ApiOATHValidate.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Extension\OATHAuth\Api\Module;
 
use MediaWiki\Extension\OATHAuth\Module\TOTP;
use MediaWiki\MediaWikiServices;
use MediaWiki\Extension\OATHAuth\IModule;
use ApiBase;
use User;
use ApiResult;
use FormatJson;
 
class ApiOATHValidate extends ApiBase {
    public function execute() {
        // Be extra paranoid about the data that is sent
        $this->requireAtLeastOneParameter( $this->extractRequestParams(), 'totp', 'data' );
        $this->requirePostedParameters( [ 'token', 'data', 'totp' ] );
 
        $params = $this->extractRequestParams();
        if ( $params['user'] === null ) {
            $params['user'] = $this->getUser()->getName();
        }
 
        $this->checkUserRightsAny( 'oathauth-api-all' );
 
        $user = User::newFromName( $params['user'] );
        if ( $user === false ) {
            $this->dieWithError( 'noname' );
        }
 
        // Don't increase pingLimiter, just check for limit exceeded.
        if ( $user->pingLimiter( 'badoath', 0 ) ) {
            $this->dieWithError( 'apierror-ratelimited' );
        }
 
        $result = [
            ApiResult::META_BC_BOOLS => [ 'enabled', 'valid' ],
            'enabled' => false,
            'valid' => false,
            'module' => ''
        ];
 
        if ( !$user->isAnon() ) {
            $userRepo = MediaWikiServices::getInstance()->getService( 'OATHUserRepository' );
            $authUser = $userRepo->findByUser( $user );
            if ( $authUser ) {
                $module = $authUser->getModule();
                if ( $module instanceof IModule ) {
                    $data = [];
                    if ( isset( $params['totp'] ) ) {
                        // Legacy
                        if ( $module instanceof TOTP ) {
                            $data = [
                                'token' => $params['totp']
                            ];
                        }
                    } else {
                        $decoded = FormatJson::decode( $params['data'], true );
                        if ( is_array( $decoded ) ) {
                            $data = $decoded;
                        }
                    }
                    $result['enabled'] = $module->isEnabled( $authUser );
                    $result['valid'] = $module->verify( $authUser, $data ) !== false;
                    $result['module'] = $module->getName();
                }
            }
        }
 
        $this->getResult()->addValue( null, $this->getModuleName(), $result );
    }
 
    public function getCacheMode( $params ) {
        return 'private';
    }
 
    public function isInternal() {
        return true;
    }
 
    public function needsToken() {
        return 'csrf';
    }
 
    public function getAllowedParams() {
        return [
            'user' => [
                ApiBase::PARAM_TYPE => 'user',
            ],
            'totp' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_DEPRECATED => true
            ],
            'data' => [
                ApiBase::PARAM_TYPE => 'string'
            ]
        ];
    }
 
    protected function getExamplesMessages() {
        return [
            'action=oathvalidate&totp=123456&token=123ABC'
                => 'apihelp-oathvalidate-example-1',
            'action=oathvalidate&user=Example&totp=123456&token=123ABC'
                => 'apihelp-oathvalidate-example-2',
            'action=oathvalidate&user=Example&data={"totp":"123456"}&token=123ABC'
                => 'apihelp-oathvalidate-example-3',
        ];
    }
}