src/Security/OAuth.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2024, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Security;
  23
  24 use Friendica\Core\Logger;
  25 use Friendica\Core\Worker;
  26 use Friendica\Database\Database;
  27 use Friendica\Database\DBA;
  28 use Friendica\Model\Contact;
  29 use Friendica\Model\User;
  30 use Friendica\Module\BaseApi;
  31 use Friendica\Util\DateTimeFormat;
  32 use GuzzleHttp\Psr7\Uri;
  33
  34 /**
  35  * OAuth Server
  36  */
  37 class OAuth
  38 {
  39         /**
  40          * @var bool|int
  41          */
  42         protected static $current_user_id = 0;
  43         /**
  44          * @var array
  45          */
  46         protected static $current_token = [];
  47
  48         /**
  49          * Get current user id, returns 0 if not logged in
  50          *
  51          * @return int User ID
  52          */
  53         public static function getCurrentUserID()
  54         {
  55                 if (empty(self::$current_user_id)) {
  56                         $token = self::getCurrentApplicationToken();
  57                         if (!empty($token['uid'])) {
  58                                 self::$current_user_id = $token['uid'];
  59                         } else {
  60                                 self::$current_user_id = 0;
  61                         }
  62                 }
  63
  64                 return (int)self::$current_user_id;
  65         }
  66
  67         /**
  68          * Get current application token
  69          *
  70          * @return array token
  71          */
  72         public static function getCurrentApplicationToken()
  73         {
  74                 if (empty(self::$current_token)) {
  75                         self::$current_token = self::getTokenByBearer();
  76                 }
  77
  78                 return self::$current_token;
  79         }
  80
  81         /**
  82          * Get the user token via the Bearer token
  83          *
  84          * @return array User Token
  85          */
  86         private static function getTokenByBearer()
  87         {
  88                 $authorization = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
  89
  90                 if (empty($authorization)) {
  91                         // workaround for HTTP-auth in CGI mode
  92                         $authorization = $_SERVER['REDIRECT_REMOTE_USER'] ?? '';
  93                 }
  94
  95                 if (substr($authorization, 0, 7) != 'Bearer ') {
  96                         return [];
  97                 }
  98
  99                 $condition = ['access_token' => trim(substr($authorization, 7))];
 100
 101                 $token = DBA::selectFirst('application-view', ['uid', 'id', 'name', 'website', 'created_at', 'read', 'write', 'follow', 'push'], $condition);
 102                 if (!DBA::isResult($token)) {
 103                         Logger::notice('Token not found', $condition);
 104                         return [];
 105                 }
 106                 Logger::debug('Token found', $token);
 107
 108                 User::updateLastActivity($token['uid']);
 109
 110                 // Regularly update suggestions
 111                 if (Contact\Relation::areSuggestionsOutdated($token['uid'])) {
 112                         Worker::add(Worker::PRIORITY_MEDIUM, 'UpdateSuggestions', $token['uid']);
 113                 }
 114
 115                 return $token;
 116         }
 117
 118         /**
 119          * Get the application record via the provided request header fields
 120          *
 121          * @param string $client_id
 122          * @param string $client_secret
 123          * @param string $redirect_uri
 124          * @return array application record
 125          */
 126         public static function getApplication(string $client_id, string $client_secret, string $redirect_uri)
 127         {
 128                 $condition = ['client_id' => $client_id];
 129                 if (!empty($client_secret)) {
 130                         $condition['client_secret'] = $client_secret;
 131                 }
 132
 133                 if (!empty($redirect_uri)) {
 134                         $redirect_uri = strtok($redirect_uri, '?');
 135                         $condition = DBA::mergeConditions($condition, ["`redirect_uri` LIKE ?", '%' . $redirect_uri . '%']);
 136                 }
 137
 138                 $application = DBA::selectFirst('application', [], $condition);
 139                 if (!DBA::isResult($application)) {
 140                         Logger::warning('Application not found', $condition);
 141                         return [];
 142                 }
 143
 144                 // The redirect_uri could contain several URI that are separated by spaces.
 145                 if (($application['redirect_uri'] != $redirect_uri) && !in_array($redirect_uri, explode(' ', $application['redirect_uri']))) {
 146                         return [];
 147                 }
 148
 149                 return $application;
 150         }
 151
 152         /**
 153          * Check if an token for the application and user exists
 154          *
 155          * @param array $application
 156          * @param integer $uid
 157          * @return boolean
 158          */
 159         public static function existsTokenForUser(array $application, int $uid)
 160         {
 161                 return DBA::exists('application-token', ['application-id' => $application['id'], 'uid' => $uid]);
 162         }
 163
 164         /**
 165          * Fetch the token for the given application and user
 166          *
 167          * @param array $application
 168          * @param integer $uid
 169          * @return array application record
 170          */
 171         public static function getTokenForUser(array $application, int $uid)
 172         {
 173                 return DBA::selectFirst('application-token', [], ['application-id' => $application['id'], 'uid' => $uid]);
 174         }
 175
 176         /**
 177          * Create and fetch an token for the application and user
 178          *
 179          * @param array   $application
 180          * @param integer $uid
 181          * @param string  $scope
 182          * @return array application record
 183          */
 184         public static function createTokenForUser(array $application, int $uid, string $scope)
 185         {
 186                 $code         = bin2hex(random_bytes(32));
 187                 $access_token = bin2hex(random_bytes(32));
 188
 189                 $fields = [
 190                         'application-id' => $application['id'],
 191                         'uid'            => $uid,
 192                         'code'           => $code,
 193                         'access_token'   => $access_token,
 194                         'scopes'         => $scope,
 195                         'read'           => (stripos($scope, BaseApi::SCOPE_READ) !== false),
 196                         'write'          => (stripos($scope, BaseApi::SCOPE_WRITE) !== false),
 197                         'follow'         => (stripos($scope, BaseApi::SCOPE_FOLLOW) !== false),
 198                         'push'           => (stripos($scope, BaseApi::SCOPE_PUSH) !== false),
 199                         'created_at'     => DateTimeFormat::utcNow()
 200                 ];
 201
 202                 foreach ([BaseApi::SCOPE_READ, BaseApi::SCOPE_WRITE, BaseApi::SCOPE_WRITE, BaseApi::SCOPE_PUSH] as $scope) {
 203                         if ($fields[$scope] && !$application[$scope]) {
 204                                 Logger::warning('Requested token scope is not allowed for the application', ['token' => $fields, 'application' => $application]);
 205                         }
 206                 }
 207
 208                 if (!DBA::insert('application-token', $fields, Database::INSERT_UPDATE)) {
 209                         return [];
 210                 }
 211
 212                 return DBA::selectFirst('application-token', [], ['application-id' => $application['id'], 'uid' => $uid]);
 213         }
 214 }