Skip to content

Commit c16ad84

Browse files
ericmannericmann
committed
Module 2
The second lesson focuses on system authentication - we need to actually register users with identifiers (email addresses) and passwords. Note that we can't fully validate user emails as we have no outgoing email support, but we should focus on proper password storage and validation at a minimum. Your task is to replace problematic password-based authentication routines with something that leverages real hashing and proper storage/comparison techniques.
1 parent 0c70f3a commit c16ad84

12 files changed

Lines changed: 1041 additions & 1 deletion

File tree

‎composer.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@
2020
},
2121
"autoload": {
2222
"psr-4": {
23-
"Notes\\Module1\\": "module-1/server/"
23+
"Notes\\Module1\\": "module-1/server/",
24+
"Notes\\Module2\\": "module-2/server/"
2425
},
2526
"files": [
2627
"util/Database.php",

‎module-2/client/notes.php‎

Lines changed: 284 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,284 @@
1+
#!/usr/bin/php
2+
<?php
3+
4+
include __DIR__ . '/../../vendor/autoload.php';
5+
6+
use splitbrain\phpcli\CLI;
7+
use splitbrain\phpcli\Colors;
8+
use splitbrain\phpcli\Options;
9+
use splitbrain\phpcli\TableFormatter;
10+
11+
class Module2 extends CLI
12+
{
13+
/**
14+
* @var GuzzleHttp\Client
15+
*/
16+
private $client;
17+
18+
private $user;
19+
20+
private $pass;
21+
22+
const TABLE_WIDTH = ['9', '*'];
23+
const TABLE_STYLE = [Colors::C_CYAN, Colors::C_GREEN];
24+
25+
protected function setup(Options $options)
26+
{
27+
$options->setHelp('This client is built to operate against the server defined in Module 1 only.');
28+
29+
$options->registerCommand('create', 'Create a new note.');
30+
$options->registerCommand('get', 'Get a specific note.');
31+
$options->registerCommand('delete', 'Delete a specific note.');
32+
$options->registerCommand('all', 'Get all notes.');
33+
34+
$options->registerCommand('register', 'Create a user account.');
35+
$options->registerCommand('changePassword', 'Change your user password');
36+
37+
$options->registerArgument('note', 'Actual note to store.', true, 'create');
38+
$options->registerArgument('noteId', 'Identify the note to retrieve.', true, 'get');
39+
$options->registerArgument('noteId', 'Identify the note to delete.', true, 'delete');
40+
41+
$options->registerOption('email', 'Email address', 'e', true, 'register');
42+
$options->registerOption('password', 'Login password', 'p', true, 'register');
43+
$options->registerOption('repeat-password', 'Login password (again)', 'r', true, 'register');
44+
$options->registerOption('greeting', 'User name or greeting', 'g', true, 'register');
45+
$options->registerOption('email', 'Email address', 'e', true, 'changePassword');
46+
$options->registerOption('old-password', 'Old login password', 'o', true, 'changePassword');
47+
$options->registerOption('new-password', 'New login password', 'p', true, 'changePassword');
48+
$options->registerOption('repeat-password', 'New login password (again)', 'r', true, 'changePassword');
49+
50+
foreach (['create', 'get', 'delete', 'all'] as $command) {
51+
$options->registerOption('email', 'Email address', 'e', true, $command);
52+
$options->registerOption('password', 'Login password', 'p', true, $command);
53+
}
54+
55+
$this->client = new GuzzleHttp\Client(['base_uri' => 'http://localhost:8888']);
56+
}
57+
58+
protected function createNote($contents)
59+
{
60+
if (empty($contents)) {
61+
$this->error('Invalid/Empty note. Cannot send to server!');
62+
return;
63+
}
64+
65+
$jsonBody = [
66+
'note' => $contents
67+
];
68+
69+
$response = $this->client->request('POST', 'notes', [
70+
'body' => json_encode($jsonBody),
71+
'auth' => [$this->user, $this->pass]
72+
]);
73+
74+
if ($response->getStatusCode() === 200) {
75+
$return = json_decode($response->getBody(), true);
76+
77+
$this->info(sprintf('Created note ID %s', $return['noteId']));
78+
}
79+
}
80+
81+
private function initTable(): TableFormatter
82+
{
83+
$tf = new TableFormatter($this->colors);
84+
$tf->setBorder(' | ');
85+
86+
echo $tf->format(
87+
self::TABLE_WIDTH,
88+
['Field', 'Value']
89+
);
90+
91+
echo str_pad('', $tf->getMaxWidth(), '-') . "\n";
92+
93+
return $tf;
94+
}
95+
96+
private function printNote(array $note, TableFormatter $tf)
97+
{
98+
echo $tf->format(
99+
self::TABLE_WIDTH,
100+
['Note ID', $note['noteId']],
101+
self::TABLE_STYLE
102+
);
103+
104+
echo $tf->format(
105+
self::TABLE_WIDTH,
106+
['Created', $note['created']],
107+
self::TABLE_STYLE
108+
);
109+
110+
echo $tf->format(
111+
self::TABLE_WIDTH,
112+
['Note', $note['note']],
113+
self::TABLE_STYLE
114+
);
115+
}
116+
117+
protected function getNote($noteId)
118+
{
119+
$response = $this->client->request('GET', sprintf('notes/%s', $noteId), ['auth' => [$this->user, $this->pass]]);
120+
121+
if ($response->getStatusCode() === 200) {
122+
$return = json_decode($response->getBody(), true);
123+
124+
if ( ! empty($return)) {
125+
$tf = $this->initTable();
126+
$this->printNote($return, $tf);
127+
echo str_pad('', $tf->getMaxWidth(), '-') . "\n";
128+
} else {
129+
$this->error(sprintf('Note ID %s does not exist!', $noteId));
130+
}
131+
}
132+
}
133+
134+
protected function deleteNote($noteId)
135+
{
136+
try {
137+
$this->client->request('DELETE', sprintf('notes/%s', $noteId), ['auth' => [$this->user, $this->pass]]);
138+
$this->info(sprintf('Note ID %s has been deleted.', $noteId));
139+
} catch (\GuzzleHttp\Exception\BadResponseException $e) {
140+
$this->error(sprintf('Unable to delete note %s. It might not exist!', $noteId));
141+
}
142+
}
143+
144+
protected function getAllNotes()
145+
{
146+
$response = $this->client->request('GET', 'notes', ['auth' => [$this->user, $this->pass]]);
147+
148+
if ($response->getStatusCode() === 200) {
149+
$notes = json_decode($response->getBody(), true);
150+
151+
if (empty($notes)) {
152+
$this->warning('System contains no notes.');
153+
} else {
154+
$tf = $this->initTable();
155+
foreach ($notes as $note) {
156+
$this->printNote($note, $tf);
157+
echo str_pad('', $tf->getMaxWidth(), '-') . "\n";
158+
}
159+
}
160+
}
161+
}
162+
163+
protected function register(Options $options)
164+
{
165+
$email = $options->getOpt('email');
166+
$password = $options->getOpt('password');
167+
$repeat = $options->getOpt('repeat-password');
168+
$greeting = $options->getOpt('greeting');
169+
170+
$error = false;
171+
if (empty($email)) {
172+
$this->error('Email is required.');
173+
$error = true;
174+
}
175+
if (empty($password)) {
176+
$this->error('Password is required.');
177+
$error = true;
178+
}
179+
if (empty($repeat)) {
180+
$this->error('You must repeat your password.');
181+
$error = true;
182+
}
183+
if ($error) return;
184+
185+
$jsonBody = [
186+
'email' => $email,
187+
'greeting' => $greeting,
188+
'password' => $password,
189+
'repeat_password' => $repeat,
190+
];
191+
192+
try {
193+
$response = $this->client->request('POST', 'account', [
194+
'body' => json_encode($jsonBody)
195+
]);
196+
} catch (\GuzzleHttp\Exception\BadResponseException $e) {
197+
$this->error('Unable to create user account.');
198+
return;
199+
}
200+
201+
if ($response->getStatusCode() === 200) {
202+
$return = json_decode($response->getBody(), true);
203+
204+
$this->info(sprintf('Registered user with ID %s', $return['userId']));
205+
}
206+
}
207+
208+
protected function changePassword(Options $options)
209+
{
210+
$email = $options->getOpt('email');
211+
$oldPassword = $options->getOpt('old-password');
212+
$newPassword = $options->getOpt('new-password');
213+
$repeat = $options->getOpt('repeat-password');
214+
215+
$error = false;
216+
if (empty($email)) {
217+
$this->error('Email is required.');
218+
$error = true;
219+
}
220+
if (empty($oldPassword)) {
221+
$this->error('Old password is required.');
222+
$error = true;
223+
}
224+
if (empty($newPassword)) {
225+
$this->error('New password is required.');
226+
$error = true;
227+
}
228+
if (empty($repeat)) {
229+
$this->error('You must repeat your new password.');
230+
$error = true;
231+
}
232+
if ($error) return;
233+
234+
$jsonBody = [
235+
'email' => $email,
236+
'old_password' => $oldPassword,
237+
'new_password' => $newPassword,
238+
'repeat_password' => $repeat,
239+
];
240+
241+
$response = $this->client->request('PUT', 'account', [
242+
'body' => json_encode($jsonBody)
243+
]);
244+
245+
if ($response->getStatusCode() === 204) {
246+
$this->info('Successfully updated your user password.');
247+
}
248+
}
249+
250+
protected function main(Options $options)
251+
{
252+
$args = $options->getArgs();
253+
$this->user = $options->getOpt('email');
254+
$this->pass = $options->getOpt('password');
255+
256+
switch ($options->getCmd()) {
257+
case 'create':
258+
$this->createNote($args[0]);
259+
break;
260+
case 'get':
261+
$this->getNote($args[0]);
262+
break;
263+
case 'delete':
264+
$this->deleteNote($args[0]);
265+
break;
266+
case 'all':
267+
$this->getAllNotes();
268+
break;
269+
case 'register':
270+
$this->register($options);
271+
break;
272+
case 'changePassword':
273+
$this->changePassword($options);
274+
break;
275+
default:
276+
$this->error('No known command was called, we show the default help instead:');
277+
echo $options->help();
278+
exit;
279+
}
280+
}
281+
}
282+
283+
$cli = new Module2();
284+
$cli->run();

‎module-2/server/AuthMiddleware.php‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace Notes\Module2;
4+
5+
use League\Route\Http\Exception\ForbiddenException;
6+
use Notes\Util\Database;
7+
use Psr\Http\Message\ResponseInterface;
8+
use Psr\Http\Message\ServerRequestInterface;
9+
use Psr\Http\Server\MiddlewareInterface;
10+
use Psr\Http\Server\RequestHandlerInterface;
11+
12+
class AuthMiddleware implements MiddlewareInterface
13+
{
14+
public function process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
15+
{
16+
$authentication = $request->getHeader('authorization')[0];
17+
$base64Auth = trim(substr($authentication, 5));
18+
$decoded = explode(':', base64_decode($base64Auth));
19+
20+
$db = new Database();
21+
try {
22+
$user = $db->getUserByEmail($decoded[0]);
23+
24+
// @TODO Proper hash comparison
25+
if (hash_equals($user->password, $decoded[1])) {
26+
if (session_status() !== PHP_SESSION_ACTIVE) {
27+
session_start();
28+
}
29+
30+
$_SESSION['userId'] = $user->userId;
31+
32+
return $handler->handle($request);
33+
}
34+
} catch (\Exception $e) {}
35+
36+
throw new ForbiddenException();
37+
}
38+
}

0 commit comments

Comments
 (0)