HmacFactory.php

Go to the documentation of this file.

<?php
 
namespace Elgg\Security;
 
use Elgg\Traits\TimeUsing;
 
class HmacFactory {
 
    use TimeUsing;
 
    public function __construct(protected SiteSecret $site_secret, protected Crypto $crypto) {
    }
 
    public function getHmac($data, $algo = 'sha256', $key = '') {
        if (!$key) {
            $key = $this->site_secret->get(true);
        }
        
        return new Hmac($key, [$this->crypto, 'areEqual'], $data, $algo);
    }
    
    public function generateInviteCode(string $username): string {
        $time = $this->getCurrentTime()->getTimestamp();
        $token = $this->getHmac([$time, $username])->getToken();
        
        return "{$time}.{$token}";
    }
    
    public function validateInviteCode(string $username, string $code): bool {
        // validate the format of the token created by self::generateInviteCode()
        $matches = [];
        if (!preg_match('~^(\d+)\.([a-zA-Z0-9\-_]+)$~', $code, $matches)) {
            return false;
        }
        
        $time = (int) $matches[1];
        $mac = $matches[2];
        
        return $this->getHmac([$time, $username])->matchesToken($mac);
    }
}