ApiAuthManagerHelper.php

Go to the documentation of this file.

<?php
use MediaWiki\Auth\AuthManager;
use MediaWiki\Auth\AuthenticationRequest;
use MediaWiki\Auth\AuthenticationResponse;
use MediaWiki\Auth\CreateFromLoginAuthenticationRequest;
use MediaWiki\Logger\LoggerFactory;

class ApiAuthManagerHelper {

    private $module;

    private $messageFormat;

    public function __construct( ApiBase $module ) {
        $this->module = $module;

        $params = $module->extractRequestParams();
        $this->messageFormat = isset( $params['messageformat'] ) ? $params['messageformat'] : 'wikitext';
    }

    public static function newForModule( ApiBase $module ) {
        return new self( $module );
    }

    private function formatMessage( array &$res, $key, Message $message ) {
        switch ( $this->messageFormat ) {
            case 'none':
                break;

            case 'wikitext':
                $res[$key] = $message->setContext( $this->module )->text();
                break;

            case 'html':
                $res[$key] = $message->setContext( $this->module )->parseAsBlock();
                $res[$key] = Parser::stripOuterParagraph( $res[$key] );
                break;

            case 'raw':
                $res[$key] = [
                    'key' => $message->getKey(),
                    'params' => $message->getParams(),
                ];
                ApiResult::setIndexedTagName( $res[$key]['params'], 'param' );
                break;
        }
    }

    public function securitySensitiveOperation( $operation ) {
        $status = AuthManager::singleton()->securitySensitiveOperationStatus( $operation );
        switch ( $status ) {
            case AuthManager::SEC_OK:
                return;

            case AuthManager::SEC_REAUTH:
                $this->module->dieUsage(
                    'You have not authenticated recently in this session, please reauthenticate.', 'reauthenticate'
                );

            case AuthManager::SEC_FAIL:
                $this->module->dieUsage(
                    'This action is not available as your identify cannot be verified.', 'cannotreauthenticate'
                );

            default:
                throw new UnexpectedValueException( "Unknown status \"$status\"" );
        }
    }

    public static function blacklistAuthenticationRequests( array $reqs, array $blacklist ) {
        if ( $blacklist ) {
            $blacklist = array_flip( $blacklist );
            $reqs = array_filter( $reqs, function ( $req ) use ( $blacklist ) {
                return !isset( $blacklist[get_class( $req )] );
            } );
        }
        return $reqs;
    }

    public function loadAuthenticationRequests( $action ) {
        $params = $this->module->extractRequestParams();

        $manager = AuthManager::singleton();
        $reqs = $manager->getAuthenticationRequests( $action, $this->module->getUser() );

        // Filter requests, if requested to do so
        $wantedRequests = null;
        if ( isset( $params['requests'] ) ) {
            $wantedRequests = array_flip( $params['requests'] );
        } elseif ( isset( $params['request'] ) ) {
            $wantedRequests = [ $params['request'] => true ];
        }
        if ( $wantedRequests !== null ) {
            $reqs = array_filter( $reqs, function ( $req ) use ( $wantedRequests ) {
                return isset( $wantedRequests[$req->getUniqueId()] );
            } );
        }

        // Collect the fields for all the requests
        $fields = [];
        $sensitive = [];
        foreach ( $reqs as $req ) {
            $info = (array)$req->getFieldInfo();
            $fields += $info;
            $sensitive += array_filter( $info, function ( $opts ) {
                return !empty( $opts['sensitive'] );
            } );
        }

        // Extract the request data for the fields and mark those request
        // parameters as used
        $data = array_intersect_key( $this->module->getRequest()->getValues(), $fields );
        $this->module->getMain()->markParamsUsed( array_keys( $data ) );

        if ( $sensitive ) {
            try {
                $this->module->requirePostedParameters( array_keys( $sensitive ), 'noprefix' );
            } catch ( UsageException $ex ) {
                // Make this a warning for now, upgrade to an error in 1.29.
                $this->module->setWarning( $ex->getMessage() );
                $this->module->logFeatureUsage( $this->module->getModuleName() . '-params-in-query-string' );
            }
        }

        return AuthenticationRequest::loadRequestsFromSubmission( $reqs, $data );
    }

    public function formatAuthenticationResponse( AuthenticationResponse $res ) {
        $ret = [
            'status' => $res->status,
        ];

        if ( $res->status === AuthenticationResponse::PASS && $res->username !== null ) {
            $ret['username'] = $res->username;
        }

        if ( $res->status === AuthenticationResponse::REDIRECT ) {
            $ret['redirecttarget'] = $res->redirectTarget;
            if ( $res->redirectApiData !== null ) {
                $ret['redirectdata'] = $res->redirectApiData;
            }
        }

        if ( $res->status === AuthenticationResponse::REDIRECT ||
            $res->status === AuthenticationResponse::UI ||
            $res->status === AuthenticationResponse::RESTART
        ) {
            $ret += $this->formatRequests( $res->neededRequests );
        }

        if ( $res->status === AuthenticationResponse::FAIL ||
            $res->status === AuthenticationResponse::UI ||
            $res->status === AuthenticationResponse::RESTART
        ) {
            $this->formatMessage( $ret, 'message', $res->message );
        }

        if ( $res->status === AuthenticationResponse::FAIL ||
            $res->status === AuthenticationResponse::RESTART
        ) {
            $this->module->getRequest()->getSession()->set(
                'ApiAuthManagerHelper::createRequest',
                $res->createRequest
            );
            $ret['canpreservestate'] = $res->createRequest !== null;
        } else {
            $this->module->getRequest()->getSession()->remove( 'ApiAuthManagerHelper::createRequest' );
        }

        return $ret;
    }

    public function logAuthenticationResult( $event, $result ) {
        if ( is_string( $result ) ) {
            $status = Status::newFatal( $result );
        } elseif ( $result->status === AuthenticationResponse::PASS ) {
            $status = Status::newGood();
        } elseif ( $result->status === AuthenticationResponse::FAIL ) {
            $status = Status::newFatal( $result->message );
        } else {
            return;
        }

        $module = $this->module->getModuleName();
        LoggerFactory::getInstance( 'authevents' )->info( "$module API attempt", [
            'event' => $event,
            'status' => $status,
            'module' => $module,
        ] );
    }

    public function getPreservedRequest() {
        $ret = $this->module->getRequest()->getSession()->get( 'ApiAuthManagerHelper::createRequest' );
        return $ret instanceof CreateFromLoginAuthenticationRequest ? $ret : null;
    }

    public function formatRequests( array $reqs ) {
        $params = $this->module->extractRequestParams();
        $mergeFields = !empty( $params['mergerequestfields'] );

        $ret = [ 'requests' => [] ];
        foreach ( $reqs as $req ) {
            $describe = $req->describeCredentials();
            $reqInfo = [
                'id' => $req->getUniqueId(),
                'metadata' => $req->getMetadata() + [ ApiResult::META_TYPE => 'assoc' ],
            ];
            switch ( $req->required ) {
                case AuthenticationRequest::OPTIONAL:
                    $reqInfo['required'] = 'optional';
                    break;
                case AuthenticationRequest::REQUIRED:
                    $reqInfo['required'] = 'required';
                    break;
                case AuthenticationRequest::PRIMARY_REQUIRED:
                    $reqInfo['required'] = 'primary-required';
                    break;
            }
            $this->formatMessage( $reqInfo, 'provider', $describe['provider'] );
            $this->formatMessage( $reqInfo, 'account', $describe['account'] );
            if ( !$mergeFields ) {
                $reqInfo['fields'] = $this->formatFields( (array)$req->getFieldInfo() );
            }
            $ret['requests'][] = $reqInfo;
        }

        if ( $mergeFields ) {
            $fields = AuthenticationRequest::mergeFieldInfo( $reqs );
            $ret['fields'] = $this->formatFields( $fields );
        }

        return $ret;
    }

    private function formatFields( array $fields ) {
        static $copy = [
            'type' => true,
            'value' => true,
        ];

        $module = $this->module;
        $retFields = [];

        foreach ( $fields as $name => $field ) {
            $ret = array_intersect_key( $field, $copy );

            if ( isset( $field['options'] ) ) {
                $ret['options'] = array_map( function ( $msg ) use ( $module ) {
                    return $msg->setContext( $module )->plain();
                }, $field['options'] );
                ApiResult::setArrayType( $ret['options'], 'assoc' );
            }
            $this->formatMessage( $ret, 'label', $field['label'] );
            $this->formatMessage( $ret, 'help', $field['help'] );
            $ret['optional'] = !empty( $field['optional'] );
            $ret['sensitive'] = !empty( $field['sensitive'] );

            $retFields[$name] = $ret;
        }

        ApiResult::setArrayType( $retFields, 'assoc' );

        return $retFields;
    }

    public static function getStandardParams( $action, $param /* ... */ ) {
        $params = [
            'requests' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_ISMULTI => true,
                ApiBase::PARAM_HELP_MSG => [ 'api-help-authmanagerhelper-requests', $action ],
            ],
            'request' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_REQUIRED => true,
                ApiBase::PARAM_HELP_MSG => [ 'api-help-authmanagerhelper-request', $action ],
            ],
            'messageformat' => [
                ApiBase::PARAM_DFLT => 'wikitext',
                ApiBase::PARAM_TYPE => [ 'html', 'wikitext', 'raw', 'none' ],
                ApiBase::PARAM_HELP_MSG => 'api-help-authmanagerhelper-messageformat',
            ],
            'mergerequestfields' => [
                ApiBase::PARAM_DFLT => false,
                ApiBase::PARAM_HELP_MSG => 'api-help-authmanagerhelper-mergerequestfields',
            ],
            'preservestate' => [
                ApiBase::PARAM_DFLT => false,
                ApiBase::PARAM_HELP_MSG => 'api-help-authmanagerhelper-preservestate',
            ],
            'returnurl' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_HELP_MSG => 'api-help-authmanagerhelper-returnurl',
            ],
            'continue' => [
                ApiBase::PARAM_DFLT => false,
                ApiBase::PARAM_HELP_MSG => 'api-help-authmanagerhelper-continue',
            ],
        ];

        $ret = [];
        $wantedParams = func_get_args();
        array_shift( $wantedParams );
        foreach ( $wantedParams as $name ) {
            if ( isset( $params[$name] ) ) {
                $ret[$name] = $params[$name];
            }
        }
        return $ret;
    }
}