includes/auth/ConfirmLinkSecondaryAuthenticationProvider.php

   1 <?php
   2
   3 namespace MediaWiki\Auth;
   4
   5 use StatusValue;
   6 use User;
   7
   8 /**
   9  * Links third-party authentication to the user's account
  10  *
  11  * If the user logged into linking provider accounts that aren't linked to a
  12  * local user, this provider will prompt the user to link them after a
  13  * successful login or account creation.
  14  *
  15  * To avoid confusing behavior, this provider should be later in the
  16  * configuration list than any provider that can abort the authentication
  17  * process, so that it is only invoked for successful authentication.
  18  */
  19 class ConfirmLinkSecondaryAuthenticationProvider extends AbstractSecondaryAuthenticationProvider {
  20
  21         public function getAuthenticationRequests( $action, array $options ) {
  22                 return [];
  23         }
  24
  25         public function beginSecondaryAuthentication( $user, array $reqs ) {
  26                 return $this->beginLinkAttempt( $user, 'AuthManager::authnState' );
  27         }
  28
  29         public function continueSecondaryAuthentication( $user, array $reqs ) {
  30                 return $this->continueLinkAttempt( $user, 'AuthManager::authnState', $reqs );
  31         }
  32
  33         public function beginSecondaryAccountCreation( $user, $creator, array $reqs ) {
  34                 return $this->beginLinkAttempt( $user, 'AuthManager::accountCreationState' );
  35         }
  36
  37         public function continueSecondaryAccountCreation( $user, $creator, array $reqs ) {
  38                 return $this->continueLinkAttempt( $user, 'AuthManager::accountCreationState', $reqs );
  39         }
  40
  41         /**
  42          * Begin the link attempt
  43          * @param User $user
  44          * @param string $key Session key to look in
  45          * @return AuthenticationResponse
  46          */
  47         protected function beginLinkAttempt( $user, $key ) {
  48                 $session = $this->manager->getRequest()->getSession();
  49                 $state = $session->getSecret( $key );
  50                 if ( !is_array( $state ) ) {
  51                         return AuthenticationResponse::newAbstain();
  52                 }
  53                 $maybeLink = $state['maybeLink'];
  54                 if ( !$maybeLink ) {
  55                         return AuthenticationResponse::newAbstain();
  56                 }
  57
  58                 $req = new ConfirmLinkAuthenticationRequest( $maybeLink );
  59                 return AuthenticationResponse::newUI(
  60                         [ $req ],
  61                         wfMessage( 'authprovider-confirmlink-message' )
  62                 );
  63         }
  64
  65         /**
  66          * Continue the link attempt
  67          * @param User $user
  68          * @param string $key Session key to look in
  69          * @param AuthenticationRequest[] $reqs
  70          * @return AuthenticationResponse
  71          */
  72         protected function continueLinkAttempt( $user, $key, array $reqs ) {
  73                 $req = ButtonAuthenticationRequest::getRequestByName( $reqs, 'linkOk' );
  74                 if ( $req ) {
  75                         return AuthenticationResponse::newPass();
  76                 }
  77
  78                 $req = AuthenticationRequest::getRequestByClass( $reqs, ConfirmLinkAuthenticationRequest::class );
  79                 if ( !$req ) {
  80                         // WTF? Retry.
  81                         return $this->beginLinkAttempt( $user, $key );
  82                 }
  83
  84                 $session = $this->manager->getRequest()->getSession();
  85                 $state = $session->getSecret( $key );
  86                 if ( !is_array( $state ) ) {
  87                         return AuthenticationResponse::newAbstain();
  88                 }
  89
  90                 $maybeLink = [];
  91                 foreach ( $state['maybeLink'] as $linkReq ) {
  92                         $maybeLink[$linkReq->getUniqueId()] = $linkReq;
  93                 }
  94                 if ( !$maybeLink ) {
  95                         return AuthenticationResponse::newAbstain();
  96                 }
  97
  98                 $state['maybeLink'] = [];
  99                 $session->setSecret( $key, $state );
 100
 101                 $statuses = [];
 102                 $anyFailed = false;
 103                 foreach ( $req->confirmedLinkIDs as $id ) {
 104                         if ( isset( $maybeLink[$id] ) ) {
 105                                 $req = $maybeLink[$id];
 106                                 $req->username = $user->getName();
 107                                 if ( !$req->action ) {
 108                                         // Make sure the action is set, but don't override it if
 109                                         // the provider filled it in.
 110                                         $req->action = AuthManager::ACTION_CHANGE;
 111                                 }
 112                                 $status = $this->manager->allowsAuthenticationDataChange( $req );
 113                                 $statuses[] = [ $req, $status ];
 114                                 if ( $status->isGood() ) {
 115                                         $this->manager->changeAuthenticationData( $req );
 116                                 } else {
 117                                         $anyFailed = true;
 118                                 }
 119                         }
 120                 }
 121                 if ( !$anyFailed ) {
 122                         return AuthenticationResponse::newPass();
 123                 }
 124
 125                 $combinedStatus = \Status::newGood();
 126                 foreach ( $statuses as $data ) {
 127                         list( $req, $status ) = $data;
 128                         $descriptionInfo = $req->describeCredentials();
 129                         $description = wfMessage(
 130                                 'authprovider-confirmlink-option',
 131                                 $descriptionInfo['provider']->text(), $descriptionInfo['account']->text()
 132                         )->text();
 133                         if ( $status->isGood() ) {
 134                                 $combinedStatus->error( wfMessage( 'authprovider-confirmlink-success-line', $description ) );
 135                         } else {
 136                                 $combinedStatus->error( wfMessage(
 137                                         'authprovider-confirmlink-failed-line', $description, $status->getMessage()->text()
 138                                 ) );
 139                         }
 140                 }
 141                 return AuthenticationResponse::newUI(
 142                         [
 143                                 new ButtonAuthenticationRequest(
 144                                         'linkOk', wfMessage( 'ok' ), wfMessage( 'authprovider-confirmlink-ok-help' )
 145                                 )
 146                         ],
 147                         $combinedStatus->getMessage( 'authprovider-confirmlink-failed' )
 148                 );
 149         }
 150 }