AuthenticationService.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Exceptions\AuthenticationException;
use Elgg\Traits\Loggable;

class AuthenticationService {
    
    use Loggable;
    
    protected array $handlers = [];
    
    public function __construct(protected HandlersService $handlerService) {
    }
    
    public function registerHandler($handler, string $importance = 'sufficient', string $policy = 'user'): bool {
        $handler_string = $this->handlerService->describeCallable($handler);
        if (!isset($this->handlers[$policy])) {
            $this->handlers[$policy] = [];
        }
        
        $this->handlers[$policy][$handler_string] = [
            'handler' => $handler,
            'importance' => strtolower($importance),
        ];
        
        return true;
    }
    
    public function unregisterHandler($handler, string $policy = 'user'): void {
        $handler_string = $this->handlerService->describeCallable($handler);
        
        unset($this->handlers[$policy][$handler_string]);
    }
    
    public function authenticate(string $policy, array $authentication_params = []): bool {
        if (!isset($this->handlers[$policy])) {
            return false;
        }
        
        $authenticated = false;
        $first_exception = null;
        
        foreach ($this->handlers[$policy] as $handler_string => $handler_config) {
            $handler = $handler_config['handler'];
            $importance = strtolower($handler_config['importance']);
            
            if (!$this->handlerService->isCallable($handler)) {
                $this->getLogger()->warning("PAM handler '{$handler_string}' for policy '{$policy}' isn't callable");
                continue;
            }
            
            $callable = $this->handlerService->resolveCallable($handler);
            
            try {
                $result = call_user_func($callable, $authentication_params);
                if ($result === true) {
                    $authenticated = true;
                } elseif ($result === false && $importance === 'required') {
                    return false;
                }
            } catch (\Exception $e) {
                if (!$e instanceof AuthenticationException) {
                    $e = new AuthenticationException($e->getMessage(), $e->getCode(), $e);
                }
                
                if ($importance === 'required') {
                    throw $e;
                }
                
                if (!isset($first_exception)) {
                    $first_exception = $e;
                }
            }
        }
        
        if (!$authenticated && $first_exception instanceof AuthenticationException) {
            throw $first_exception;
        }
        
        return $authenticated;
    }
}