410 lines
12 KiB
PHP
410 lines
12 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of EC-CUBE
|
|
*
|
|
* Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
|
|
*
|
|
* http://www.ec-cube.co.jp/
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Plugin\Passkeys\Service;
|
|
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use Eccube\Common\EccubeConfig;
|
|
use Eccube\Entity\BaseInfo;
|
|
use Eccube\Entity\Customer;
|
|
use Eccube\Repository\BaseInfoRepository;
|
|
use Plugin\Passkeys\Entity\PasskeysCustomerCookie;
|
|
use Plugin\Passkeys\Repository\PasskeysAuthConfigRepository;
|
|
use Plugin\Passkeys\Repository\PasskeysAuthCustomerCookieRepository;
|
|
use Psr\Container\ContainerInterface;
|
|
use Symfony\Component\HttpFoundation\Cookie;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\RequestStack;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface;
|
|
use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
|
|
use Twilio\Exceptions\ConfigurationException;
|
|
use Twilio\Rest\Client;
|
|
|
|
class CustomerPasskeysAuthService
|
|
{
|
|
/**
|
|
* @var string コールバックURL
|
|
*/
|
|
public const SESSION_CALL_BACK_URL = 'plugin_eccube_customer_passkeys_call_back_url';
|
|
|
|
/**
|
|
* @var ContainerInterface
|
|
*/
|
|
protected $container;
|
|
/**
|
|
* @var EccubeConfig
|
|
*/
|
|
protected $eccubeConfig;
|
|
/**
|
|
* @var EncoderFactoryInterface
|
|
*/
|
|
protected $encoderFactory;
|
|
/**
|
|
* @var RequestStack
|
|
*/
|
|
protected $requestStack;
|
|
/**
|
|
* @var Request
|
|
*/
|
|
protected $request;
|
|
/**
|
|
* @var string
|
|
*/
|
|
protected $cookieName;
|
|
/**
|
|
* @var string
|
|
*/
|
|
protected $routeCookieName;
|
|
/**
|
|
* @var int
|
|
*/
|
|
protected $expire;
|
|
/**
|
|
* @var int
|
|
*/
|
|
protected $route_expire;
|
|
/**
|
|
* @var EntityManagerInterface
|
|
*/
|
|
private $entityManager;
|
|
/**
|
|
* @var BaseInfo|object|null
|
|
*/
|
|
private $baseInfo;
|
|
|
|
/**
|
|
* @var PasskeysAuthConfig
|
|
*/
|
|
private $PasskeysAuthConfig;
|
|
|
|
/**
|
|
* @var array
|
|
*/
|
|
private $default_tfa_routes = [
|
|
'login',
|
|
'mypage_login',
|
|
'mypage',
|
|
'mypage_order',
|
|
'mypage_favorite',
|
|
'mypage_change',
|
|
'mypage_delivery',
|
|
'mypage_withdraw',
|
|
'shopping',
|
|
'shopping_login',
|
|
];
|
|
|
|
/**
|
|
* @var PasskeysAuthCustomerCookieRepository
|
|
*/
|
|
private PasskeysAuthCustomerCookieRepository $passkeysCustomerCookieRepository;
|
|
|
|
/**
|
|
* @var PasswordHasherFactoryInterface
|
|
*/
|
|
private PasswordHasherFactoryInterface $hashFactory;
|
|
|
|
/**
|
|
* constructor.
|
|
*
|
|
* @param EntityManagerInterface $entityManager
|
|
* @param EccubeConfig $eccubeConfig
|
|
* @param BaseInfoRepository $baseInfoRepository
|
|
* @param PasskeysAuthConfigRepository $PasskeysAuthConfigRepository
|
|
* @param PasskeysAuthCustomerCookieRepository $passkeysCustomerCookieRepository
|
|
* @param PasswordHasherFactoryInterface $hashFactory
|
|
*/
|
|
public function __construct(
|
|
EntityManagerInterface $entityManager,
|
|
EccubeConfig $eccubeConfig,
|
|
BaseInfoRepository $baseInfoRepository,
|
|
RequestStack $requestStack,
|
|
PasskeysAuthConfigRepository $PasskeysAuthConfigRepository,
|
|
PasskeysAuthCustomerCookieRepository $passkeysCustomerCookieRepository,
|
|
PasswordHasherFactoryInterface $hashFactory
|
|
) {
|
|
$this->entityManager = $entityManager;
|
|
$this->eccubeConfig = $eccubeConfig;
|
|
|
|
$this->baseInfo = $baseInfoRepository->find(1);
|
|
$this->request = $requestStack->getCurrentRequest();
|
|
$this->cookieName = $this->eccubeConfig->get('plugin_eccube_passkeys_customer_cookie_name');
|
|
$this->routeCookieName = $this->eccubeConfig->get('plugin_eccube_passkeys_route_customer_cookie_name');
|
|
|
|
$this->expire = (int) $this->eccubeConfig->get('plugin_eccube_passkeys_customer_expire');
|
|
$this->route_expire = (int) $this->eccubeConfig->get('plugin_eccube_passkeys_route_customer_expire');
|
|
|
|
$this->PasskeysAuthConfig = $PasskeysAuthConfigRepository->findOne();
|
|
$this->passkeysCustomerCookieRepository = $passkeysCustomerCookieRepository;
|
|
$this->hashFactory = $hashFactory;
|
|
}
|
|
|
|
/**
|
|
* @return array
|
|
*/
|
|
public function getDefaultAuthRoutes()
|
|
{
|
|
return $this->default_tfa_routes;
|
|
}
|
|
|
|
/**
|
|
* @required
|
|
*/
|
|
public function setContainer(ContainerInterface $container): ?ContainerInterface
|
|
{
|
|
$previous = $this->container;
|
|
$this->container = $container;
|
|
|
|
return $previous;
|
|
}
|
|
|
|
/**
|
|
* 2段階認証用Cookie生成.
|
|
*
|
|
* @param Customer $Customer
|
|
* @param null $route
|
|
*
|
|
* @return Cookie
|
|
*/
|
|
public function createAuthedCookie($Customer, $route = null): Cookie
|
|
{
|
|
$expire = $this->expire;
|
|
$cookieName = $this->cookieName;
|
|
if ($route != null) {
|
|
$includeRouts = $this->getIncludeRoutes();
|
|
if (in_array($route, $includeRouts) && $this->isAuthed($Customer, 'mypage')) {
|
|
$cookieName = $this->routeCookieName.'_'.$route;
|
|
$expire = $this->route_expire;
|
|
}
|
|
}
|
|
|
|
return $this->createRouteAuthCookie($Customer, $cookieName, $expire);
|
|
}
|
|
|
|
/**
|
|
* 要認証ルートを取得.
|
|
*
|
|
* @return array
|
|
*/
|
|
public function getIncludeRoutes(): array
|
|
{
|
|
$routes = [];
|
|
$include = $this->PasskeysAuthConfig->getIncludeRoutes();
|
|
if ($include) {
|
|
$routes = preg_split('/\R/', $include);
|
|
}
|
|
|
|
return $routes;
|
|
}
|
|
|
|
/**
|
|
* 認証済みか？
|
|
*
|
|
* @param Customer $Customer
|
|
* @param null $route
|
|
*
|
|
* @return boolean
|
|
*/
|
|
public function isAuthed(Customer $Customer, $route = null): bool
|
|
{
|
|
$expire = $this->expire;
|
|
if ($route != null) {
|
|
$includeRouts = $this->getIncludeRoutes();
|
|
if (in_array($route, $includeRouts) && $this->isAuthed($Customer, 'mypage')) {
|
|
// 重要操作ルーティングの場合、
|
|
$cookieName = $this->routeCookieName.'_'.$route;
|
|
$expire = $this->route_expire;
|
|
} else {
|
|
// デフォルトルーティングの場合、
|
|
$cookieName = $this->cookieName;
|
|
}
|
|
|
|
return $this->isRouteAuthed($Customer, $cookieName, $expire);
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* デフォルトルート・重要操作ルーティングは認証済みか
|
|
* データベースの中に保存しているデータとクッキー値を比較する
|
|
*
|
|
* @param Customer $Customer
|
|
* @param string $cookieName
|
|
* @param int $expire
|
|
*
|
|
* @return bool
|
|
*/
|
|
public function isRouteAuthed(Customer $Customer, string $cookieName, int $expire): bool
|
|
{
|
|
if ($json = $this->request->cookies->get($cookieName)) {
|
|
$configs = json_decode($json);
|
|
|
|
/** @var PasskeysCustomerCookie[]|null $activeCookies */
|
|
$activeCookies = $this
|
|
->passkeysCustomerCookieRepository
|
|
->searchForCookie($Customer, $cookieName);
|
|
|
|
foreach ($activeCookies as $activeCookie) {
|
|
if (
|
|
$configs
|
|
&& isset($configs->{$Customer->getId()})
|
|
&& ($config = $configs->{$Customer->getId()})
|
|
&& property_exists($config, 'key')
|
|
&& $config->key === $activeCookie->getCookieValue()
|
|
&& (
|
|
$this->expire == 0
|
|
|| (property_exists($config, 'date') && ($config->date && $config->date > date('U', strtotime('-'.$expire))))
|
|
)
|
|
) {
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* ２段階認証用Cookie生成.
|
|
* クッキーデータをデータベースに保存する
|
|
*
|
|
* @param Customer $Customer
|
|
* @param string $cookieName
|
|
* @param int $expire
|
|
*
|
|
* @return mixed
|
|
*/
|
|
public function createRouteAuthCookie(Customer $Customer, string $cookieName, int $expire)
|
|
{
|
|
return $this->entityManager->wrapInTransaction(function (EntityManagerInterface $em) use ($expire, $cookieName, $Customer) {
|
|
$cookieData = $this->passkeysCustomerCookieRepository->generateCookieData(
|
|
$Customer,
|
|
$cookieName,
|
|
$expire,
|
|
$this->eccubeConfig->get('plugin_eccube_passkeys_route_cookie_value_character_length')
|
|
);
|
|
|
|
$configs = json_decode('{}');
|
|
if ($json = $this->request->cookies->get($cookieName)) {
|
|
$configs = json_decode($json);
|
|
}
|
|
|
|
$configs->{$Customer->getId()} = [
|
|
'key' => $cookieData->getCookieValue(),
|
|
'date' => time(),
|
|
];
|
|
|
|
$em->persist($cookieData);
|
|
$em->flush();
|
|
|
|
return new Cookie(
|
|
$cookieData->getCookieName(), // name
|
|
json_encode($configs), // value
|
|
$cookieData->getCookieExpireDate()->getTimestamp(), // expire
|
|
$this->request->getBasePath(), // path
|
|
null, // domain
|
|
$this->eccubeConfig->get('eccube_force_ssl') ? true : false, // secure
|
|
true, // httpOnly
|
|
false, // raw
|
|
$this->eccubeConfig->get('eccube_force_ssl') ? Cookie::SAMESITE_NONE : null // sameSite
|
|
);
|
|
});
|
|
}
|
|
|
|
/**
|
|
* 二段階認証設定が有効か?
|
|
*
|
|
* @return bool
|
|
*/
|
|
public function isEnabled(): bool
|
|
{
|
|
return $this->baseInfo->isPasskeysUse();
|
|
}
|
|
|
|
/**
|
|
* Passkey認証に関係しているクッキーだけを消す
|
|
*
|
|
* @param Request $request
|
|
* @param Response $response
|
|
*
|
|
* @return void
|
|
*/
|
|
public function clearPKAuthCookies(Request $request, Response $response)
|
|
{
|
|
foreach ($request->cookies->all() as $key => $cookie) {
|
|
if (
|
|
$this->str_contains($key, $this->cookieName) ||
|
|
$this->str_contains($key, $this->routeCookieName)
|
|
) {
|
|
// クッキーを消す
|
|
$response->headers->clearCookie($key);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Passkey sessionをチェックする
|
|
*
|
|
* @param String $session_id
|
|
*
|
|
* @return bool
|
|
*/
|
|
public function checkSession($session_id, $rp)
|
|
{
|
|
//Post request to server using curl
|
|
$ch = curl_init();
|
|
|
|
curl_setopt($ch, CURLOPT_URL, 'https://fido2.amipro.me/usr/validsession');//'https://mac-air-m2.dqj-home.com/usr/validsession');
|
|
curl_setopt($ch, CURLOPT_POST, 1);
|
|
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
|
|
//$json_body = '{"session": "'.$session_id.'", "rp": {"id": "'.$rp.'"}}';
|
|
|
|
$data = array(
|
|
'session'=>$session_id,
|
|
'rp'=> array(
|
|
'id'=>$rp
|
|
),
|
|
'debug_src'=>'checkSession'
|
|
);
|
|
$json_body = json_encode($data);
|
|
log_info('pk: checkSession json: ' . $json_body);
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS, $json_body);//json_encode(['session' => $session_id, 'rp' => ['id' => $rp] ]));
|
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
|
|
|
log_info('pk: checkSession req: ' . $session_id . '|' . $rp);
|
|
|
|
$response = curl_exec($ch);
|
|
$status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
|
|
|
curl_close($ch);
|
|
|
|
log_info('pk: checkSession resp: ' . $status_code . '|' . $response);
|
|
$resp = json_decode($response, true);
|
|
return $resp && $resp['status'] && $resp['status'] === 'ok';
|
|
}
|
|
|
|
|
|
/***
|
|
* @param string $haystack
|
|
* @param string $needle
|
|
* @return bool
|
|
*
|
|
* @deprecated ECCUBEの最低PHPバージョンは8.0になったら, この関数を消してphp8.0からのstr_containsを利用する
|
|
*/
|
|
private function str_contains(string $haystack, string $needle)
|
|
{
|
|
return $needle !== '' && mb_strpos($haystack, $needle) !== false;
|
|
}
|
|
}
|