Add mfa verified check to workflow engine. solved #26

apps/workflowengine/composer/composer/autoload_classmap.php

@@ -17,6 +17,7 @@
     'OCA\\WorkflowEngine\\Check\\RequestRemoteAddress' => $baseDir . '/../lib/Check/RequestRemoteAddress.php',
     'OCA\\WorkflowEngine\\Check\\RequestTime' => $baseDir . '/../lib/Check/RequestTime.php',
     'OCA\\WorkflowEngine\\Check\\RequestURL' => $baseDir . '/../lib/Check/RequestURL.php',
+    'OCA\\WorkflowEngine\\Check\\MfaVerified' => $baseDir . '/../lib/Check/MfaVerified.php',
     'OCA\\WorkflowEngine\\Check\\RequestUserAgent' => $baseDir . '/../lib/Check/RequestUserAgent.php',
     'OCA\\WorkflowEngine\\Check\\TFileCheck' => $baseDir . '/../lib/Check/TFileCheck.php',
     'OCA\\WorkflowEngine\\Check\\UserGroupMembership' => $baseDir . '/../lib/Check/UserGroupMembership.php',

apps/workflowengine/composer/composer/autoload_static.php

@@ -32,6 +32,7 @@ class ComposerStaticInitWorkflowEngine
         'OCA\\WorkflowEngine\\Check\\RequestRemoteAddress' => __DIR__ . '/..' . '/../lib/Check/RequestRemoteAddress.php',
         'OCA\\WorkflowEngine\\Check\\RequestTime' => __DIR__ . '/..' . '/../lib/Check/RequestTime.php',
         'OCA\\WorkflowEngine\\Check\\RequestURL' => __DIR__ . '/..' . '/../lib/Check/RequestURL.php',
+        'OCA\\WorkflowEngine\\Check\\MfaVerified' => __DIR__ . '/..' . '/../lib/Check/MfaVerified.php',
         'OCA\\WorkflowEngine\\Check\\RequestUserAgent' => __DIR__ . '/..' . '/../lib/Check/RequestUserAgent.php',
         'OCA\\WorkflowEngine\\Check\\TFileCheck' => __DIR__ . '/..' . '/../lib/Check/TFileCheck.php',
         'OCA\\WorkflowEngine\\Check\\UserGroupMembership' => __DIR__ . '/..' . '/../lib/Check/UserGroupMembership.php',

apps/workflowengine/lib/Check/MfaVerified.php

@@ -0,0 +1,101 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Joas Schilling <[email protected]>
+ *
+ * @author Arthur Schiwon <[email protected]>
+ * @author Christoph Wurst <[email protected]>
+ * @author Joas Schilling <[email protected]>
+ * @author Julius Härtl <[email protected]>
+ * @author Richard Steinmetz <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\WorkflowEngine\Check;
+
+use OCA\WorkflowEngine\Entity\File;
+use OCP\Files\Cache\ICache;
+use OCP\IL10N;
+use OCP\WorkflowEngine\ICheck;
+use OCP\WorkflowEngine\IFileCheck;
+use OC\Files\Storage\Wrapper\Wrapper;
+use OCP\ISession;
+
+/** @psalm-suppress PropertyNotSetInConstructor */
+class MfaVerified implements ICheck, IFileCheck {
+	use TFileCheck;
+
+	/** @var IL10N */
+	protected $l;
+
+	/** @var ISession */
+	protected $session;
+
+	/**
+	 * @param IL10N $l
+	 * @param ISession $session
+	 */
+	public function __construct(IL10N $l, ISession $session) {
+		$this->l = $l;
+		$this->session = $session;
+	}
+
+	/**
+	 * @param string $operator
+	 * @param string $value
+	 * @return bool
+	 */
+	public function executeCheck($operator, $value): bool {
+		$mfaVerified = $this->session->get('user_saml.samlUserData')["mfa_verified"][0];
+		if (strtolower($value) == 'true') {
+			return $mfaVerified == '1'; // checking whether the current user is MFA-verified
+		} else {
+			return $mfaVerified != '1'; // checking whether the current user is not MFA-verified
+		}
+	}
+
+	/**
+	 * @param string $operator
+	 * @param string $value
+	 * @throws \UnexpectedValueException
+	 */
+	public function validateCheck($operator, $value): void {
+		if (!in_array($operator, ['is'])) {
+			throw new \UnexpectedValueException($this->l->t('The given operator is invalid'), 1);
+		}
+
+		if (!in_array($value, ['true', 'false'])) {
+			throw new \UnexpectedValueException($this->l->t('The given value is invalid, must be one of ("true", "false")'), 1);
+		}
+	}
+
+	/**
+	 * @param string $path
+	 * @return string
+	 */
+	protected function dirname(string $path): string {
+		$dir = dirname($path);
+		return $dir === '.' ? '' : $dir;
+	}
+
+	public function supportedEntities(): array {
+		return [ File::class ];
+	}
+
+	public function isAvailableForScope(int $scope): bool {
+		return true;
+	}
+}

apps/workflowengine/lib/Manager.php

@@ -36,6 +36,7 @@
 use OCA\WorkflowEngine\Check\FileName;
 use OCA\WorkflowEngine\Check\FileSize;
 use OCA\WorkflowEngine\Check\FileSystemTags;
+use OCA\WorkflowEngine\Check\MfaVerified;
 use OCA\WorkflowEngine\Check\RequestRemoteAddress;
 use OCA\WorkflowEngine\Check\RequestTime;
 use OCA\WorkflowEngine\Check\RequestURL;
@@ -723,6 +724,7 @@ protected function getBuildInChecks(): array {
 				$this->container->query(FileName::class),
 				$this->container->query(FileSize::class),
 				$this->container->query(FileSystemTags::class),
+				$this->container->query(MfaVerified::class),
 				$this->container->query(RequestRemoteAddress::class),
 				$this->container->query(RequestTime::class),
 				$this->container->query(RequestURL::class),

apps/workflowengine/src/components/Checks/file.js

@@ -100,6 +100,17 @@ const FileChecks = [
 		],
 		component: FileSystemTag,
 	},
+
+	{
+		class: 'OCA\\WorkflowEngine\\Check\\MfaVerified',
+		name: t('workflowengine', 'MFA Verified'),
+		operators: [
+			{ operator: 'is', name: t('workflowengine', 'is verified?') },
+		],
+		placeholder: (check) => {
+			return 'true'
+		},
+	},
 ]
 
 export default FileChecks