ID
 119          * @return bool
 120          * @throws \Exception
 121          */
 122         public static function deleteAllForUser(int $uid)
 123         {
 124                 return DBA::delete('2fa_app_specific_password', ['uid' => $uid]);
 125         }
 126
 127         /**
 128          * @param int $uid
 129          * @param int $app_specific_password_id
 130          * @return bool
 131          * @throws \Exception
 132          */
 133         public static function deleteForUser(int $uid, int $app_specific_password_id)
 134         {
 135                 return DBA::delete('2fa_app_specific_password', ['id' => $app_specific_password_id, 'uid' => $uid]);
 136         }
 137 }