AbstractToken.php

<?php

declare(strict_types=1);

namespace Staffbase\plugins\sdk;

use DateInterval;
use Exception;
use Lcobucci\JWT\Configuration;
use Lcobucci\JWT\Signer;
use Lcobucci\JWT\Signer\Key;
use Lcobucci\JWT\Signer\Key\InMemory;
use Lcobucci\JWT\Token\Plain;
use Lcobucci\JWT\Validation\Constraint;
use Lcobucci\JWT\Validation\Constraint\SignedWith;
use Lcobucci\JWT\Validation\RequiredConstraintsViolated;
use Staffbase\plugins\sdk\Exceptions\SSOAuthenticationException;
use Staffbase\plugins\sdk\Exceptions\SSOException;

abstract class AbstractToken
{
    private Plain $token;

    private Key $signerKey;

    private Configuration $config;

    /**
     * @var Constraint[]
     */
    private array $constraints;

    /**
     * Constructor
     *
     * @param string $appSecret Either a PEM key or a file:// URL.
     * @param non-empty-string $tokenData The token text.
     * @param Signer $signer The algorithm which is used to sign the token
     * @param Constraint[] $constrains constrains
     *
     * @throws SSOAuthenticationException
     * @throws SSOException on invalid parameters.
     */
    public function __construct(string $appSecret, protected string $tokenData, Signer $signer, array $constrains = [])
    {
        if (!trim($appSecret)) {
            throw new SSOException('Parameter appSecret for SSOToken is empty.');
        }

        if (!trim($tokenData)) {
            throw new SSOException('Parameter tokenData for SSOToken is empty.');
        }

        $this->setSignerKey(trim($appSecret));
        $this->setConfig(Configuration::forSymmetricSigner($signer, $this->getSignerKey()));

        $this->constraints = [
            new SignedWith($signer, $this->getSignerKey()),
            ...$constrains,
        ];
    }

    /**
     * Creates and validates an SSO token.
     *
     */
    protected function parseToken(): void
    {
        // parse text
        $token = $this->config->parser()->parse($this->tokenData);
        if (!$token instanceof Plain) {
            throw new \RuntimeException('Parsed token is not a Plain token');
        }
        $this->token = $token;
    }

    /**
     * Creates and validates an SSO token.
     *
     * @throws SSOAuthenticationException if the parsing/verification/validation of the token fails.
     */
    protected function validateToken(): void
    {
        try {
            $this->config->validator()->assert($this->token, ...$this->constraints);
        } catch (RequiredConstraintsViolated $violation) {
            throw new SSOAuthenticationException($violation->getMessage());
        }
    }

    /**
     * Test if a claim is set.
     *
     * @param string $claim name.
     */
    protected function hasClaim(string $claim): bool
    {
        if (empty($claim)) {
            return false;
        }
        return $this->token->claims()->has($claim);
    }

    /**
     * Get a claim without checking for existence.
     *
     * @param string $claim name.
     *
     * @return mixed
     */
    /**
     * Get a claim without checking for existence.
     *
     * @param string $claim name.
     *
     * @return mixed
     */
    protected function getClaim(string $claim): mixed
    {
        if (empty($claim)) {
            return null;
        }
        return $this->token->claims()->get($claim);
    }

    /**
     * Get an array of all available claims and their values.
     *
     * @return array<string, mixed>
     */
    protected function getAllClaims(): array
    {

        return $this->token->claims()->all();
    }

    /**
     * Translate a base64 string to PEM encoded public key.
     *
     * @param string $data base64 encoded key
     *
     * @return string PEM encoded key
     */
    public static function base64ToPEMPublicKey(string $data): string
    {
        if (empty($data)) {
            throw new SSOException('Empty base64 data provided for PEM conversion.');
        }

        $data = strtr($data, [
            "\r" => "",
            "\n" => "",
        ]);

        if (empty($data)) {
            throw new SSOException('Base64 data is empty after cleanup.');
        }

        return
            "-----BEGIN PUBLIC KEY-----\n"
            . chunk_split($data, 64)
            . "-----END PUBLIC KEY-----\n";
    }

    /**
     * Set the configuration
     *
     * @param Configuration $value
     */
    public function setConfig(Configuration $value): void
    {
        $this->config = $value;
    }

    /**
     * Get the configuration
     */
    public function getConfig(): Configuration
    {
        return $this->config;
    }

    /**
     * Creates a key from the secret and stores it to the property
     * @param string $secret
     */
    public function setSignerKey(string $secret): void
    {
        $this->signerKey = $this->getKey($secret);
    }

    /**
     * Get the Signer key
     */
    public function getSignerKey(): Key
    {
        return $this->signerKey;
    }

    /**
     * Decides between the new key methods, the JWT library offers
     *
     * @param string $appSecret
     */
    private function getKey(string $appSecret): Key
    {
        // Ensure the app secret is not empty to satisfy strict non-empty-string requirements
        if (!trim($appSecret)) {
            throw new SSOException('Empty appSecret provided when creating signer key.');
        }

        if (strpos($appSecret, '-----') === 0) {
            if (empty($appSecret)) {
                throw new SSOException('Empty PEM key provided.');
            }
            $key = InMemory::plainText($appSecret);
        } elseif (strpos($appSecret, 'file://') === 0) {
            if (empty($appSecret)) {
                throw new SSOException('Empty file path provided.');
            }
            $key = InMemory::file($appSecret);
        } else {
            $pem = self::base64ToPEMPublicKey($appSecret);
            // After our validation in base64ToPEMPublicKey, we know $pem is non-empty
            /** @var non-empty-string $pem */
            $key = InMemory::plainText($pem);
        }
        return $key;
    }

    /**
     * Formats the leeway integer value into a DateInterval as this is
     * needed by the JWT library
     *
     * @param int $leeway count of seconds added to current timestamp
     * @return DateInterval DateInterval
     */
    protected function getLeewayInterval(int $leeway): DateInterval
    {
        $leewayInterval = "PT{$leeway}S";

        try {
            $interval = new DateInterval($leewayInterval);
        } catch (Exception $e) {
            error_log("Wrong date interval $leewayInterval");
            $interval = new DateInterval('PT0S');
        }

        return $interval;
    }
}