BotPasswordStore.php

Go to the documentation of this file.

<?php
namespace MediaWiki\User;
 
use BotPassword;
use CentralIdLookup;
use DBAccessObjectUtils;
use FormatJson;
use IDBAccessObject;
use MediaWiki\Config\ServiceOptions;
use MWCryptRand;
use MWRestrictions;
use Password;
use PasswordFactory;
use StatusValue;
use User;
use Wikimedia\Rdbms\IDatabase;
use Wikimedia\Rdbms\LBFactory;
 
class BotPasswordStore implements IDBAccessObject {
 
    public const CONSTRUCTOR_OPTIONS = [
        'EnableBotPasswords',
        'BotPasswordsCluster',
        'BotPasswordsDatabase',
    ];
 
    private $options;
 
    private $lbFactory;
 
    private $centralIdLookup;
 
    public function __construct(
        ServiceOptions $options,
        CentralIdLookup $centralIdLookup,
        LBFactory $lbFactory
    ) {
        $options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
        $this->options = $options;
        $this->centralIdLookup = $centralIdLookup;
        $this->lbFactory = $lbFactory;
    }
 
    public function getDatabase( int $db ): IDatabase {
        if ( $this->options->get( 'BotPasswordsCluster' ) ) {
            $loadBalancer = $this->lbFactory->getExternalLB(
                $this->options->get( 'BotPasswordsCluster' )
            );
        } else {
            $loadBalancer = $this->lbFactory->getMainLB(
                $this->options->get( 'BotPasswordsDatabase' )
            );
        }
        return $loadBalancer->getConnectionRef(
            $db,
            [],
            $this->options->get( 'BotPasswordsDatabase' )
        );
    }
 
    public function getByUser(
        UserIdentity $userIdentity,
        string $appId,
        int $flags = self::READ_NORMAL
    ): ?BotPassword {
        if ( !$this->options->get( 'EnableBotPasswords' ) ) {
            return null;
        }
 
        $centralId = $this->centralIdLookup->centralIdFromLocalUser(
            $userIdentity,
            CentralIdLookup::AUDIENCE_RAW,
            $flags
        );
        return $centralId ? $this->getByCentralId( $centralId, $appId, $flags ) : null;
    }
 
    public function getByCentralId(
        int $centralId,
        string $appId,
        int $flags = self::READ_NORMAL
    ): ?BotPassword {
        if ( !$this->options->get( 'EnableBotPasswords' ) ) {
            return null;
        }
 
        list( $index, $options ) = DBAccessObjectUtils::getDBOptions( $flags );
        $db = $this->getDatabase( $index );
        $row = $db->selectRow(
            'bot_passwords',
            [ 'bp_user', 'bp_app_id', 'bp_token', 'bp_restrictions', 'bp_grants' ],
            [ 'bp_user' => $centralId, 'bp_app_id' => $appId ],
            __METHOD__,
            $options
        );
        return $row ? new BotPassword( $row, true, $flags ) : null;
    }
 
    public function newUnsavedBotPassword(
        array $data,
        int $flags = self::READ_NORMAL
    ): ?BotPassword {
        if ( isset( $data['user'] ) && ( !$data['user'] instanceof UserIdentity ) ) {
            return null;
        }
 
        $row = (object)[
            'bp_user' => 0,
            'bp_app_id' => isset( $data['appId'] ) ? trim( $data['appId'] ) : '',
            'bp_token' => '**unsaved**',
            'bp_restrictions' => $data['restrictions'] ?? MWRestrictions::newDefault(),
            'bp_grants' => $data['grants'] ?? [],
        ];
 
        if (
            $row->bp_app_id === '' ||
            strlen( $row->bp_app_id ) > BotPassword::APPID_MAXLENGTH ||
            !$row->bp_restrictions instanceof MWRestrictions ||
            !is_array( $row->bp_grants )
        ) {
            return null;
        }
 
        $row->bp_restrictions = $row->bp_restrictions->toJson();
        $row->bp_grants = FormatJson::encode( $row->bp_grants );
 
        if ( isset( $data['user'] ) ) {
            // Must be a UserIdentity object, already checked above
            $row->bp_user = $this->centralIdLookup->centralIdFromLocalUser(
                $data['user'],
                CentralIdLookup::AUDIENCE_RAW,
                $flags
            );
        } elseif ( isset( $data['username'] ) ) {
            $row->bp_user = $this->centralIdLookup->centralIdFromName(
                $data['username'],
                CentralIdLookup::AUDIENCE_RAW,
                $flags
            );
        } elseif ( isset( $data['centralId'] ) ) {
            $row->bp_user = $data['centralId'];
        }
        if ( !$row->bp_user ) {
            return null;
        }
 
        return new BotPassword( $row, false, $flags );
    }
 
    public function insertBotPassword(
        BotPassword $botPassword,
        Password $password = null
    ): StatusValue {
        $res = $this->validateBotPassword( $botPassword );
        if ( !$res->isGood() ) {
            return $res;
        }
 
        if ( $password === null ) {
            $password = PasswordFactory::newInvalidPassword();
        }
        $fields = [
            'bp_user' => $botPassword->getUserCentralId(),
            'bp_app_id' => $botPassword->getAppId(),
            'bp_token' => MWCryptRand::generateHex( User::TOKEN_LENGTH ),
            'bp_restrictions' => $botPassword->getRestrictions()->toJson(),
            'bp_grants' => FormatJson::encode( $botPassword->getGrants() ),
            'bp_password' => $password->toString(),
        ];
 
        $dbw = $this->getDatabase( DB_PRIMARY );
        $dbw->insert(
            'bot_passwords',
            $fields,
            __METHOD__,
            [ 'IGNORE' ]
        );
 
        $ok = (bool)$dbw->affectedRows();
        if ( $ok ) {
            $token = $dbw->selectField(
                'bot_passwords',
                'bp_token',
                [
                    'bp_user' => $botPassword->getUserCentralId(),
                    'bp_app_id' => $botPassword->getAppId(),
                ],
                __METHOD__
            );
            return StatusValue::newGood( $token );
        }
        return StatusValue::newFatal( 'botpasswords-insert-failed', $botPassword->getAppId() );
    }
 
    public function updateBotPassword(
        BotPassword $botPassword,
        Password $password = null
    ): StatusValue {
        $res = $this->validateBotPassword( $botPassword );
        if ( !$res->isGood() ) {
            return $res;
        }
 
        $conds = [
            'bp_user' => $botPassword->getUserCentralId(),
            'bp_app_id' => $botPassword->getAppId(),
        ];
        $fields = [
            'bp_token' => MWCryptRand::generateHex( User::TOKEN_LENGTH ),
            'bp_restrictions' => $botPassword->getRestrictions()->toJson(),
            'bp_grants' => FormatJson::encode( $botPassword->getGrants() ),
        ];
        if ( $password !== null ) {
            $fields['bp_password'] = $password->toString();
        }
 
        $dbw = $this->getDatabase( DB_PRIMARY );
        $dbw->update(
            'bot_passwords',
            $fields,
            $conds,
            __METHOD__
        );
 
        $ok = (bool)$dbw->affectedRows();
        if ( $ok ) {
            $token = $dbw->selectField(
                'bot_passwords',
                'bp_token',
                $conds,
                __METHOD__
            );
            return StatusValue::newGood( $token );
        }
        return StatusValue::newFatal( 'botpasswords-update-failed', $botPassword->getAppId() );
    }
 
    private function validateBotPassword( BotPassword $botPassword ): StatusValue {
        $res = StatusValue::newGood();
 
        $restrictions = $botPassword->getRestrictions()->toJson();
        if ( strlen( $restrictions ) > BotPassword::RESTRICTIONS_MAXLENGTH ) {
            $res->fatal( 'botpasswords-toolong-restrictions' );
        }
 
        $grants = FormatJson::encode( $botPassword->getGrants() );
        if ( strlen( $grants ) > BotPassword::GRANTS_MAXLENGTH ) {
            $res->fatal( 'botpasswords-toolong-grants' );
        }
 
        return $res;
    }
 
    public function deleteBotPassword( BotPassword $botPassword ): bool {
        $dbw = $this->getDatabase( DB_PRIMARY );
        $dbw->delete(
            'bot_passwords',
            [
                'bp_user' => $botPassword->getUserCentralId(),
                'bp_app_id' => $botPassword->getAppId(),
            ],
            __METHOD__
        );
 
        return (bool)$dbw->affectedRows();
    }
 
    public function invalidateUserPasswords( string $username ): bool {
        if ( !$this->options->get( 'EnableBotPasswords' ) ) {
            return false;
        }
 
        $centralId = $this->centralIdLookup->centralIdFromName(
            $username,
            CentralIdLookup::AUDIENCE_RAW,
            CentralIdLookup::READ_LATEST
        );
        if ( !$centralId ) {
            return false;
        }
 
        $dbw = $this->getDatabase( DB_PRIMARY );
        $dbw->update(
            'bot_passwords',
            [ 'bp_password' => PasswordFactory::newInvalidPassword()->toString() ],
            [ 'bp_user' => $centralId ],
            __METHOD__
        );
        return (bool)$dbw->affectedRows();
    }
 
    public function removeUserPasswords( string $username ): bool {
        if ( !$this->options->get( 'EnableBotPasswords' ) ) {
            return false;
        }
 
        $centralId = $this->centralIdLookup->centralIdFromName(
            $username,
            CentralIdLookup::AUDIENCE_RAW,
            CentralIdLookup::READ_LATEST
        );
        if ( !$centralId ) {
            return false;
        }
 
        $dbw = $this->getDatabase( DB_PRIMARY );
        $dbw->delete(
            'bot_passwords',
            [ 'bp_user' => $centralId ],
            __METHOD__
        );
        return (bool)$dbw->affectedRows();
    }
 
}