strict typing, textual space changes

[fsfdrupalauth.git] / lib / Auth / Source / FSFDrupalAuth.php

<?php

declare(strict_types=1);

namespace SimpleSAML\Module\fsfdrupalauth\Auth\Source;

use Exception;
use PDO;
use PDOException;
use SimpleSAML\Assert\Assert;
use SimpleSAML\Error;
use SimpleSAML\Logger;

/**
 * Extension of simple SQL authentication source
 *
 * @package SimpleSAMLphp
 */

class FSFDrupalAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
{
    /**
     * The DSN we should connect to.
     */
    private string $dsn;

    /**
     * The username we should connect to the database with.
     */
    private string $username;

    /**
     * The password we should connect to the database with.
     */
    private string $password;

    /**
     * The options that we should connect to the database with.
     */
    private string $options;

    /**
     * The query we should use to retrieve the attributes for the user.
     *
     * The username and password will be available as :username and :password.
     */
    private string $query_main;
    private string $query_membership;
    private string $query_staff;

    private string $query_nomination_process_donations;
    private string $query_nomination_process_gift_receipt;
    private string $query_nomination_process_adhoc;

    private string $query_discussion_process_old_membership;
    private string $query_discussion_process_donations;
    private string $query_discussion_process_adhoc;

    /**
     * SQL query parameters, or variables that help determine which attributes
     * someone has
     */
    private string $fsf_org_id;
    private string $gift_redeem_page_id;

    private string $nomination_process_active;
    private string $nomination_process_contrib_start_date;
    private string $nomination_process_contrib_end_date;
    private string $nomination_process_adhoc_access_group_id;
    private string $membership_monthly_rate;
    private string $student_membership_monthly_rate;

    private string $discussion_process_active;
    private string $discussion_process_contrib_start_date;
    private string $discussion_process_contrib_end_date;
    private string $discussion_process_adhoc_access_group_id;
    private string $discussion_process_adhoc_no_access_group_id;
    private string $discussion_process_donation_amount;

    private string $discussion_moderator_access_group_id;

    /**
     * Constructor for this authentication source.
     *
     * @param array $info  Information about this authentication source.
     * @param array $config  Configuration.
     */
    public function __construct(array $info, array $config)
    {
        // Call the parent constructor first, as required by the interface
        parent::__construct($info, $config);

        // Make sure that all required parameters are present.
	foreach (['dsn',
		'username',
		'password',

		'query_main',
		'query_membership',
		'query_staff',

		'query_nomination_process_donations',
		'query_nomination_process_gift_receipt',
		'query_nomination_process_adhoc',

		'fsf_org_id',
		'gift_redeem_page_id',

		'nomination_process_active',
		'nomination_process_contrib_start_date',
		'nomination_process_contrib_end_date',
		'nomination_process_adhoc_access_group_id',
		'membership_monthly_rate',
		'student_membership_monthly_rate',

		'query_discussion_process_old_membership',
		'query_discussion_process_donations',
		'query_discussion_process_adhoc',

		'discussion_process_active',
		'discussion_process_contrib_start_date',
		'discussion_process_contrib_end_date',
		'discussion_process_adhoc_access_group_id',
		'discussion_process_adhoc_no_access_group_id',
		'discussion_process_donation_amount',

		'discussion_moderator_access_group_id',]
		as $param) {

            if (!array_key_exists($param, $config)) {
                throw new Exception('Missing required attribute \'' . $param .
                    '\' for authentication source ' . $this->authId);
            }

            if (!is_string($config[$param])) {
                throw new Exception('Expected parameter \'' . $param .
                    '\' for authentication source ' . $this->authId .
                    ' to be a string. Instead it was: ' .
                    var_export($config[$param], true));
            }

            $this->$param = $config[$param];
        }

        if (isset($config['options'])) {
            $this->options = $config['options'];
        }
    }


    /**
     * Create a database connection.
     *
     * @return PDO  The database connection.
     */
    private function connect(): PDO
    {
        try {
            $db = new PDO($this->dsn, $this->username, $this->password, $this->options);
        } catch (PDOException $e) {
            // Obfuscate the password if it's part of the dsn
            $obfuscated_dsn =  preg_replace('/(user|password)=(.*?([;]|$))/', '${1}=***', $this->dsn);

            throw new Exception('fsfdrupalauth:' . $this->authId . ': - Failed to connect to \'' .
                $obfuscated_dsn . '\': ' . $e->getMessage());
        }

        $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        $driver = explode(':', $this->dsn, 2);
        $driver = strtolower($driver[0]);

        // Driver specific initialization
        switch ($driver) {
            case 'mysql':
                // Use UTF-8
                $db->exec("SET NAMES 'utf8mb4'");
                break;
            case 'pgsql':
                // Use UTF-8
                $db->exec("SET NAMES 'UTF8'");
                break;
        }

        return $db;
    }

    /*
     * Check the password against a Drupal hash
     *
     */
    private function check_password(string $password, string $hash): boolean {

        //
        // The reason for running a separate process is so that the PHP global
        // env doesn't get clobbered by include / require.
        //

        // pipes code based off of https://www.php.net/manual/en/function.proc-open.php
        // CC-BY 3.0 or later
        $descriptorspec = array(
           0 => array("pipe", "r"),  // stdin is a pipe that the child may read from
           1 => array("pipe", "w"),  // stdout is a pipe that the child may write to
           2 => array("pipe", "w")   // stderr is a pipe that the child may write to
        );

        $cwd = "../modules/fsfdrupalauth/extlib";
        //$env = array('some_option' => 'aeiou');
        $env = array();

        $process = proc_open('php drupal-pw-check.php', $descriptorspec, $pipes, $cwd, $env);

        if (is_resource($process)) {
            // $pipes now looks like this:
            // 0 => writeable handle connected to child stdin
            // 1 => readable handle connected to child stdout

            fwrite($pipes[0], json_encode([$password, $hash]));
            fclose($pipes[0]);

            $result = stream_get_contents($pipes[1]);
            fclose($pipes[1]);

            $errors = stream_get_contents($pipes[2]);
            fclose($pipes[2]);

            // It is important that you close any pipes before calling
            // proc_close in order to avoid a deadlock
            $return_value = proc_close($process);

            //Logger::debug('fsfdrupalauth:' . $this->authId . ': authenticator stdout: ' . $result);

            $errors_found_yet = false;
            if ($errors != "") {
                Logger::error('fsfdrupalauth:' . $this->authId.': authenticator stderr: ' . $errors);
                $errors_found_yet = true;
            }

            if ($return_value != 0) {
                Logger::error('fsfdrupalauth:' . $this->authId . ': authenticator non-zero return code: ' . $return_value);
                $errors_found_yet = true;
            }

            return (!$errors_found_yet && is_string($result) && rtrim($result) == "true");

        } else {

            Logger::error('fsfdrupalauth:' . $this->authId . ': unable to launch authenticator');

            return false;
        }
    }

    /**
     *
     * query the database with arbitrary queries that only require a user name.
     *
     */
    private function query_db(string $queryname, string $query_params): array
    {
        $db = $this->connect();

        try {
            $sth = $db->prepare($this->$queryname);
        } catch (PDOException $e) {
            throw new Exception('fsfdrupalauth:' . $this->authId .
                ': - Failed to prepare queryname: ' . $queryname . ': ' . $e->getMessage());
        }

        try {
            $sth->execute($query_params);
        } catch (PDOException $e) {
            throw new Exception('fsfdrupalauth:' . $this->authId .
                ': - Failed to execute queryname: ' . $queryname . ': ' . $e->getMessage());
        }

        try {
            $data = $sth->fetchAll(PDO::FETCH_ASSOC);
        } catch (PDOException $e) {
            throw new Exception('fsfdrupalauth:' . $this->authId .
                ': - Failed to fetch result set: ' . $e->getMessage());
        }

        Logger::info('fsfdrupalauth:' . $this->authId . ': Got ' . count($data) .
            ' rows from database');

        return $data;
    }

    /**
     * add more CAS attributes to user, such as is_staff and is_member
     */
    private function add_more_attributes(array &$attributes, string $username): void {

        //
        // query on staff
        //

        $staff_data = $this->query_db('query_staff', ['username' => $username, 'fsf_org_id' => $this->fsf_org_id]);

        if (count($staff_data) === 0) {
            // No rows returned - invalid username
            Logger::debug('fsfdrupalauth:' . $this->authId .
                ': No rows in result set. Probably not FSF staff.');
        }

        $attributes['is_fsf_staff'] = ['false'];

        foreach ($staff_data as $row) {
            foreach ($row as $key => $value) {

                if ($value === null) {
                    continue;
                }
                $value = (string) $value;

                if (strtolower($value) === strtolower($username)) {
                    // they are staff
                    $attributes['is_fsf_staff'] = ['true'];
                    break;
                }
            }
        }

        //
        // query on membership
        //

        $membership_data = $this->query_db('query_membership', ['username' => $username]);

        if (count($membership_data) === 0) {
            // No rows returned - invalid username
            Logger::debug('fsfdrupalauth:' . $this->authId .
                ': No rows in result set. Probably no membership.');
        }

        $attributes['is_member'] = ['false'];
        $attributes['was_member'] = ['false'];

        foreach ($membership_data as $row) {
            foreach ($row as $key => $value) {
                if ($value === null) {
                    continue;
                }
                $value = (string) $value;

                if ($value === '1' || $value === '2' || $value === '3') {
                    $attributes['is_member'] = ['true'];
                    $attributes['was_member'] = ['true'];
                } elseif ($value === '4') {
                    $attributes['was_member'] = ['true'];
                }
            }
        }

        //
        // helper functions for access to board nomination / discussion process
        //

	/**
         * @param string $query_name  Name of query in authsources
         * @param array $extra_params  Associative array of parameters to include in query
	 */
	$donation_query = function (string $query_name, array $extra_params): array
	    use (string $username) {

		$parameters = ['username' => $username];

		foreach ($extra_params as $key => $value) {
			$parameters[$key] = $value;
		}

		return $this->query_db($query_name, $parameters);
	};

	$old_membership_query = $donation_query;

	$compare_res = function (array $result, int $amount): void {
		foreach ($result[0] as $key => $value) {
			if (intval($value) >= $amount) {
				return true;
			}
		}
		return false;
	};

	// set dates here, used by helper functions below
	$nomination_process_start_date = $this->nomination_process_contrib_start_date;
	$nomination_process_end_date   = $this->nomination_process_contrib_end_date;
	$discussion_process_start_date = $this->discussion_process_contrib_start_date;
	$discussion_process_end_date   = $this->discussion_process_contrib_end_date;


	// looks for memberships / comparable donations in time window. also
	// looks for a membership or donation (included as a param) that
	// occurred up to a year before, and that would have carried over into
	// the time window with a single donation. this approximates whether
	// the person was, or would have been, a member during the configured
	// time window.
	$nomination_process_analyze_history = function (array $selective_donations_history): boolean
	    use (string $nomination_process_start_date, string $nomination_process_end_date) {

		$eligible = false;

		Logger::debug('fsfdrupalauth:' . $this->authId .
			': start date: ' . $nomination_process_start_date . " end date: " . $nomination_process_end_date);

		$start_date_obj = new \DateTime($nomination_process_start_date);
		$end_date_obj = new \DateTime($nomination_process_end_date);

		foreach ($selective_donations_history as $row) {

			$amount = intval($row['amount']);
			$member_type_id = $row['member_type_id'];
			$receive_date_obj = new \DateTime($row['receive_date']);

			if ($amount < 5) {
				continue;

			} elseif ($receive_date_obj >= $start_date_obj and $receive_date_obj <= $end_date_obj) {
				return true;

			} elseif ($receive_date_obj < $start_date_obj) {
				switch ($member_type_id) {
					case '1':
					case '2':
						$rate = intval($this->student_membership_monthly_rate);
						break;
					case '8':
					case '9':
					case null:
					default:
						$rate = intval($this->membership_monthly_rate);
						break;
				}
				$membership_end_date_obj = new \DateTime($row['receive_date']);
				$membership_end_date_obj->add(new \DateInterval("P" . ceil($amount / $rate) . "M"));

				if ($membership_end_date_obj >= $start_date_obj) {
					return true;
				}
			}
		}
		return false;
	};

	$discussion_process_analyze_history = function (array $selective_donations_history): boolean
	    use (string $discussion_process_start_date, string $discussion_process_end_date) {

		$eligible = false;
		$total = 0;

		Logger::debug('fsfdrupalauth:' . $this->authId .
			': start date: ' . $discussion_process_start_date . " end date: " . $discussion_process_end_date);

		$start_date_obj = new \DateTime($discussion_process_start_date);
		$end_date_obj = new \DateTime($discussion_process_end_date);

		foreach ($selective_donations_history as $row) {

			$amount = intval($row['amount']);
			$member_type_id = $row['member_type_id'];
			$receive_date_obj = new \DateTime($row['receive_date']);

			if (($receive_date_obj > $start_date_obj) && ($receive_date_obj < $end_date_obj)) {
				$total += $amount;
			}
		}

		Logger::debug('fsfdrupalauth:' . $this->authId .
			': total amount: $' . $total);

		if ($total >= $this->discussion_process_donation_amount) {
			return true;
		} else {
			return false;
		}
	};

	//
	// nomination form participation specific checks
	//

	$donation_params    = ['start_date' => $nomination_process_start_date, 'end_date' => $nomination_process_end_date];
	$gift_member_params = ['start_date' => $nomination_process_start_date, 'end_date' => $nomination_process_end_date, 'gift_redeem_page_id' => intval($this->gift_redeem_page_id)];
	$adhoc_params       = ['adhoc_access_group_id' => intval($this->nomination_process_adhoc_access_group_id)];

	if ($this->nomination_process_active != 'true' ) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Nomination board process checks not active');
		$attributes['nomination_process'] = ['false'];

	} elseif ($compare_res($donation_query('query_nomination_process_adhoc', $adhoc_params), 1)) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': In adhoc list of contacts for nomination board process');
		$attributes['nomination_process'] = ['true'];

	} elseif ($attributes['is_member'] != ['true']) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Not a current member for nomination board process');
		$attributes['nomination_process'] = ['false'];

	} elseif ($nomination_process_analyze_history($donation_query('query_nomination_process_donations', $donation_params))
		|| $compare_res($donation_query('query_nomination_process_gift_receipt', $gift_member_params), 1)) {

		Logger::debug('fsfdrupalauth:' . $this->authId . ': Past membership / donations meet threshold for nomination board process');
		$attributes['nomination_process'] = ['true'];

	} else {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Past membership / donations do not meet threshold for nomination board process');
		$attributes['nomination_process'] = ['false'];
	}

	//
	// discussion forum participation specific checks
	//

	$donation_params    = ['start_date' => $discussion_process_start_date, 'end_date' => $discussion_process_end_date];
	$old_member_params  = $donation_params;
	$adhoc_params       = ['adhoc_access_group_id' => intval($this->discussion_process_adhoc_access_group_id)];
	$adhoc_params_no    = ['adhoc_access_group_id' => intval($this->discussion_process_adhoc_no_access_group_id)];

	if ($this->discussion_process_active != 'true' ) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Discussion board process checks not active');
		$attributes['discussion_process'] = ['false'];

	} elseif ($compare_res($donation_query('query_discussion_process_adhoc', $adhoc_params_no), 1)) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Nominee not allowed to participate in board discussion process.');
		$attributes['discussion_process'] = ['false'];

	} elseif ($compare_res($donation_query('query_discussion_process_adhoc', $adhoc_params), 1)) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': In adhoc list of contacts for discussion board process');
		$attributes['discussion_process'] = ['true'];

	} elseif ($attributes['is_member'] != ['true']) {
		Logger::debug('fsfdrupalauth :' . $this->authId . ': Not a member, so not eligible for board nominee discussion process.');
		$attributes['discussion_process'] = ['false'];

	} elseif ($compare_res($old_membership_query('query_discussion_process_old_membership', $old_member_params), 1)
		|| $discussion_process_analyze_history($donation_query('query_discussion_process_donations', $donation_params))) {

		Logger::debug('fsfdrupalauth:' . $this->authId . ': Past membership / donations meet threshold for discussion board process');
		$attributes['discussion_process'] = ['true'];

	} else {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Past membership / donations do not meet threshold for discussion board process');
		$attributes['discussion_process'] = ['false'];
	}

	//
	// discussion forum moderator early access
	//

	$adhoc_params       = ['adhoc_access_group_id' => intval($this->discussion_moderator_access_group_id)];

	if ($compare_res($donation_query('query_discussion_process_adhoc', $adhoc_params), 1)) {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': In adhoc list of moderators for board discussion forum');
		$attributes['discussion_moderator'] = ['true'];

	} else {
		Logger::debug('fsfdrupalauth:' . $this->authId . ': Not in adhoc list of moderators for board discussion forum');
		$attributes['discussion_moderator'] = ['false'];
	}

        //
        // aggregate attribute
        //

        $groups_list = '';
        $first = true;
        foreach ($attributes as $key => $value) {
            if ($value == ['true']) {
                if (!$first) {
                    $groups_list .= ', ';
                }
                $groups_list .= $key;
                $first = false;
            }
        }

        $attributes['groups_list'] = [$groups_list];
    }

    /**
     * Attempt to log in using the given username and password.
     *
     * On a successful login, this function should return the users attributes. On failure,
     * it should throw an exception. If the error was caused by the user entering the wrong
     * username or password, a Error\Error('WRONGUSERPASS') should be thrown.
     *
     * Note that both the username and the password are UTF-8 encoded.
     *
     * @param string $username  The username the user wrote.
     * @param string $password  The password the user wrote.
     * @return array  Associative array with the users attributes.
     */
    protected function login(string $username, string $password): array
    {

        //// keep this commented when it's not in use. it prints user passwords to the log file
        //Logger::debug('fsfdrupalauth:' . $this->authId . ': entered password: ' . $password);


        $user_data = $this->query_db('query_main', ['username' => $username]);


        if (count($user_data) === 0) {
            // No rows returned - invalid username
            Logger::error('fsfdrupalauth:' . $this->authId .
                ': No rows in result set. Probably wrong username.');
            throw new Error\Error('WRONGUSERPASS');
        }

        /* Extract attributes. We allow the resultset to consist of multiple rows. Attributes
         * which are present in more than one row will become multivalued. null values and
         * duplicate values will be skipped. All values will be converted to strings.
         */
        $attributes = [];

        // use the entered user name so we don't forcibly change it to all
        // lower case. this is to preserve the behavior of the old cas server,
        // and to remain compatible with our MW and Discourse sites that are
        // case sensitive.
        $attributes['name'][] = $username;

        foreach ($user_data as $row) {
            foreach ($row as $key => $value) {
                if ($value === null) {
                    continue;
                }

                $value = (string) $value;

                if (!array_key_exists($key, $attributes)) {
                    $attributes[$key] = [];
                }

                if (in_array($value, $attributes[$key], true)) {
                    // Value already exists in attribute
                    continue;
                }

                $attributes[$key][] = $value;
            }
        }

        if (!$this->check_password($password, $attributes['pass'][0])) {
            throw new Error\Error('WRONGUSERPASS');
        }

        unset($attributes['pass']);


        $this->add_more_attributes($attributes, $username);


        Logger::info('fsfdrupalauth:' . $this->authId . ': Attributes: ' . 
            implode(',', array_keys($attributes)));

        return $attributes;
    }
}