UserPasswordPolicy.php

Go to the documentation of this file.

<?php
class UserPasswordPolicy {

    private $policies;

    private $policyCheckFunctions;

    public function __construct( array $policies, array $checks ) {
        if ( !isset( $policies['default'] ) ) {
            throw new InvalidArgumentException(
                'Must include a \'default\' password policy'
            );
        }
        $this->policies = $policies;

        foreach ( $checks as $statement => $check ) {
            if ( !is_callable( $check ) ) {
                throw new InvalidArgumentException(
                    "Policy check functions must be callable. '$statement' isn't callable."
                );
            }
            $this->policyCheckFunctions[$statement] = $check;
        }
    }

    public function checkUserPassword( User $user, $password, $purpose = 'login' ) {
        $effectivePolicy = $this->getPoliciesForUser( $user, $purpose );
        return $this->checkPolicies(
            $user,
            $password,
            $effectivePolicy,
            $this->policyCheckFunctions
        );
    }

    public function checkUserPasswordForGroups( User $user, $password, array $groups ) {
        $effectivePolicy = self::getPoliciesForGroups(
            $this->policies,
            $groups,
            $this->policies['default']
        );
        return $this->checkPolicies(
            $user,
            $password,
            $effectivePolicy,
            $this->policyCheckFunctions
        );
    }

    private function checkPolicies( User $user, $password, $policies, $policyCheckFunctions ) {
        $status = Status::newGood();
        foreach ( $policies as $policy => $value ) {
            if ( !isset( $policyCheckFunctions[$policy] ) ) {
                throw new DomainException( "Invalid password policy config. No check defined for '$policy'." );
            }
            $status->merge(
                call_user_func(
                    $policyCheckFunctions[$policy],
                    $value,
                    $user,
                    $password
                )
            );
        }
        return $status;
    }

    public function getPoliciesForUser( User $user, $purpose = 'login' ) {
        $effectivePolicy = $this->policies['default'];
        if ( $purpose !== 'create' ) {
            $effectivePolicy = self::getPoliciesForGroups(
                $this->policies,
                $user->getEffectiveGroups(),
                $this->policies['default']
            );
        }

        Hooks::run( 'PasswordPoliciesForUser', [ $user, &$effectivePolicy, $purpose ] );

        return $effectivePolicy;
    }

    public static function getPoliciesForGroups( array $policies, array $userGroups,
        array $defaultPolicy
    ) {
        $effectivePolicy = $defaultPolicy;
        foreach ( $policies as $group => $policy ) {
            if ( in_array( $group, $userGroups ) ) {
                $effectivePolicy = self::maxOfPolicies(
                    $effectivePolicy,
                    $policies[$group]
                );
            }
        }

        return $effectivePolicy;
    }

    public static function maxOfPolicies( array $p1, array $p2 ) {
        $ret = [];
        $keys = array_merge( array_keys( $p1 ), array_keys( $p2 ) );
        foreach ( $keys as $key ) {
            if ( !isset( $p1[$key] ) ) {
                $ret[$key] = $p2[$key];
            } elseif ( !isset( $p2[$key] ) ) {
                $ret[$key] = $p1[$key];
            } else {
                $ret[$key] = max( $p1[$key], $p2[$key] );
            }
        }
        return $ret;
    }

}