wp-stateless / lib / Google / vendor / google / auth / src / AccessToken.php

AccessToken.php in WP-Stateless – Google Cloud Storage 3.0.3, at lib/Google/vendor/google/auth/src/AccessToken.php

480 lines 17.2 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2019 Google LLC
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth;
19
20	use DateTime;
21	use Exception;
22	use Firebase\JWT\ExpiredException;
23	use Firebase\JWT\JWT;
24	use Firebase\JWT\SignatureInvalidException;
25	use Google\Auth\Cache\MemoryCacheItemPool;
26	use Google\Auth\HttpHandler\HttpClientCache;
27	use Google\Auth\HttpHandler\HttpHandlerFactory;
28	use GuzzleHttp\Psr7;
29	use GuzzleHttp\Psr7\Request;
30	use InvalidArgumentException;
31	use phpseclib\Crypt\RSA;
32	use phpseclib\Math\BigInteger;
33	use Psr\Cache\CacheItemPoolInterface;
34	use RuntimeException;
35	use SimpleJWT\InvalidTokenException;
36	use SimpleJWT\JWT as SimpleJWT;
37	use SimpleJWT\Keys\KeyFactory;
38	use SimpleJWT\Keys\KeySet;
39	use UnexpectedValueException;
40
41	/**
42	* Wrapper around Google Access Tokens which provides convenience functions.
43	*
44	* @experimental
45	*/
46	class AccessToken
47	{
48	const FEDERATED_SIGNON_CERT_URL = 'https://www.googleapis.com/oauth2/v3/certs';
49	const IAP_CERT_URL = 'https://www.gstatic.com/iap/verify/public_key-jwk';
50	const IAP_ISSUER = 'https://cloud.google.com/iap';
51	const OAUTH2_ISSUER = 'accounts.google.com';
52	const OAUTH2_ISSUER_HTTPS = 'https://accounts.google.com';
53	const OAUTH2_REVOKE_URI = 'https://oauth2.googleapis.com/revoke';
54
55	/**
56	* @var callable
57	*/
58	private $httpHandler;
59
60	/**
61	* @var CacheItemPoolInterface
62	*/
63	private $cache;
64
65	/**
66	* @param callable $httpHandler [optional] An HTTP Handler to deliver PSR-7 requests.
67	* @param CacheItemPoolInterface $cache [optional] A PSR-6 compatible cache implementation.
68	*/
69	public function __construct(
70	callable $httpHandler = null,
71	CacheItemPoolInterface $cache = null
72	) {
73	$this->httpHandler = $httpHandler
74	?: HttpHandlerFactory::build(HttpClientCache::getHttpClient());
75	$this->cache = $cache ?: new MemoryCacheItemPool();
76	}
77
78	/**
79	* Verifies an id token and returns the authenticated apiLoginTicket.
80	* Throws an exception if the id token is not valid.
81	* The audience parameter can be used to control which id tokens are
82	* accepted. By default, the id token must have been issued to this OAuth2 client.
83	*
84	* @param string $token The JSON Web Token to be verified.
85	* @param array $options [optional] Configuration options.
86	* @param string $options.audience The indended recipient of the token.
87	* @param string $options.issuer The intended issuer of the token.
88	* @param string $options.cacheKey The cache key of the cached certs. Defaults to
89	* the sha1 of $certsLocation if provided, otherwise is set to
90	* "federated_signon_certs_v3".
91	* @param string $options.certsLocation The location (remote or local) from which
92	* to retrieve certificates, if not cached. This value should only be
93	* provided in limited circumstances in which you are sure of the
94	* behavior.
95	* @param bool $options.throwException Whether the function should throw an
96	* exception if the verification fails. This is useful for
97	* determining the reason verification failed.
98	* @return array\|bool the token payload, if successful, or false if not.
99	* @throws InvalidArgumentException If certs could not be retrieved from a local file.
100	* @throws InvalidArgumentException If received certs are in an invalid format.
101	* @throws InvalidArgumentException If the cert alg is not supported.
102	* @throws RuntimeException If certs could not be retrieved from a remote location.
103	* @throws UnexpectedValueException If the token issuer does not match.
104	* @throws UnexpectedValueException If the token audience does not match.
105	*/
106	public function verify($token, array $options = [])
107	{
108	$audience = isset($options['audience'])
109	? $options['audience']
110	: null;
111	$issuer = isset($options['issuer'])
112	? $options['issuer']
113	: null;
114	$certsLocation = isset($options['certsLocation'])
115	? $options['certsLocation']
116	: self::FEDERATED_SIGNON_CERT_URL;
117	$cacheKey = isset($options['cacheKey'])
118	? $options['cacheKey']
119	: $this->getCacheKeyFromCertLocation($certsLocation);
120	$throwException = isset($options['throwException'])
121	? $options['throwException']
122	: false; // for backwards compatibility
123
124	// Check signature against each available cert.
125	$certs = $this->getCerts($certsLocation, $cacheKey, $options);
126	$alg = $this->determineAlg($certs);
127	if (!in_array($alg, ['RS256', 'ES256'])) {
128	throw new InvalidArgumentException(
129	'unrecognized "alg" in certs, expected ES256 or RS256'
130	);
131	}
132	try {
133	if ($alg == 'RS256') {
134	return $this->verifyRs256($token, $certs, $audience, $issuer);
135	}
136	return $this->verifyEs256($token, $certs, $audience, $issuer);
137	} catch (ExpiredException $e) { // firebase/php-jwt 3+
138	} catch (\ExpiredException $e) { // firebase/php-jwt 2
139	} catch (SignatureInvalidException $e) { // firebase/php-jwt 3+
140	} catch (\SignatureInvalidException $e) { // firebase/php-jwt 2
141	} catch (InvalidTokenException $e) { // simplejwt
142	} catch (DomainException $e) {
143	} catch (InvalidArgumentException $e) {
144	} catch (UnexpectedValueException $e) {
145	}
146
147	if ($throwException) {
148	throw $e;
149	}
150
151	return false;
152	}
153
154	/**
155	* Identifies the expected algorithm to verify by looking at the "alg" key
156	* of the provided certs.
157	*
158	* @param array $certs Certificate array according to the JWK spec (see
159	* https://tools.ietf.org/html/rfc7517).
160	* @return string The expected algorithm, such as "ES256" or "RS256".
161	*/
162	private function determineAlg(array $certs)
163	{
164	$alg = null;
165	foreach ($certs as $cert) {
166	if (empty($cert['alg'])) {
167	throw new InvalidArgumentException(
168	'certs expects "alg" to be set'
169	);
170	}
171	$alg = $alg ?: $cert['alg'];
172
173	if ($alg != $cert['alg']) {
174	throw new InvalidArgumentException(
175	'More than one alg detected in certs'
176	);
177	}
178	}
179	return $alg;
180	}
181
182	/**
183	* Verifies an ES256-signed JWT.
184	*
185	* @param string $token The JSON Web Token to be verified.
186	* @param array $certs Certificate array according to the JWK spec (see
187	* https://tools.ietf.org/html/rfc7517).
188	* @param string\|null $audience If set, returns false if the provided
189	* audience does not match the "aud" claim on the JWT.
190	* @param string\|null $issuer If set, returns false if the provided
191	* issuer does not match the "iss" claim on the JWT.
192	* @return array\|bool the token payload, if successful, or false if not.
193	*/
194	private function verifyEs256($token, array $certs, $audience = null, $issuer = null)
195	{
196	$this->checkSimpleJwt();
197
198	$jwkset = new KeySet();
199	foreach ($certs as $cert) {
200	$jwkset->add(KeyFactory::create($cert, 'php'));
201	}
202
203	// Validate the signature using the key set and ES256 algorithm.
204	$jwt = $this->callSimpleJwtDecode([$token, $jwkset, 'ES256']);
205	$payload = $jwt->getClaims();
206
207	if (isset($payload['aud'])) {
208	if ($audience && $payload['aud'] != $audience) {
209	throw new UnexpectedValueException('Audience does not match');
210	}
211	}
212
213	// @see https://cloud.google.com/iap/docs/signed-headers-howto#verifying_the_jwt_payload
214	$issuer = $issuer ?: self::IAP_ISSUER;
215	if (!isset($payload['iss']) \|\| $payload['iss'] !== $issuer) {
216	throw new UnexpectedValueException('Issuer does not match');
217	}
218
219	return $payload;
220	}
221
222	/**
223	* Verifies an RS256-signed JWT.
224	*
225	* @param string $token The JSON Web Token to be verified.
226	* @param array $certs Certificate array according to the JWK spec (see
227	* https://tools.ietf.org/html/rfc7517).
228	* @param string\|null $audience If set, returns false if the provided
229	* audience does not match the "aud" claim on the JWT.
230	* @param string\|null $issuer If set, returns false if the provided
231	* issuer does not match the "iss" claim on the JWT.
232	* @return array\|bool the token payload, if successful, or false if not.
233	*/
234	private function verifyRs256($token, array $certs, $audience = null, $issuer = null)
235	{
236	$this->checkAndInitializePhpsec();
237	$keys = [];
238	foreach ($certs as $cert) {
239	if (empty($cert['kid'])) {
240	throw new InvalidArgumentException(
241	'certs expects "kid" to be set'
242	);
243	}
244	if (empty($cert['n']) \|\| empty($cert['e'])) {
245	throw new InvalidArgumentException(
246	'RSA certs expects "n" and "e" to be set'
247	);
248	}
249	$rsa = new RSA();
250	$rsa->loadKey([
251	'n' => new BigInteger($this->callJwtStatic('urlsafeB64Decode', [
252	$cert['n'],
253	]), 256),
254	'e' => new BigInteger($this->callJwtStatic('urlsafeB64Decode', [
255	$cert['e']
256	]), 256),
257	]);
258
259	// create an array of key IDs to certs for the JWT library
260	$keys[$cert['kid']] = $rsa->getPublicKey();
261	}
262
263	$payload = $this->callJwtStatic('decode', [
264	$token,
265	$keys,
266	['RS256']
267	]);
268
269	if (property_exists($payload, 'aud')) {
270	if ($audience && $payload->aud != $audience) {
271	throw new UnexpectedValueException('Audience does not match');
272	}
273	}
274
275	// support HTTP and HTTPS issuers
276	// @see https://developers.google.com/identity/sign-in/web/backend-auth
277	$issuers = $issuer ? [$issuer] : [self::OAUTH2_ISSUER, self::OAUTH2_ISSUER_HTTPS];
278	if (!isset($payload->iss) \|\| !in_array($payload->iss, $issuers)) {
279	throw new UnexpectedValueException('Issuer does not match');
280	}
281
282	return (array) $payload;
283	}
284
285	/**
286	* Revoke an OAuth2 access token or refresh token. This method will revoke the current access
287	* token, if a token isn't provided.
288	*
289	* @param string\|array $token The token (access token or a refresh token) that should be revoked.
290	* @param array $options [optional] Configuration options.
291	* @return bool Returns True if the revocation was successful, otherwise False.
292	*/
293	public function revoke($token, array $options = [])
294	{
295	if (is_array($token)) {
296	if (isset($token['refresh_token'])) {
297	$token = $token['refresh_token'];
298	} else {
299	$token = $token['access_token'];
300	}
301	}
302
303	$body = Psr7\stream_for(http_build_query(['token' => $token]));
304	$request = new Request('POST', self::OAUTH2_REVOKE_URI, [
305	'Cache-Control' => 'no-store',
306	'Content-Type' => 'application/x-www-form-urlencoded',
307	], $body);
308
309	$httpHandler = $this->httpHandler;
310
311	$response = $httpHandler($request, $options);
312
313	return $response->getStatusCode() == 200;
314	}
315
316	/**
317	* Gets federated sign-on certificates to use for verifying identity tokens.
318	* Returns certs as array structure, where keys are key ids, and values
319	* are PEM encoded certificates.
320	*
321	* @param string $location The location from which to retrieve certs.
322	* @param string $cacheKey The key under which to cache the retrieved certs.
323	* @param array $options [optional] Configuration options.
324	* @return array
325	* @throws InvalidArgumentException If received certs are in an invalid format.
326	*/
327	private function getCerts($location, $cacheKey, array $options = [])
328	{
329	$cacheItem = $this->cache->getItem($cacheKey);
330	$certs = $cacheItem ? $cacheItem->get() : null;
331
332	$gotNewCerts = false;
333	if (!$certs) {
334	$certs = $this->retrieveCertsFromLocation($location, $options);
335
336	$gotNewCerts = true;
337	}
338
339	if (!isset($certs['keys'])) {
340	if ($location !== self::IAP_CERT_URL) {
341	throw new InvalidArgumentException(
342	'federated sign-on certs expects "keys" to be set'
343	);
344	}
345	throw new InvalidArgumentException(
346	'certs expects "keys" to be set'
347	);
348	}
349
350	// Push caching off until after verifying certs are in a valid format.
351	// Don't want to cache bad data.
352	if ($gotNewCerts) {
353	$cacheItem->expiresAt(new DateTime('+1 hour'));
354	$cacheItem->set($certs);
355	$this->cache->save($cacheItem);
356	}
357
358	return $certs['keys'];
359	}
360
361	/**
362	* Retrieve and cache a certificates file.
363	*
364	* @param $url string location
365	* @param array $options [optional] Configuration options.
366	* @return array certificates
367	* @throws InvalidArgumentException If certs could not be retrieved from a local file.
368	* @throws RuntimeException If certs could not be retrieved from a remote location.
369	*/
370	private function retrieveCertsFromLocation($url, array $options = [])
371	{
372	// If we're retrieving a local file, just grab it.
373	if (strpos($url, 'http') !== 0) {
374	if (!file_exists($url)) {
375	throw new InvalidArgumentException(sprintf(
376	'Failed to retrieve verification certificates from path: %s.',
377	$url
378	));
379	}
380
381	return json_decode(file_get_contents($url), true);
382	}
383
384	$httpHandler = $this->httpHandler;
385	$response = $httpHandler(new Request('GET', $url), $options);
386
387	if ($response->getStatusCode() == 200) {
388	return json_decode((string) $response->getBody(), true);
389	}
390
391	throw new RuntimeException(sprintf(
392	'Failed to retrieve verification certificates: "%s".',
393	$response->getBody()->getContents()
394	), $response->getStatusCode());
395	}
396
397	private function checkAndInitializePhpsec()
398	{
399	// @codeCoverageIgnoreStart
400	if (!class_exists('phpseclib\Crypt\RSA')) {
401	throw new RuntimeException('Please require phpseclib/phpseclib v2 to use this utility.');
402	}
403	// @codeCoverageIgnoreEnd
404
405	$this->setPhpsecConstants();
406	}
407
408	private function checkSimpleJwt()
409	{
410	// @codeCoverageIgnoreStart
411	if (!class_exists('SimpleJWT\JWT')) {
412	throw new RuntimeException('Please require kelvinmo/simplejwt ^0.2 to use this utility.');
413	}
414	// @codeCoverageIgnoreEnd
415	}
416
417	/**
418	* phpseclib calls "phpinfo" by default, which requires special
419	* whitelisting in the AppEngine VM environment. This function
420	* sets constants to bypass the need for phpseclib to check phpinfo
421	*
422	* @see phpseclib/Math/BigInteger
423	* @see https://github.com/GoogleCloudPlatform/getting-started-php/issues/85
424	* @codeCoverageIgnore
425	*/
426	private function setPhpsecConstants()
427	{
428	if (filter_var(getenv('GAE_VM'), FILTER_VALIDATE_BOOLEAN)) {
429	if (!defined('MATH_BIGINTEGER_OPENSSL_ENABLED')) {
430	define('MATH_BIGINTEGER_OPENSSL_ENABLED', true);
431	}
432	if (!defined('CRYPT_RSA_MODE')) {
433	define('CRYPT_RSA_MODE', RSA::MODE_OPENSSL);
434	}
435	}
436	}
437
438	/**
439	* Provide a hook to mock calls to the JWT static methods.
440	*
441	* @param string $method
442	* @param array $args
443	* @return mixed
444	*/
445	protected function callJwtStatic($method, array $args = [])
446	{
447	$class = class_exists('Firebase\JWT\JWT')
448	? 'Firebase\JWT\JWT'
449	: 'JWT';
450	return call_user_func_array([$class, $method], $args);
451	}
452
453	/**
454	* Provide a hook to mock calls to the JWT static methods.
455	*
456	* @param array $args
457	* @return mixed
458	*/
459	protected function callSimpleJwtDecode(array $args = [])
460	{
461	return call_user_func_array(['SimpleJWT\JWT', 'decode'], $args);
462	}
463
464	/**
465	* Generate a cache key based on the cert location using sha1 with the
466	* exception of using "federated_signon_certs_v3" to preserve BC.
467	*
468	* @param string $certsLocation
469	* @return string
470	*/
471	private function getCacheKeyFromCertLocation($certsLocation)
472	{
473	$key = $certsLocation === self::FEDERATED_SIGNON_CERT_URL
474	? 'federated_signon_certs_v3'
475	: sha1($certsLocation);
476
477	return 'google_auth_certs_cache\|' . $key;
478	}
479	}
480