PersistentLoginService.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Database\UsersRememberMeCookiesTable;
use Elgg\Traits\TimeUsing;

class PersistentLoginService {
    
    use TimeUsing;
    
    protected array $cookie_config;
    
    protected string $cookie_token;
    
    public $_callable_elgg_set_cookie = 'elgg_set_cookie';
    
    public function __construct(
        protected UsersRememberMeCookiesTable $cookie_table,
        protected \ElggSession $session,
        protected \Elgg\Security\Crypto $crypto,
        \Elgg\Config $config,
        \Elgg\Http\Request $request
    ) {
        $global_cookies_config = $config->getCookieConfig();
        
        $this->cookie_config = $global_cookies_config['remember_me'];
        $this->cookie_token = $request->cookies->get($this->cookie_config['name'], '');
    }

    public function makeLoginPersistent(\ElggUser $user): void {
        $token = $this->generateToken();
        $hash = $this->hashToken($token);

        $this->cookie_table->insertHash($user, $hash);
        $this->setCookie($token);
        $this->setSessionToken($token);
    }

    public function removePersistentLogin(): void {
        if ($this->cookie_token) {
            $client_hash = $this->hashToken($this->cookie_token);
            $this->cookie_table->deleteHash($client_hash);
        }

        $this->setCookie('');
        $this->setSessionToken('');
    }

    public function handlePasswordChange(\ElggUser $subject, \ElggUser $modifier = null): void {
        $this->cookie_table->deleteAllHashes($subject);
        if (!$modifier || ($modifier->guid !== $subject->guid) || !$this->cookie_token) {
            return;
        }

        $this->makeLoginPersistent($subject);
    }

    public function bootSession(): ?\ElggUser {
        if (!$this->cookie_token) {
            return null;
        }

        // is this token good?
        $user = $this->getUserFromToken($this->cookie_token);
        if ($user) {
            $this->setSessionToken($this->cookie_token);

            return $user;
        }
        
        $this->setCookie('');
        return null;
    }

    public function getUserFromToken(string $token): ?\ElggUser {
        if (empty($token)) {
            return null;
        }
        
        $hash = $this->hashToken($token);
        if (empty($hash)) {
            return null;
        }
        
        $user_row = $this->cookie_table->getRowFromHash($hash);
        if (empty($user_row)) {
            return null;
        }
        
        $user = get_user($user_row->guid);
        return ($user instanceof \ElggUser) ? $user : null;
    }
    
    public function updateTokenUsage(\ElggUser $user): ?bool {
        if (!$this->cookie_token) {
            return null;
        }
        
        // update the database record
        // not interested in number of updated rows, as an update in the same second won't update the row
        $this->cookie_table->updateHash($user, $this->hashToken($this->cookie_token));
        
        // also update the cookie lifetime client-side
        $this->setCookie($this->cookie_token);
        
        return true;
    }
    
    public function removeExpiredTokens($time): bool {
        $time = Values::normalizeTime($time);
        
        $expires = Values::normalizeTime($this->cookie_config['expire']);
        $diff = $time->diff($expires);
        
        $time->sub($diff);
        if ($time->getTimestamp() > time()) {
            return false;
        }
        
        return (bool) $this->cookie_table->deleteExpiredHashes($time->getTimestamp());
    }

    protected function hashToken(string $token): string {
        // note: with user passwords, you'd want legit password hashing, but since these are randomly
        // generated and long tokens, rainbow tables aren't any help.
        return md5($token);
    }

    protected function setCookie(string $token): void {
        $cookie = new \ElggCookie($this->cookie_config['name']);
        foreach (['expire', 'path', 'domain', 'secure', 'httpOnly'] as $key) {
            $cookie->$key = $this->cookie_config[strtolower($key)];
        }
        
        $cookie->value = $token;
        if (!$token) {
            $cookie->expire = $this->getCurrentTime('-30 days')->getTimestamp();
        }
        
        call_user_func($this->_callable_elgg_set_cookie, $cookie);
    }

    protected function setSessionToken(string $token): void {
        if ($token) {
            $this->session->set('code', $token);
        } else {
            $this->session->remove('code');
        }
    }

    protected function generateToken(): string {
        return 'z' . $this->crypto->getRandomString(31);
    }
}