2021-07-17 18:45:00 +02:00
|
|
|
<?php
|
|
|
|
|
2023-05-17 18:56:55 +02:00
|
|
|
namespace BookStack\Access;
|
2021-07-17 18:45:00 +02:00
|
|
|
|
2023-05-17 18:56:55 +02:00
|
|
|
use BookStack\Access\Mfa\MfaSession;
|
|
|
|
use BookStack\Activity\ActivityType;
|
2022-09-22 17:54:27 +02:00
|
|
|
use BookStack\Exceptions\LoginAttemptException;
|
2021-07-18 17:52:31 +02:00
|
|
|
use BookStack\Exceptions\StoppedAuthenticationException;
|
2021-07-17 18:45:00 +02:00
|
|
|
use BookStack\Facades\Activity;
|
|
|
|
use BookStack\Facades\Theme;
|
|
|
|
use BookStack\Theming\ThemeEvents;
|
2023-05-17 18:56:55 +02:00
|
|
|
use BookStack\Users\Models\User;
|
2021-07-18 17:52:31 +02:00
|
|
|
use Exception;
|
2021-07-17 18:45:00 +02:00
|
|
|
|
|
|
|
class LoginService
|
|
|
|
{
|
2021-07-18 17:52:31 +02:00
|
|
|
protected const LAST_LOGIN_ATTEMPTED_SESSION_KEY = 'auth-login-last-attempted';
|
|
|
|
|
2023-12-06 14:49:53 +01:00
|
|
|
public function __construct(
|
|
|
|
protected MfaSession $mfaSession,
|
|
|
|
protected EmailConfirmationService $emailConfirmationService,
|
|
|
|
protected SocialDriverManager $socialDriverManager,
|
|
|
|
) {
|
2021-07-17 19:24:50 +02:00
|
|
|
}
|
|
|
|
|
2021-07-17 18:45:00 +02:00
|
|
|
/**
|
|
|
|
* Log the given user into the system.
|
2021-07-17 19:24:50 +02:00
|
|
|
* Will start a login of the given user but will prevent if there's
|
|
|
|
* a reason to (MFA or Unconfirmed Email).
|
|
|
|
* Returns a boolean to indicate the current login result.
|
2021-08-21 16:49:40 +02:00
|
|
|
*
|
2021-07-18 17:52:31 +02:00
|
|
|
* @throws StoppedAuthenticationException
|
2021-07-17 18:45:00 +02:00
|
|
|
*/
|
2021-08-07 23:32:19 +02:00
|
|
|
public function login(User $user, string $method, bool $remember = false): void
|
2021-07-17 18:45:00 +02:00
|
|
|
{
|
2021-07-17 19:24:50 +02:00
|
|
|
if ($this->awaitingEmailConfirmation($user) || $this->needsMfaVerification($user)) {
|
2021-08-07 23:32:19 +02:00
|
|
|
$this->setLastLoginAttemptedForUser($user, $method, $remember);
|
2021-08-21 16:49:40 +02:00
|
|
|
|
2021-07-18 17:52:31 +02:00
|
|
|
throw new StoppedAuthenticationException($user, $this);
|
2021-07-17 19:24:50 +02:00
|
|
|
}
|
|
|
|
|
2021-07-18 17:52:31 +02:00
|
|
|
$this->clearLastLoginAttempted();
|
2021-08-07 23:32:19 +02:00
|
|
|
auth()->login($user, $remember);
|
2021-07-17 18:45:00 +02:00
|
|
|
Activity::add(ActivityType::AUTH_LOGIN, "{$method}; {$user->logDescriptor()}");
|
|
|
|
Theme::dispatch(ThemeEvents::AUTH_LOGIN, $method, $user);
|
|
|
|
|
|
|
|
// Authenticate on all session guards if a likely admin
|
|
|
|
if ($user->can('users-manage') && $user->can('user-roles-manage')) {
|
2021-10-11 20:05:16 +02:00
|
|
|
$guards = ['standard', 'ldap', 'saml2', 'oidc'];
|
2021-07-17 18:45:00 +02:00
|
|
|
foreach ($guards as $guard) {
|
|
|
|
auth($guard)->login($user);
|
|
|
|
}
|
|
|
|
}
|
2021-07-18 17:52:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Reattempt a system login after a previous stopped attempt.
|
2021-08-21 16:49:40 +02:00
|
|
|
*
|
2021-07-18 17:52:31 +02:00
|
|
|
* @throws Exception
|
|
|
|
*/
|
2021-08-02 23:02:25 +02:00
|
|
|
public function reattemptLoginFor(User $user)
|
2021-07-18 17:52:31 +02:00
|
|
|
{
|
2021-08-02 16:04:43 +02:00
|
|
|
if ($user->id !== ($this->getLastLoginAttemptUser()->id ?? null)) {
|
2021-07-18 17:52:31 +02:00
|
|
|
throw new Exception('Login reattempt user does align with current session state');
|
|
|
|
}
|
2021-07-17 19:24:50 +02:00
|
|
|
|
2021-08-07 23:32:19 +02:00
|
|
|
$lastLoginDetails = $this->getLastLoginAttemptDetails();
|
|
|
|
$this->login($user, $lastLoginDetails['method'], $lastLoginDetails['remember'] ?? false);
|
2021-07-18 17:52:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get the last user that was attempted to be logged in.
|
|
|
|
* Only exists if the last login attempt had correct credentials
|
|
|
|
* but had been prevented by a secondary factor.
|
|
|
|
*/
|
|
|
|
public function getLastLoginAttemptUser(): ?User
|
|
|
|
{
|
2021-08-02 23:02:25 +02:00
|
|
|
$id = $this->getLastLoginAttemptDetails()['user_id'];
|
2021-08-21 16:49:40 +02:00
|
|
|
|
2021-08-02 23:02:25 +02:00
|
|
|
return User::query()->where('id', '=', $id)->first();
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get the details of the last login attempt.
|
|
|
|
* Checks upon a ttl of about 1 hour since that last attempted login.
|
2021-08-21 16:49:40 +02:00
|
|
|
*
|
2021-08-07 23:32:19 +02:00
|
|
|
* @return array{user_id: ?string, method: ?string, remember: bool}
|
2021-08-02 23:02:25 +02:00
|
|
|
*/
|
|
|
|
protected function getLastLoginAttemptDetails(): array
|
|
|
|
{
|
|
|
|
$value = session()->get(self::LAST_LOGIN_ATTEMPTED_SESSION_KEY);
|
|
|
|
if (!$value) {
|
|
|
|
return ['user_id' => null, 'method' => null];
|
2021-07-18 17:52:31 +02:00
|
|
|
}
|
|
|
|
|
2021-08-07 23:32:19 +02:00
|
|
|
[$id, $method, $remember, $time] = explode(':', $value);
|
2021-08-21 16:49:40 +02:00
|
|
|
$hourAgo = time() - (60 * 60);
|
2021-08-02 23:02:25 +02:00
|
|
|
if ($time < $hourAgo) {
|
|
|
|
$this->clearLastLoginAttempted();
|
2021-08-21 16:49:40 +02:00
|
|
|
|
2021-08-02 23:02:25 +02:00
|
|
|
return ['user_id' => null, 'method' => null];
|
|
|
|
}
|
|
|
|
|
2021-08-07 23:32:19 +02:00
|
|
|
return ['user_id' => $id, 'method' => $method, 'remember' => boolval($remember)];
|
2021-07-18 17:52:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Set the last login attempted user.
|
|
|
|
* Must be only used when credentials are correct and a login could be
|
|
|
|
* achieved but a secondary factor has stopped the login.
|
|
|
|
*/
|
2021-08-07 23:32:19 +02:00
|
|
|
protected function setLastLoginAttemptedForUser(User $user, string $method, bool $remember)
|
2021-07-18 17:52:31 +02:00
|
|
|
{
|
2021-08-02 23:02:25 +02:00
|
|
|
session()->put(
|
|
|
|
self::LAST_LOGIN_ATTEMPTED_SESSION_KEY,
|
2021-08-07 23:32:19 +02:00
|
|
|
implode(':', [$user->id, $method, $remember, time()])
|
2021-08-02 23:02:25 +02:00
|
|
|
);
|
2021-07-18 17:52:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Clear the last login attempted session value.
|
|
|
|
*/
|
|
|
|
protected function clearLastLoginAttempted(): void
|
|
|
|
{
|
|
|
|
session()->remove(self::LAST_LOGIN_ATTEMPTED_SESSION_KEY);
|
2021-07-17 18:45:00 +02:00
|
|
|
}
|
|
|
|
|
2021-07-17 19:24:50 +02:00
|
|
|
/**
|
|
|
|
* Check if MFA verification is needed.
|
|
|
|
*/
|
2021-07-18 17:52:31 +02:00
|
|
|
public function needsMfaVerification(User $user): bool
|
2021-07-17 19:24:50 +02:00
|
|
|
{
|
|
|
|
return !$this->mfaSession->isVerifiedForUser($user) && $this->mfaSession->isRequiredForUser($user);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Check if the given user is awaiting email confirmation.
|
|
|
|
*/
|
2021-07-18 17:52:31 +02:00
|
|
|
public function awaitingEmailConfirmation(User $user): bool
|
2021-07-17 19:24:50 +02:00
|
|
|
{
|
2021-08-07 22:18:59 +02:00
|
|
|
return $this->emailConfirmationService->confirmationRequired() && !$user->email_confirmed;
|
2021-07-17 19:24:50 +02:00
|
|
|
}
|
2021-07-17 18:45:00 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Attempt the login of a user using the given credentials.
|
2021-07-17 19:24:50 +02:00
|
|
|
* Meant to mirror Laravel's default guard 'attempt' method
|
2021-07-17 18:45:00 +02:00
|
|
|
* but in a manner that always routes through our login system.
|
2021-07-18 17:52:31 +02:00
|
|
|
* May interrupt the flow if extra authentication requirements are imposed.
|
|
|
|
*
|
|
|
|
* @throws StoppedAuthenticationException
|
2022-09-22 17:54:27 +02:00
|
|
|
* @throws LoginAttemptException
|
2021-07-17 18:45:00 +02:00
|
|
|
*/
|
|
|
|
public function attempt(array $credentials, string $method, bool $remember = false): bool
|
|
|
|
{
|
|
|
|
$result = auth()->attempt($credentials, $remember);
|
|
|
|
if ($result) {
|
|
|
|
$user = auth()->user();
|
|
|
|
auth()->logout();
|
2021-08-07 23:32:19 +02:00
|
|
|
$this->login($user, $method, $remember);
|
2021-07-17 18:45:00 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return $result;
|
|
|
|
}
|
2023-12-06 14:49:53 +01:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Logs the current user out of the application.
|
|
|
|
* Returns an app post-redirect path.
|
|
|
|
*/
|
|
|
|
public function logout(): string
|
|
|
|
{
|
|
|
|
auth()->logout();
|
|
|
|
session()->invalidate();
|
|
|
|
session()->regenerateToken();
|
|
|
|
|
|
|
|
return $this->shouldAutoInitiate() ? '/login?prevent_auto_init=true' : '/';
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Check if login auto-initiate should be valid based upon authentication config.
|
|
|
|
*/
|
|
|
|
protected function shouldAutoInitiate(): bool
|
|
|
|
{
|
|
|
|
$socialDrivers = $this->socialDriverManager->getActive();
|
|
|
|
$authMethod = config('auth.method');
|
|
|
|
$autoRedirect = config('auth.auto_initiate');
|
|
|
|
|
|
|
|
return $autoRedirect && count($socialDrivers) === 0 && in_array($authMethod, ['oidc', 'saml2']);
|
|
|
|
}
|
2021-08-21 16:49:40 +02:00
|
|
|
}
|