src/Security/TwoFactor/Model/AppSpecificPassword.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2022, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Security\TwoFactor\Model;
  23
  24 use Friendica\Database\DBA;
  25 use Friendica\Model\User;
  26 use Friendica\Util\DateTimeFormat;
  27 use Friendica\Util\Temporal;
  28 use PragmaRX\Random\Random;
  29
  30 /**
  31  * Manages users' two-factor recovery hashed_passwords in the 2fa_app_specific_passwords table
  32  */
  33 class AppSpecificPassword
  34 {
  35         public static function countForUser($uid)
  36         {
  37                 return DBA::count('2fa_app_specific_password', ['uid' => $uid]);
  38         }
  39
  40         public static function checkDuplicateForUser($uid, $description)
  41         {
  42                 return DBA::exists('2fa_app_specific_password', ['uid' => $uid, 'description' => $description]);
  43         }
  44
  45         /**
  46          * Checks the provided hashed_password is available to use for login by the provided user
  47          *
  48          * @param int    $uid User ID
  49          * @param string $plaintextPassword
  50          * @return bool
  51          * @throws \Exception
  52          */
  53         public static function authenticateUser($uid, $plaintextPassword)
  54         {
  55                 $appSpecificPasswords = self::getListForUser($uid);
  56
  57                 $return = false;
  58
  59                 foreach ($appSpecificPasswords as $appSpecificPassword) {
  60                         if (password_verify($plaintextPassword, $appSpecificPassword['hashed_password'])) {
  61                                 $fields = ['last_used' => DateTimeFormat::utcNow()];
  62                                 if (password_needs_rehash($appSpecificPassword['hashed_password'], PASSWORD_DEFAULT)) {
  63                                         $fields['hashed_password'] = User::hashPassword($plaintextPassword);
  64                                 }
  65
  66                                 self::update($appSpecificPassword['id'], $fields);
  67
  68                                 $return |= true;
  69                         }
  70                 }
  71
  72                 return $return;
  73         }
  74
  75     /**
  76      * Returns a complete list of all recovery hashed_passwords for the provided user, including the used status
  77      *
  78      * @param  int $uid User ID
  79      * @return array
  80      * @throws \Exception
  81      */
  82         public static function getListForUser($uid)
  83         {
  84                 $appSpecificPasswordsStmt = DBA::select('2fa_app_specific_password', ['id', 'description', 'hashed_password', 'last_used'], ['uid' => $uid]);
  85
  86                 $appSpecificPasswords = DBA::toArray($appSpecificPasswordsStmt);
  87
  88                 array_walk($appSpecificPasswords, function (&$value) {
  89                         $value['ago']   = Temporal::getRelativeDate($value['last_used']);
  90                         $value['utc']   = $value['last_used'] ? DateTimeFormat::utc($value['last_used'], 'c') : '';
  91                         $value['local'] = $value['last_used'] ? DateTimeFormat::local($value['last_used'], 'r') : '';
  92                 });
  93
  94                 return $appSpecificPasswords;
  95         }
  96
  97     /**
  98      * Generates a new app specific password for the provided user and hashes it in the database.
  99      *
 100      * @param  int    $uid         User ID
 101      * @param  string $description Password description
 102      * @return array The new app-specific password data structure with the plaintext password added
 103      * @throws \Exception
 104      */
 105         public static function generateForUser(int $uid, $description)
 106         {
 107                 $Random = (new Random())->size(40);
 108
 109                 $plaintextPassword = $Random->get();
 110
 111                 $generated = DateTimeFormat::utcNow();
 112
 113                 $fields = [
 114                         'uid' => $uid,
 115                         'description' => $description,
 116                         'hashed_password' => User::hashPassword($plaintextPassword),
 117                         'generated' => $generated,
 118                 ];
 119
 120                 DBA::insert('2fa_app_specific_password', $fields);
 121
 122                 $fields['id'] = DBA::lastInsertId();
 123                 $fields['plaintext_password'] = $plaintextPassword;
 124
 125                 return $fields;
 126         }
 127
 128         private static function update($appSpecificPasswordId, $fields)
 129         {
 130                 return DBA::update('2fa_app_specific_password', $fields, ['id' => $appSpecificPasswordId]);
 131         }
 132
 133         /**
 134          * Deletes all the recovery hashed_passwords for the provided user.
 135          *
 136          * @param int $uid User ID
 137          * @return bool
 138          * @throws \Exception
 139          */
 140         public static function deleteAllForUser(int $uid)
 141         {
 142                 return DBA::delete('2fa_app_specific_password', ['uid' => $uid]);
 143         }
 144
 145         /**
 146          * @param int $uid
 147          * @param int $app_specific_password_id
 148          * @return bool
 149          * @throws \Exception
 150          */
 151         public static function deleteForUser(int $uid, int $app_specific_password_id)
 152         {
 153                 return DBA::delete('2fa_app_specific_password', ['id' => $app_specific_password_id, 'uid' => $uid]);
 154         }
 155 }