faustwp / includes / auth / functions.php

functions.php in Faust.js trunk, at includes/auth/functions.php

229 lines 5.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Redirect related functions.
4	*
5	* @package FaustWP
6	*/
7
8	namespace WPE\FaustWP\Auth;
9
10	use function WPE\FaustWP\Settings\get_secret_key;
11
12	if ( ! defined( 'ABSPATH' ) ) {
13	exit;
14	}
15
16	/**
17	* Generate a refresh token given a user.
18	*
19	* @uses WPE\FaustWP\Auth\generate_user_code()
20	*
21	* @param WP_User $wp_user A WP_User object.
22	* @param int $duration The duration in seconds to remain valid.
23	*
24	* @return string\|bool An encrypted string or false.
25	*/
26	function generate_refresh_token( $wp_user, $duration ) {
27	return generate_user_code( $wp_user, 'rt', $duration );
28	}
29
30	/**
31	* Generate an access token given a user.
32	*
33	* @uses WPE\FaustWP\Auth\generate_user_code()
34	*
35	* @param WP_User $wp_user A WP_User object.
36	* @param int $duration The duration in seconds to remain valid.
37	*
38	* @return string\|bool An encrypted string or false.
39	*/
40	function generate_access_token( $wp_user, $duration ) {
41	return generate_user_code( $wp_user, 'at', $duration );
42	}
43
44	/**
45	* Generate an authorization code given a user.
46	*
47	* @uses WPE\FaustWP\Auth\generate_user_code()
48	*
49	* @param WP_User $wp_user A WP_User object.
50	* @param int $duration The duration in seconds to remain valid.
51	*
52	* @return string\|bool An encrypted string or false.
53	*/
54	function generate_authorization_code( $wp_user, $duration ) {
55	return generate_user_code( $wp_user, 'ac', $duration );
56	}
57
58	/**
59	* Get a WP_User given a refresh token.
60	*
61	* @uses WPE\FaustWP\Auth\get_user_from_code()
62	*
63	* @param string $token A base 64 encoded string.
64	*
65	* @return WP_user\|bool A WP_User object or false.
66	*/
67	function get_user_from_refresh_token( $token ) {
68	return get_user_from_code( $token, 'rt' );
69	}
70
71	/**
72	* Get a WP_User given an access token.
73	*
74	* @uses WPE\FaustWP\Auth\get_user_from_code()
75	*
76	* @param string $token A base 64 encoded string.
77	*
78	* @return WP_User\|bool A WP_User object or false.
79	*/
80	function get_user_from_access_token( $token ) {
81	return get_user_from_code( $token, 'at' );
82	}
83
84	/**
85	* Get a WP_User given an authorization code.
86	*
87	* @uses WPE\FaustWP\Auth\get_user_from_code()
88	*
89	* @param string $code A base 64 encoded string.
90	*
91	* @return WP_User\|bool A WP_User object or false.
92	*/
93	function get_user_from_authorization_code( $code ) {
94	return get_user_from_code( $code, 'ac' );
95	}
96
97	/**
98	* Generate an encrypted code for the given WP_User and type.
99	*
100	* @uses WPE\FaustWP\Auth\encrypt()
101	*
102	* @param WP_User $wp_user A WP_User object.
103	* @param string $type The type of code. Either 'at', 'rt', or 'at'.
104	* @param int $duration The duration in seconds to remain valid.
105	*
106	* @return string\|bool An encrypted string or false if failure.
107	*/
108	function generate_user_code( $wp_user, $type, $duration ) {
109	if ( empty( $wp_user->ID ) ) {
110	return false;
111	}
112
113	return encrypt( "{$type}\|{$wp_user->ID}\|" . ( time() + $duration ) );
114	}
115
116	/**
117	* Get a WP_User given a base 64 encoded code.
118	*
119	* @param string $code The base64 encoded encrypted code.
120	* @param string $type The type of code. Either 'ac' or 'at'.
121	*
122	* @return WP_User\|bool A WP_User object or false.
123	*/
124	function get_user_from_code( $code, $type ) {
125	$code = decrypt( $code );
126	if ( ! $code ) {
127	return false;
128	}
129
130	$parts = explode( '\|', $code );
131	if ( count( $parts ) < 3 ) {
132	return false;
133	}
134
135	if ( $type !== $parts[0] ) {
136	return false;
137	}
138
139	if ( absint( $parts[2] ) < time() ) {
140	return false;
141	}
142
143	return get_user_by( 'ID', absint( $parts[1] ) );
144	}
145
146	/**
147	* Encrypt a value.
148	*
149	* @uses openssl_encrypt()
150	* @link https://www.php.net/manual/en/function.openssl-encrypt.php
151	*
152	* @param string $value The value to encrypt.
153	*
154	* @return string\|bool The encrypted value as a base 64 encoded string or false.
155	*/
156	function encrypt( $value ) {
157	$secret_key = get_secret_key();
158
159	if ( ! $secret_key ) {
160	return false;
161	}
162
163	$iv = openssl_random_pseudo_bytes( openssl_cipher_iv_length( 'AES-256-CBC' ) );
164	$cipher_text = openssl_encrypt( $value, 'AES-256-CBC', $secret_key, OPENSSL_RAW_DATA, $iv );
165
166	if ( ! $cipher_text ) {
167	return false;
168	}
169
170	$hash = hash_hmac( 'sha256', $iv . $cipher_text, $secret_key, true );
171
172	return base64_encode( $iv . $hash . $cipher_text ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
173	}
174
175	/**
176	* Decrypt a value.
177	*
178	* @uses openssl_decrypt()
179	* @link https://www.php.net/manual/en/function.openssl-decrypt.php
180	*
181	* @param string $value The base 64 encoded value.
182	*
183	* @return string\|bool The decrypted value or false.
184	*/
185	function decrypt( $value ) {
186	$secret_key = get_secret_key();
187	$decrypted_value = false;
188
189	if ( ! $secret_key ) {
190	return $decrypted_value;
191	}
192
193	$value = base64_decode( $value ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
194	$iv_length = openssl_cipher_iv_length( 'AES-256-CBC' );
195	$iv = substr( $value, 0, $iv_length );
196	$hash = substr( $value, $iv_length, 32 );
197	$cipher_text = substr( $value, $iv_length + 32 );
198	$hash_comp = hash_hmac( 'sha256', $iv . $cipher_text, $secret_key, true );
199
200	if ( hash_equals( $hash, $hash_comp ) ) {
201	$decrypted_value = openssl_decrypt( $cipher_text, 'AES-256-CBC', $secret_key, OPENSSL_RAW_DATA, $iv );
202	}
203
204	return $decrypted_value;
205	}
206
207	/**
208	* Get the default key for decryption.
209	*
210	* @todo Figure this out.
211	*
212	* @return string The default key.
213	*/
214	function get_default_key() {
215	if ( defined( 'FAUST_SECRET_KEY' ) && FAUST_SECRET_KEY ) {
216	return FAUST_SECRET_KEY;
217	}
218
219	if ( defined( 'FAUSTWP_SECRET_KEY' ) && FAUSTWP_SECRET_KEY ) {
220	return FAUSTWP_SECRET_KEY;
221	}
222
223	if ( defined( 'AUTH_KEY' ) && AUTH_KEY ) {
224	return AUTH_KEY;
225	}
226
227	return get_secret_key();
228	}
229