HmacFactory.php

Go to the documentation of this file.

<?php

namespace Elgg\Security;

use Elgg\Traits\TimeUsing;

class HmacFactory {

    use TimeUsing;
    
    protected $site_secret;

    protected $crypto;

    public function __construct(SiteSecret $secret, Crypto $crypto) {
        $this->site_secret = $secret;
        $this->crypto = $crypto;
    }

    public function getHmac($data, $algo = 'sha256', $key = '') {
        if (!$key) {
            $key = $this->site_secret->get(true);
        }
        
        return new Hmac($key, [$this->crypto, 'areEqual'], $data, $algo);
    }
    
    public function generateInviteCode(string $username): string {
        $time = $this->getCurrentTime()->getTimestamp();
        $token = $this->getHmac([$time, $username])->getToken();
        
        return "{$time}.{$token}";
    }
    
    public function validateInviteCode(string $username, string $code): bool {
        // validate the format of the token created by self::generateInviteCode()
        $matches = [];
        if (!preg_match('~^(\d+)\.([a-zA-Z0-9\-_]+)$~', $code, $matches)) {
            return false;
        }
        
        $time = (int) $matches[1];
        $mac = $matches[2];
        
        return $this->getHmac([$time, $username])->matchesToken($mac);
    }
}