Skip to content

Always catch OCP versions of authentication exceptions #42640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
come-nc merged 5 commits into from
Jan 11, 2024
Merged

Always catch OCP versions of authentication exceptions #42640

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
eee9f1e
Always catch OCP versions of authentication exceptions
come-nc Jan 4, 2024
95ea618
Suppress or fix psalm errors related to InvalidTokenException
come-nc Jan 8, 2024
8fc39ae
Use IToken from OCP instead of OC
come-nc Jan 8, 2024
37a6e15
Use OCP version of IToken in AppPasswordCreatedEvent
come-nc Jan 11, 2024
a526a38
Import OCP IToken as OCPIToken to avoid a name clash in lib/private
come-nc Jan 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Import OCP IToken as OCPIToken to avoid a name clash in lib/private 
Signed-off-by: Côme Chilliet <[email protected]>
  • Loading branch information
@come-nc
come-nc committed Jan 11, 2024
commit a526a382bf858ed01a5f62d79a760333d8885595
48 changes: 24 additions & 24 deletions lib/private/Authentication/Token/IProvider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
use OCP\Authentication\Exceptions\ExpiredTokenException;
use OCP\Authentication\Exceptions\InvalidTokenException;
use OCP\Authentication\Exceptions\WipeTokenException;
use OCP\Authentication\Token\IToken;
use OCP\Authentication\Token\IToken as OCPIToken;

interface IProvider {
/**
Expand All @@ -46,16 +46,16 @@ interface IProvider {
* @param string $name Name will be trimmed to 120 chars when longer
* @param int $type token type
* @param int $remember whether the session token should be used for remember-me
* @return IToken
* @return OCPIToken
* @throws \RuntimeException when OpenSSL reports a problem
*/
public function generateToken(string $token,
string $uid,
string $loginName,
?string $password,
string $name,
int $type = IToken::TEMPORARY_TOKEN,
int $remember = IToken::DO_NOT_REMEMBER): IToken;
int $type = OCPIToken::TEMPORARY_TOKEN,
int $remember = OCPIToken::DO_NOT_REMEMBER): OCPIToken;

/**
* Get a token by token id
Expand All @@ -64,9 +64,9 @@ public function generateToken(string $token,
* @throws InvalidTokenException
* @throws ExpiredTokenException
* @throws WipeTokenException
* @return IToken
* @return OCPIToken
*/
public function getToken(string $tokenId): IToken;
public function getToken(string $tokenId): OCPIToken;

/**
* Get a token by token id
Expand All @@ -75,9 +75,9 @@ public function getToken(string $tokenId): IToken;
* @throws InvalidTokenException
* @throws ExpiredTokenException
* @throws WipeTokenException
* @return IToken
* @return OCPIToken
*/
public function getTokenById(int $tokenId): IToken;
public function getTokenById(int $tokenId): OCPIToken;

/**
* Duplicate an existing session token
Expand All @@ -86,9 +86,9 @@ public function getTokenById(int $tokenId): IToken;
* @param string $sessionId
* @throws InvalidTokenException
* @throws \RuntimeException when OpenSSL reports a problem
* @return IToken The new token
* @return OCPIToken The new token
*/
public function renewSessionToken(string $oldSessionId, string $sessionId): IToken;
public function renewSessionToken(string $oldSessionId, string $sessionId): OCPIToken;

/**
* Invalidate (delete) the given session token
Expand Down Expand Up @@ -118,16 +118,16 @@ public function invalidateLastUsedBefore(string $uid, int $before): void;
/**
* Save the updated token
*
* @param IToken $token
* @param OCPIToken $token
*/
public function updateToken(IToken $token);
public function updateToken(OCPIToken $token);

/**
* Update token activity timestamp
*
* @param IToken $token
* @param OCPIToken $token
*/
public function updateTokenActivity(IToken $token);
public function updateTokenActivity(OCPIToken $token);

/**
* Get all tokens of a user
Expand All @@ -136,49 +136,49 @@ public function updateTokenActivity(IToken $token);
* where a high number of (session) tokens is generated
*
* @param string $uid
* @return IToken[]
* @return OCPIToken[]
*/
public function getTokenByUser(string $uid): array;

/**
* Get the (unencrypted) password of the given token
*
* @param IToken $savedToken
* @param OCPIToken $savedToken
* @param string $tokenId
* @throws InvalidTokenException
* @throws PasswordlessTokenException
* @return string
*/
public function getPassword(IToken $savedToken, string $tokenId): string;
public function getPassword(OCPIToken $savedToken, string $tokenId): string;

/**
* Encrypt and set the password of the given token
*
* @param IToken $token
* @param OCPIToken $token
* @param string $tokenId
* @param string $password
* @throws InvalidTokenException
*/
public function setPassword(IToken $token, string $tokenId, string $password);
public function setPassword(OCPIToken $token, string $tokenId, string $password);

/**
* Rotate the token. Useful for for example oauth tokens
*
* @param IToken $token
* @param OCPIToken $token
* @param string $oldTokenId
* @param string $newTokenId
* @return IToken
* @return OCPIToken
* @throws \RuntimeException when OpenSSL reports a problem
*/
public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken;
public function rotate(OCPIToken $token, string $oldTokenId, string $newTokenId): OCPIToken;

/**
* Marks a token as having an invalid password.
*
* @param IToken $token
* @param OCPIToken $token
* @param string $tokenId
*/
public function markPasswordInvalid(IToken $token, string $tokenId);
public function markPasswordInvalid(OCPIToken $token, string $tokenId);

/**
* Update all the passwords of $uid if required
Expand Down
48 changes: 24 additions & 24 deletions lib/private/Authentication/Token/Manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
use OCP\Authentication\Exceptions\InvalidTokenException;
use OCP\Authentication\Exceptions\WipeTokenException;
use OCP\Authentication\Token\IProvider as OCPIProvider;
use OCP\Authentication\Token\IToken;
use OCP\Authentication\Token\IToken as OCPIToken;

class Manager implements IProvider, OCPIProvider {
/** @var PublicKeyTokenProvider */
Expand All @@ -54,15 +54,15 @@ public function __construct(PublicKeyTokenProvider $publicKeyTokenProvider) {
* @param string $name Name will be trimmed to 120 chars when longer
* @param int $type token type
* @param int $remember whether the session token should be used for remember-me
* @return IToken
* @return OCPIToken
*/
public function generateToken(string $token,
string $uid,
string $loginName,
$password,
string $name,
int $type = IToken::TEMPORARY_TOKEN,
int $remember = IToken::DO_NOT_REMEMBER): IToken {
int $type = OCPIToken::TEMPORARY_TOKEN,
int $remember = OCPIToken::DO_NOT_REMEMBER): OCPIToken {
if (mb_strlen($name) > 128) {
$name = mb_substr($name, 0, 120) . '…';
}
Expand Down Expand Up @@ -95,10 +95,10 @@ public function generateToken(string $token,
/**
* Save the updated token
*
* @param IToken $token
* @param OCPIToken $token
* @throws InvalidTokenException
*/
public function updateToken(IToken $token) {
public function updateToken(OCPIToken $token) {
$provider = $this->getProvider($token);
$provider->updateToken($token);
}
Expand All @@ -107,16 +107,16 @@ public function updateToken(IToken $token) {
* Update token activity timestamp
*
* @throws InvalidTokenException
* @param IToken $token
* @param OCPIToken $token
*/
public function updateTokenActivity(IToken $token) {
public function updateTokenActivity(OCPIToken $token) {
$provider = $this->getProvider($token);
$provider->updateTokenActivity($token);
}

/**
* @param string $uid
* @return IToken[]
* @return OCPIToken[]
*/
public function getTokenByUser(string $uid): array {
return $this->publicKeyTokenProvider->getTokenByUser($uid);
Expand All @@ -128,9 +128,9 @@ public function getTokenByUser(string $uid): array {
* @param string $tokenId
* @throws InvalidTokenException
* @throws \RuntimeException when OpenSSL reports a problem
* @return IToken
* @return OCPIToken
*/
public function getToken(string $tokenId): IToken {
public function getToken(string $tokenId): OCPIToken {
try {
return $this->publicKeyTokenProvider->getToken($tokenId);
} catch (WipeTokenException $e) {
Expand All @@ -147,9 +147,9 @@ public function getToken(string $tokenId): IToken {
*
* @param int $tokenId
* @throws InvalidTokenException
* @return IToken
* @return OCPIToken
*/
public function getTokenById(int $tokenId): IToken {
public function getTokenById(int $tokenId): OCPIToken {
try {
return $this->publicKeyTokenProvider->getTokenById($tokenId);
} catch (ExpiredTokenException $e) {
Expand All @@ -165,9 +165,9 @@ public function getTokenById(int $tokenId): IToken {
* @param string $oldSessionId
* @param string $sessionId
* @throws InvalidTokenException
* @return IToken
* @return OCPIToken
*/
public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
public function renewSessionToken(string $oldSessionId, string $sessionId): OCPIToken {
try {
return $this->publicKeyTokenProvider->renewSessionToken($oldSessionId, $sessionId);
} catch (ExpiredTokenException $e) {
Expand All @@ -178,18 +178,18 @@ public function renewSessionToken(string $oldSessionId, string $sessionId): ITok
}

/**
* @param IToken $savedToken
* @param OCPIToken $savedToken
* @param string $tokenId session token
* @throws InvalidTokenException
* @throws PasswordlessTokenException
* @return string
*/
public function getPassword(IToken $savedToken, string $tokenId): string {
public function getPassword(OCPIToken $savedToken, string $tokenId): string {
$provider = $this->getProvider($savedToken);
return $provider->getPassword($savedToken, $tokenId);
}

public function setPassword(IToken $token, string $tokenId, string $password) {
public function setPassword(OCPIToken $token, string $tokenId, string $password) {
$provider = $this->getProvider($token);
$provider->setPassword($token, $tokenId, $password);
}
Expand All @@ -211,14 +211,14 @@ public function invalidateLastUsedBefore(string $uid, int $before): void {
}

/**
* @param IToken $token
* @param OCPIToken $token
* @param string $oldTokenId
* @param string $newTokenId
* @return IToken
* @return OCPIToken
* @throws InvalidTokenException
* @throws \RuntimeException when OpenSSL reports a problem
*/
public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
public function rotate(OCPIToken $token, string $oldTokenId, string $newTokenId): OCPIToken {
if ($token instanceof PublicKeyToken) {
return $this->publicKeyTokenProvider->rotate($token, $oldTokenId, $newTokenId);
}
Expand All @@ -228,11 +228,11 @@ public function rotate(IToken $token, string $oldTokenId, string $newTokenId): I
}

/**
* @param IToken $token
* @param OCPIToken $token
* @return IProvider
* @throws InvalidTokenException
*/
private function getProvider(IToken $token): IProvider {
private function getProvider(OCPIToken $token): IProvider {
if ($token instanceof PublicKeyToken) {
return $this->publicKeyTokenProvider;
}
Expand All @@ -241,7 +241,7 @@ private function getProvider(IToken $token): IProvider {
}


public function markPasswordInvalid(IToken $token, string $tokenId) {
public function markPasswordInvalid(OCPIToken $token, string $tokenId) {
$this->getProvider($token)->markPasswordInvalid($token, $tokenId);
}

Expand Down
Loading