add apiKey management
This commit is contained in:
marko
153
homepage/participo/lib/participoLib/apiKey.php
Normal file
153
homepage/participo/lib/participoLib/apiKey.php
Normal file
@@ -0,0 +1,153 @@
|
||||
<?php
|
||||
|
||||
// require_once('Base62x/base62x.php');
|
||||
require_once 'participoLib/dbConnector.php';
|
||||
|
||||
/**
|
||||
* Framework for apiKeys
|
||||
*/
|
||||
class ApiKey
|
||||
{
|
||||
private $id = null;
|
||||
private $userId = null;
|
||||
private $key = null;
|
||||
private $rights = null;
|
||||
private $endDate = null;
|
||||
|
||||
public function __construct($id, $userId, $key, $rights, $endDate)
|
||||
{
|
||||
//! @todo input validation and sanitation
|
||||
$this->id = filter_var($id, FILTER_VALIDATE_INT, ['options' => ['default' => null, 'min_range' => 1]]);
|
||||
$this->userId = filter_var($userId, FILTER_VALIDATE_INT, ['options' => ['default' => null, 'min_range' => 1]]);
|
||||
$this->key = self::isWellFormatted($key) ? $key : null;
|
||||
$this->rights = explode(',', $rights);
|
||||
$this->endDate = DateTime::createFromFormat('Y-m-d', $endDate);
|
||||
|
||||
if ($this->endDate == false) {
|
||||
$this->endDate = null;
|
||||
}
|
||||
}
|
||||
|
||||
public function getUserId()
|
||||
{
|
||||
return $this->userId;
|
||||
}
|
||||
|
||||
/**
|
||||
* testing if the apiKey is valid for a certain action
|
||||
*
|
||||
* @param string $action the action to test the apiKey against
|
||||
* @return boolean true if apiKey is valid for the action, false otherwise
|
||||
*/
|
||||
public function isValidFor(string $action)
|
||||
{
|
||||
// @todo add as validation: does the user exist and is 'active' (?)
|
||||
$today = new DateTime();
|
||||
return (
|
||||
$this->id != null
|
||||
&& in_array($action, $this->rights)
|
||||
&& ($this->endDate->format('Y-m-d') >= $today->format('Y-m-d'))
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* request a specific apiKey from the db
|
||||
*
|
||||
* @param string $key the key to request
|
||||
* @return ApiKey found in the db, null otherwise
|
||||
*/
|
||||
public static function loadFromDb(string $key)
|
||||
{
|
||||
if (!self::isWellFormatted($key)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$query = 'SELECT * FROM `cwsvjudo`.`participo_apiKeys` WHERE apiKey = :key;';
|
||||
$params = [':key' => ['value' => $key, 'data_type' => PDO::PARAM_STR]];
|
||||
$response = dbConnector::query($query, $params);
|
||||
|
||||
// apiKeys are considered unique. so every other count is treated as error to prevent unprivileged access
|
||||
if (count($response) != 1) {
|
||||
return null;
|
||||
}
|
||||
return ApiKey::fromDbArray($response[0]);
|
||||
}
|
||||
|
||||
public function addToDb()
|
||||
{
|
||||
$query = 'INSERT INTO `cwsvjudo`.`participo_apiKeys` (userId, apiKey, rights, endDate) VALUES (:userId, :apiKey, :rights, :endDate);';
|
||||
$params = [
|
||||
':userId' => ['value' => $this->userId, 'data_type' => PDO::PARAM_INT],
|
||||
':apiKey' => ['value' => $this->key, 'data_type' => PDO::PARAM_STR],
|
||||
':rights' => ['value' => implode(',', $this->rights), 'data_type' => PDO::PARAM_STR],
|
||||
':endDate' => ['value' => $this->endDate->format('Y-m-d'), 'data_type' => PDO::PARAM_STR]
|
||||
];
|
||||
$response = dbConnector::query($query, $params);
|
||||
// @todo use the response in an error handling/messaging
|
||||
}
|
||||
|
||||
/** create an Api key from the return of an sql select * */
|
||||
private static function fromDbArray(array $apiKey)
|
||||
{
|
||||
return new ApiKey(
|
||||
$apiKey['id'] ?? null,
|
||||
$apiKey['userId'] ?? null,
|
||||
$apiKey['apiKey'] ?? null,
|
||||
$apiKey['rights'] ?? null,
|
||||
$apiKey['endDate'] ?? null
|
||||
);
|
||||
}
|
||||
|
||||
private static $BASE = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
|
||||
|
||||
/**
|
||||
* quick and dirty implementation of a convert_to_base62
|
||||
* stolen from https://stackoverflow.com/a/4964352
|
||||
*
|
||||
* @param [int] $num
|
||||
* @param integer $b
|
||||
* @return void
|
||||
*/
|
||||
private static function toBase($num, $b = 62) :string
|
||||
{
|
||||
// @todo What is with negative numbers? How are they supposed to be converted?
|
||||
$r = $num % $b ;
|
||||
$res = ApiKey::$BASE[$r];
|
||||
$q = floor($num / $b);
|
||||
while ($q) {
|
||||
$r = $q % $b;
|
||||
$q = floor($q / $b);
|
||||
$res = ApiKey::$BASE[$r] . $res;
|
||||
}
|
||||
return $res;
|
||||
}
|
||||
|
||||
/**
|
||||
* simple check if a string a well formatted apiKey
|
||||
*
|
||||
* Basically checks, if it consists only of 0-9, a-z or A-Z
|
||||
*
|
||||
* @param string $string string to check
|
||||
* @return boolean true if it is base62 encoded, false otherwise
|
||||
*/
|
||||
public static function isWellFormatted(string $string)
|
||||
{
|
||||
return (bool) preg_match('/^[0-9a-zA-Z]+$/', $string);
|
||||
}
|
||||
|
||||
/**
|
||||
* provides a random api key value
|
||||
*
|
||||
* @return string a random api key value
|
||||
*/
|
||||
public static function create()
|
||||
{
|
||||
// @todo What is with negative numbers? How are they supposed to be converted?
|
||||
return ApiKey::toBase(random_int(0, PHP_INT_MAX));
|
||||
}
|
||||
|
||||
private static function createTable()
|
||||
{
|
||||
dbConnector::query("CREATE TABLE `cwsvjudo`.`participo_apiKeys` (`id` INT NOT NULL AUTO_INCREMENT COMMENT 'unique identifier' , `userId` INT NOT NULL COMMENT 'id of the user the key belongs to' , `apiKey` VARCHAR(16) NOT NULL COMMENT 'the apiKey itself' , `rights` INT NOT NULL COMMENT 'a comma separated list of rights for the key' , `endDate` DATE NOT NULL COMMENT 'endDate for the apiKey' , PRIMARY KEY (`id`), UNIQUE (`key`)); ");
|
||||
}
|
||||
}
|
||||
123
homepage/participo/lib/participoLib/dbConnector.php
Normal file
123
homepage/participo/lib/participoLib/dbConnector.php
Normal file
@@ -0,0 +1,123 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* interface for connecting and communicating with a database
|
||||
*/
|
||||
class dbConnector
|
||||
{
|
||||
private static $db = null;
|
||||
|
||||
// connect to the database
|
||||
public static function connect($hostname, $dbName, $user, $password)
|
||||
{
|
||||
return self::setDbConnection(self::connectToPdo($hostname, $dbName, $user, $password));
|
||||
}
|
||||
|
||||
public static function getDbConnection()
|
||||
{
|
||||
return self::$db;
|
||||
}
|
||||
|
||||
/// perform a pdo-query
|
||||
///
|
||||
/// @param $aQueryString
|
||||
/// @param $aBindArray e.g. array(
|
||||
/// ':userId' => array('value'=>$anUserId, 'data_type'=>PDO::PARAM_INT),
|
||||
/// ':attributeId'=> array('value'=>$anAttributeId, 'data_type'=>PDO::PARAM_INT) )
|
||||
/// @param $someOption
|
||||
public static function query($aQueryString, $aBindArray = [], $someOptions = [])
|
||||
{
|
||||
// var_dump($aQueryString, $aBindArray);
|
||||
// Standardbelegungen
|
||||
if (empty($someOptions['dbCharset'])) {
|
||||
$someOptions['dbCharset'] = 'ISO-8859-1';
|
||||
}
|
||||
if (empty($someOptions['outCharset'])) {
|
||||
$someOptions['outCharset'] = 'UTF-8';
|
||||
}
|
||||
if (empty($someOptions['dontFetch'])) {
|
||||
$someOptions['dontFetch'] = false;
|
||||
}
|
||||
|
||||
/// @toDo: Bisher wird nur die Rückgabe konvertiert. Eigentlich muss
|
||||
/// doch auch die Eingabe konvertiert werden. Aber das jetzt
|
||||
/// umzustellen wird schwer! Die User im Wettkampfplaner sind ja z.B.
|
||||
/// als UTF8 in latin1(?) gespeichert.
|
||||
/// @toDo: Die Standardwerte sollten vielleicht aus einer config
|
||||
/// kommen, nicht hardcoded
|
||||
try {
|
||||
$pdoStatement = self::$db->prepare($aQueryString);
|
||||
foreach ($aBindArray as $bindName => $bind) {
|
||||
if ($bind['data_type'] == PDO::PARAM_STR) {
|
||||
$bind['value'] = iconv(
|
||||
$someOptions['outCharset'],
|
||||
$someOptions['dbCharset'],
|
||||
$bind['value']
|
||||
);
|
||||
}
|
||||
$pdoStatement->bindValue(
|
||||
$bindName,
|
||||
$bind['value'],
|
||||
(isset($bind['data_type']) ? $bind['data_type'] : PDO::PARAM_STR)
|
||||
);
|
||||
}
|
||||
$pdoResult = $pdoStatement->execute();
|
||||
if (!$pdoResult) {
|
||||
echo("Error during dbQuery!\n");
|
||||
echo("DB-Error:\n");
|
||||
var_dump(self::$db->errorInfo());
|
||||
}
|
||||
if ($someOptions['dontFetch']) {
|
||||
$ret = null;
|
||||
} else {
|
||||
$ret = $pdoStatement->fetchAll(PDO::FETCH_ASSOC);
|
||||
}
|
||||
} catch(PDOException $db_error) {
|
||||
print 'Error!: ' . $db_error->getMessage() . '<br/>';
|
||||
return null;
|
||||
}
|
||||
|
||||
// Zeichensatzkonvertierung
|
||||
if (is_array($ret)) {
|
||||
foreach ($ret as &$entry) {
|
||||
array_walk(
|
||||
$entry,
|
||||
function (&$value, $key, $someOptions) {
|
||||
$value = iconv($someOptions['dbCharset'], $someOptions['outCharset'], $value);
|
||||
},
|
||||
$someOptions
|
||||
);
|
||||
}
|
||||
}
|
||||
return $ret;
|
||||
}
|
||||
|
||||
// get a Connection to the database
|
||||
private static function connectToPdo($hostname, $dbName, $user, $password)
|
||||
{
|
||||
// var_dump($hostname, $dbName, $user, $password);
|
||||
$dbConnection = null;
|
||||
try {
|
||||
$dbConnection = new PDO(
|
||||
'mysql:host=' . $hostname . ';dbname=' . $dbName,
|
||||
$user,
|
||||
$password
|
||||
);
|
||||
} catch(PDOException $dbError) {
|
||||
echo('Error whilst getting a dbConnection!: ' . $dbError->getMessage());
|
||||
}
|
||||
return $dbConnection;
|
||||
}
|
||||
|
||||
// set the dbConnection (just setting, no establishing)
|
||||
private static function setDbConnection($dbConnection)
|
||||
{
|
||||
$success = false;
|
||||
if ($dbConnection instanceof PDO) {
|
||||
self::$db = $dbConnection;
|
||||
$success = true;
|
||||
} else {
|
||||
self::$db = null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,6 @@
|
||||
<?php
|
||||
|
||||
require_once 'participoLib/dbConnector.php';
|
||||
// require_once("spyc/Spyc.php");
|
||||
|
||||
class participo
|
||||
@@ -43,6 +45,34 @@ class participo
|
||||
public static function authentificate()
|
||||
{
|
||||
session_start();
|
||||
|
||||
// check if an api key was received
|
||||
if (array_key_exists('apiKey', $_GET)) {
|
||||
$key = ApiKey::loadFromDb($_GET['apiKey']);
|
||||
if ($key) {
|
||||
if ($key->isValidFor('login')) {
|
||||
// query *all* users with the entered name
|
||||
// @todo check for e.g., len(user)=1
|
||||
// @todo getUser?
|
||||
$user = dbConnector::query(
|
||||
'SELECT `id`, `loginName`, `config` FROM `wkParticipo_Users` WHERE `id` = :id',
|
||||
['id' => ['value' => $key->getUserId(), 'data_type' => PDO::PARAM_INT]]
|
||||
);
|
||||
$user = $user[0];
|
||||
|
||||
// case valid login: Set the session data
|
||||
$_SESSION = [
|
||||
'login' => true,
|
||||
'user' => [
|
||||
'username' => $user['loginName'],
|
||||
'userId' => $user['id'],
|
||||
'userConfig' => json_decode($user['config'], true)
|
||||
]
|
||||
];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
if (!self::isLoginValid()) {
|
||||
header('Location: login?returnToUrl=' . urlencode($_SERVER['REQUEST_URI'] . ($_POST['fragment'] ?? '')), true, 301);
|
||||
exit(); // should'nt matter
|
||||
@@ -430,126 +460,6 @@ function logLoginsToJsonFile($userName, $fileName = 'lastLogins.json')
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* interface for connecting and communicating with a database
|
||||
*/
|
||||
class dbConnector
|
||||
{
|
||||
private static $db = null;
|
||||
|
||||
// connect to the database
|
||||
public static function connect($hostname, $dbName, $user, $password)
|
||||
{
|
||||
return self::setDbConnection(self::connectToPdo($hostname, $dbName, $user, $password));
|
||||
}
|
||||
|
||||
public static function getDbConnection()
|
||||
{
|
||||
return self::$db;
|
||||
}
|
||||
|
||||
/// perform a pdo-query
|
||||
///
|
||||
/// @param $aQueryString
|
||||
/// @param $aBindArray e.g. array(
|
||||
/// ':userId' => array('value'=>$anUserId, 'data_type'=>PDO::PARAM_INT),
|
||||
/// ':attributeId'=> array('value'=>$anAttributeId, 'data_type'=>PDO::PARAM_INT) )
|
||||
/// @param $someOption
|
||||
public static function query($aQueryString, $aBindArray = [], $someOptions = [])
|
||||
{
|
||||
// Standardbelegungen
|
||||
if (empty($someOptions['dbCharset'])) {
|
||||
$someOptions['dbCharset'] = 'ISO-8859-1';
|
||||
}
|
||||
if (empty($someOptions['outCharset'])) {
|
||||
$someOptions['outCharset'] = 'UTF-8';
|
||||
}
|
||||
if (empty($someOptions['dontFetch'])) {
|
||||
$someOptions['dontFetch'] = false;
|
||||
}
|
||||
|
||||
/// @toDo: Bisher wird nur die Rückgabe konvertiert. Eigentlich muss
|
||||
/// doch auch die Eingabe konvertiert werden. Aber das jetzt
|
||||
/// umzustellen wird schwer! Die User im Wettkampfplaner sind ja z.B.
|
||||
/// als UTF8 in latin1(?) gespeichert.
|
||||
/// @toDo: Die Standardwerte sollten vielleicht aus einer config
|
||||
/// kommen, nicht hardcoded
|
||||
try {
|
||||
$pdoStatement = self::$db->prepare($aQueryString);
|
||||
foreach ($aBindArray as $bindName => $bind) {
|
||||
if ($bind['data_type'] == PDO::PARAM_STR) {
|
||||
$bind['value'] = iconv(
|
||||
$someOptions['outCharset'],
|
||||
$someOptions['dbCharset'],
|
||||
$bind['value']
|
||||
);
|
||||
}
|
||||
$pdoStatement->bindValue(
|
||||
$bindName,
|
||||
$bind['value'],
|
||||
(isset($bind['data_type']) ? $bind['data_type'] : PDO::PARAM_STR)
|
||||
);
|
||||
}
|
||||
$pdoResult = $pdoStatement->execute();
|
||||
if (!$pdoResult) {
|
||||
echo("Error during dbQuery!\n");
|
||||
echo("DB-Error:\n");
|
||||
var_dump(self::$db->errorInfo());
|
||||
}
|
||||
if ($someOptions['dontFetch']) {
|
||||
$ret = null;
|
||||
} else {
|
||||
$ret = $pdoStatement->fetchAll(PDO::FETCH_ASSOC);
|
||||
}
|
||||
} catch(PDOException $db_error) {
|
||||
print 'Error!: ' . $db_error->getMessage() . '<br/>';
|
||||
return null;
|
||||
}
|
||||
|
||||
// Zeichensatzkonvertierung
|
||||
if (is_array($ret)) {
|
||||
foreach ($ret as &$entry) {
|
||||
array_walk(
|
||||
$entry,
|
||||
function (&$value, $key, $someOptions) {
|
||||
$value = iconv($someOptions['dbCharset'], $someOptions['outCharset'], $value);
|
||||
},
|
||||
$someOptions
|
||||
);
|
||||
}
|
||||
}
|
||||
return $ret;
|
||||
}
|
||||
|
||||
// get a Connection to the database
|
||||
private static function connectToPdo($hostname, $dbName, $user, $password)
|
||||
{
|
||||
$dbConnection = null;
|
||||
try {
|
||||
$dbConnection = new PDO(
|
||||
'mysql:host=' . $hostname . ';dbname=' . $dbName,
|
||||
$user,
|
||||
$password
|
||||
);
|
||||
} catch(PDOException $dbError) {
|
||||
echo('Error whilst getting a dbConnection!: ' . $dbError->getMessage());
|
||||
}
|
||||
return $dbConnection;
|
||||
}
|
||||
|
||||
// set the dbConnection (just setting, no establishing)
|
||||
private static function setDbConnection($dbConnection)
|
||||
{
|
||||
$success = false;
|
||||
if ($dbConnection instanceof PDO) {
|
||||
self::$db = $dbConnection;
|
||||
$success = true;
|
||||
} else {
|
||||
self::$db = null;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* User for the Participo system
|
||||
*/
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
<?php
|
||||
require_once 'participoLib/apiKey.php';
|
||||
|
||||
/**
|
||||
* frame for a shiai
|
||||
|
||||
Reference in New Issue
Block a user