jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Next major version 2 with PHP 8.1, Symfony 6, Tabler UI, 2FA ... (#2902)

Browse Source
This commit is contained in:
Kevin Papst
2022-12-31 21:19:55 +01:00
committed by GitHub
parent 95e06746bd
commit 90a0fd8a22
2164 changed files with 83700 additions and 86426 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Security/AccessDeniedException.php
View File

@@ -11,6 +11,6 @@ namespace App\Security;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
class AccessDeniedException extends AccessDeniedHttpException
final class AccessDeniedException extends AccessDeniedHttpException
{
}

12
src/Security/AclDecisionManager.php
View File

@@ -12,23 +12,17 @@ namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
class AclDecisionManager
final class AclDecisionManager
{
/**
* @var AccessDecisionManagerInterface
*/
private $decisionManager;
public function __construct(AccessDecisionManagerInterface $decisionManager)
public function __construct(private AccessDecisionManagerInterface $decisionManager)
{
$this->decisionManager = $decisionManager;
}
/**
* @param TokenInterface $token
* @return bool
*/
public function isFullyAuthenticated(TokenInterface $token)
public function isFullyAuthenticated(TokenInterface $token): bool
{
if ($this->decisionManager->decide($token, ['IS_AUTHENTICATED_FULLY'])) {
return true;

120
src/Security/ApiAuthenticator.php
View File

@@ -1,120 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Security;
use App\Entity\User;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
class ApiAuthenticator extends AbstractGuardAuthenticator
{
public const HEADER_JAVASCRIPT = 'X-AUTH-SESSION';
private $authenticator;
public function __construct(TokenAuthenticator $authenticator)
{
$this->authenticator = $authenticator;
}
/**
* @param Request $request
* @return bool
*/
public function supports(Request $request)
{
// API docs can only be access, when the user is logged in
if (strpos($request->getRequestUri(), '/api/doc') !== false) {
return false;
}
// only try to use this authenticator, when the URL contains the /api/ path
if (strpos($request->getRequestUri(), '/api/') !== false) {
// javascript requests can set a header to disable this authenticator and use the existing session
return !$request->headers->has(self::HEADER_JAVASCRIPT);
}
return false;
}
/**
* @param Request $request
* @return array|bool
*/
public function getCredentials(Request $request)
{
return $this->authenticator->getCredentials($request);
}
/**
* @param array $credentials
* @param UserProviderInterface $userProvider
* @return null|UserInterface
*/
public function getUser($credentials, UserProviderInterface $userProvider)
{
return $this->authenticator->getUser($credentials, $userProvider);
}
/**
* @param array $credentials
* @param UserInterface $user
* @return bool
*/
public function checkCredentials($credentials, UserInterface $user)
{
return $this->authenticator->checkCredentials($credentials, $user);
}
/**
* @param Request $request
* @param TokenInterface $token
* @param string $providerKey
* @return null|Response
*/
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
{
return $this->authenticator->onAuthenticationSuccess($request, $token, $providerKey);
}
/**
* @param Request $request
* @param AuthenticationException $exception
* @return null|JsonResponse|Response
*/
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
{
return $this->authenticator->onAuthenticationFailure($request, $exception);
}
/**
* @param Request $request
* @param AuthenticationException|null $authException
* @return JsonResponse|Response
*/
public function start(Request $request, AuthenticationException $authException = null)
{
return $this->authenticator->start($request, $authException);
}
/**
* @return bool
*/
public function supportsRememberMe()
{
return false;
}
}

29
src/Security/ApiRequestMatcher.php
View File

@@ -1,29 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Security;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\RequestMatcherInterface;
class ApiRequestMatcher implements RequestMatcherInterface
{
public function matches(Request $request): bool
{
if (strpos($request->getRequestUri(), '/api/doc') !== false) {
return false;
}
if (!preg_match('{^/api/}', rawurldecode($request->getPathInfo()))) {
return false;
}
return $request->headers->has(TokenAuthenticator::HEADER_USERNAME) && $request->headers->has(TokenAuthenticator::HEADER_TOKEN);
}
}

57
src/Security/CurrentUser.php
View File

@@ -1,57 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Security;
use App\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
/**
* @deprecated will be removed with 2.0
*/
final class CurrentUser
{
/**
* @var TokenStorageInterface
*/
private $storage;
/**
* @var User|null
*/
private $user;
public function __construct(TokenStorageInterface $storage)
{
$this->storage = $storage;
}
public function getUser(): ?User
{
if (null !== $this->user) {
return $this->user;
}
if (null === $this->storage->getToken()) {
return null;
}
/** @var User $user */
$user = $this->storage->getToken()->getUser();
if (!($user instanceof User)) {
return null;
}
@trigger_error('CurrentUser is deprecated and will be removed with 2.0, use DI or at worst Symfony\Component\Security\Core\Security instead', E_USER_DEPRECATED);
$this->user = $user;
return $this->user;
}
}

90
src/Security/DoctrineUserProvider.php
View File

@@ -1,90 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Security;
use App\Entity\User;
use App\Repository\UserRepository;
use Exception;
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
final class DoctrineUserProvider implements UserProviderInterface, PasswordUpgraderInterface
{
/**
* @var UserRepository
*/
private $repository;
public function __construct(UserRepository $repository)
{
$this->repository = $repository;
}
/**
* {@inheritdoc}
*/
public function loadUserByUsername($username)
{
$user = null;
try {
/** @var User|null $user */
$user = $this->repository->loadUserByUsername($username);
} catch (\Exception $ex) {
}
if (null === $user) {
throw new UsernameNotFoundException(sprintf('User "%s" not found.', $username));
}
return $user;
}
/**
* {@inheritdoc}
*/
public function refreshUser(UserInterface $user)
{
if (!$user instanceof User) {
throw new UnsupportedUserException(sprintf('Expected an instance of %s, but got "%s".', User::class, \get_class($user)));
}
/** @var User|null $reloadedUser */
$reloadedUser = $this->repository->getUserById($user->getId());
if (null === $reloadedUser) {
throw new UsernameNotFoundException(sprintf('User with ID "%s" could not be reloaded.', $user->getId()));
}
return $reloadedUser;
}
/**
* {@inheritdoc}
*/
public function supportsClass($class)
{
return $class === User::class;
}
public function upgradePassword(UserInterface $user, string $newEncodedPassword): void
{
if ($user instanceof User) {
try {
$user->setPassword($newEncodedPassword);
$this->repository->saveUser($user);
} catch (Exception $e) {
}
}
}
}

43
src/Security/KimaiUserProvider.php
View File

@@ -12,23 +12,20 @@ namespace App\Security;
use App\Configuration\SystemConfiguration;
use App\Ldap\LdapUserProvider;
use Symfony\Component\Security\Core\User\ChainUserProvider;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
class KimaiUserProvider implements UserProviderInterface, PasswordUpgraderInterface
final class KimaiUserProvider implements UserProviderInterface, PasswordUpgraderInterface
{
private $providers;
private $provider;
private $configuration;
private ?ChainUserProvider $provider = null;
/**
* @param iterable|UserProviderInterface[] $providers
*/
public function __construct(iterable $providers, SystemConfiguration $configuration)
public function __construct(private iterable $providers, private SystemConfiguration $configuration)
{
$this->providers = $providers;
$this->configuration = $configuration;
}
private function getInternalProvider(): ChainUserProvider
@@ -37,6 +34,9 @@ class KimaiUserProvider implements UserProviderInterface, PasswordUpgraderInterf
$activated = [];
foreach ($this->providers as $provider) {
if ($provider instanceof LdapUserProvider) {
if (!class_exists('Laminas\Ldap\Ldap')) {
continue;
}
if (!$this->configuration->isLdapActive()) {
continue;
}
@@ -49,43 +49,28 @@ class KimaiUserProvider implements UserProviderInterface, PasswordUpgraderInterf
return $this->provider;
}
/**
* @return array
*/
public function getProviders()
public function getProviders(): array
{
return $this->getInternalProvider()->getProviders();
}
/**
* {@inheritdoc}
*/
public function loadUserByUsername($username)
public function loadUserByIdentifier(string $identifier): UserInterface
{
return $this->getInternalProvider()->loadUserByUsername($username);
return $this->getInternalProvider()->loadUserByIdentifier($identifier);
}
/**
* {@inheritdoc}
*/
public function refreshUser(UserInterface $user)
public function refreshUser(UserInterface $user): UserInterface
{
return $this->getInternalProvider()->refreshUser($user);
}
/**
* {@inheritdoc}
*/
public function supportsClass($class)
public function supportsClass(string $class): bool
{
return $this->getInternalProvider()->supportsClass($class);
}
/**
* {@inheritdoc}
*/
public function upgradePassword(UserInterface $user, string $newEncodedPassword): void
public function upgradePassword(PasswordAuthenticatedUserInterface $user, string $newHashedPassword): void
{
$this->getInternalProvider()->upgradePassword($user, $newEncodedPassword);
$this->getInternalProvider()->upgradePassword($user, $newHashedPassword);
}
}

80
src/Security/RolePermissionManager.php
View File

@@ -17,40 +17,38 @@ final class RolePermissionManager
/**
* Permissions that are always true for ROLE_SUPER_ADMIN, no matter what is inside the database.
*
* @var string[]
* @var array<string, bool>
* @internal
*/
public const SUPER_ADMIN_PERMISSIONS = [
'view_all_data',
'role_permissions',
'view_user'
'view_all_data' => true,
'role_permissions' => true,
'view_user' => true,
];
/**
* @var array
*/
private $permissions = [];
/**
* @var string[]
*/
private $knownPermissions = [];
private bool $isInitialized = false;
public function __construct(RolePermissionRepository $repository, array $permissions)
/**
* @param RolePermissionRepository $repository
* @param array<string, array<string, bool>> $permissions as defined in kimai.yaml
* @param array<string, bool> $permissionNames as defined in kimai.yaml
*/
public function __construct(private RolePermissionRepository $repository, private array $permissions, private array $permissionNames)
{
$this->permissions = $permissions;
}
foreach ($permissions as $role => $perms) {
$this->knownPermissions = array_merge($this->knownPermissions, $perms);
private function init(): void
{
if ($this->isInitialized) {
return;
}
$this->knownPermissions = array_unique($this->knownPermissions);
$all = $repository->getAllAsArray();
foreach ($all as $item) {
$perm = $item['permission'];
$role = strtoupper($item['role']);
$isAllowed = (bool) $item['allowed'];
foreach ($this->repository->getAllAsArray() as $item) {
$perm = (string) $item['permission'];
$role = (string) $item['role'];
// these permissions may not be revoked at any time, because super admin would loose the ability to reactivate any permission
if ($role === User::ROLE_SUPER_ADMIN && \in_array($perm, self::SUPER_ADMIN_PERMISSIONS)) {
// these permissions may not be revoked at any time, because super admin would lose the ability to reactivate any permission
if ($role === User::ROLE_SUPER_ADMIN && \array_key_exists($perm, self::SUPER_ADMIN_PERMISSIONS)) {
continue;
}
@@ -58,14 +56,14 @@ final class RolePermissionManager
$this->permissions[$role] = [];
}
if (false === $isAllowed) {
if (($key = array_search($perm, $this->permissions[$role])) !== false) {
unset($this->permissions[$role][$key]);
}
} else {
$this->permissions[$role][] = $perm;
}
$this->permissions[$role][$perm] = (bool) $item['allowed'];
}
foreach (self::SUPER_ADMIN_PERMISSIONS as $perm => $value) {
$this->permissions[User::ROLE_SUPER_ADMIN][$perm] = $value;
}
$this->isInitialized = true;
}
/**
@@ -76,22 +74,28 @@ final class RolePermissionManager
*/
public function isRegisteredPermission(string $permission): bool
{
return \in_array($permission, $this->knownPermissions);
$this->init();
return \array_key_exists($permission, $this->permissionNames);
}
public function hasPermission(string $role, string $permission): bool
{
$this->init();
$role = strtoupper($role);
if (!isset($this->permissions[$role])) {
if (!\array_key_exists($role, $this->permissions)) {
return false;
}
return \in_array($permission, $this->permissions[$role]);
return \array_key_exists($permission, $this->permissions[$role]) ? $this->permissions[$role][$permission] : false;
}
public function hasRolePermission(User $user, string $permission)
public function hasRolePermission(User $user, string $permission): bool
{
$this->init();
foreach ($user->getRoles() as $role) {
if ($this->hasPermission($role, $permission)) {
return true;
@@ -104,10 +108,12 @@ final class RolePermissionManager
/**
* Only permissions which were registered through the Symfony configuration stack will be returned here.
*
* @return array
* @return array<string>
*/
public function getPermissions(): array
{
return $this->knownPermissions;
$this->init();
return array_keys($this->permissionNames);
}
}

62
src/Security/RoleService.php
View File

@@ -9,55 +9,43 @@
namespace App\Security;
use App\Entity\Role;
use App\Repository\RoleRepository;
final class RoleService
{
/**
* @var array
* @var array<string>
*/
private $roles;
/**
* @var string[]
*/
private $roleNames = [];
/**
* @var RoleRepository
*/
private $repository;
private array $roleNames = [];
private bool $isInitialized = false;
public function __construct(RoleRepository $repository, array $roles)
/**
* @param RoleRepository $repository
* @param array<string> $roles as defined in security.yaml
*/
public function __construct(private RoleRepository $repository, private array $roles)
{
$this->repository = $repository;
$this->roles = $roles;
}
private function cacheNames()
{
if (empty($this->roleNames)) {
$roles = [];
foreach ($this->roles as $key => $value) {
$roles[] = $key;
if (\is_array($value)) {
foreach ($value as $name) {
$roles[] = $name;
}
}
}
/** @var Role $item */
foreach ($this->repository->findAll() as $item) {
$roles[] = $item->getName();
}
$this->roleNames = array_values(array_unique($roles));
}
}
/**
* Returns a list of UPPERCASE role names.
*
* @return string[]
*/
public function getAvailableNames(): array
{
$this->cacheNames();
if (!$this->isInitialized) {
$roles = [];
foreach ($this->repository->findAll() as $item) {
if ($item->getName() === null) {
continue;
}
$roles[] = strtoupper($item->getName());
}
$this->roleNames = array_values(array_unique(array_merge($this->roles, $roles)));
$this->isInitialized = true;
}
return $this->roleNames;
}

16
src/Security/SessionHandler.php
View File

@@ -9,26 +9,20 @@
namespace App\Security;
use Doctrine\DBAL\Driver\PDOConnection;
use Doctrine\DBAL\Connection;
use Symfony\Component\HttpFoundation\Session\Storage\Handler\PdoSessionHandler;
class SessionHandler extends PdoSessionHandler
final class SessionHandler extends PdoSessionHandler
{
public function __construct($pdoOrDsn = null)
public function __construct(Connection $connection)
{
$lockMode = PdoSessionHandler::LOCK_NONE;
if ($pdoOrDsn instanceof PDOConnection && $pdoOrDsn->getAttribute(\PDO::ATTR_DRIVER_NAME) === 'mysql') {
$lockMode = PdoSessionHandler::LOCK_ADVISORY;
}
parent::__construct($pdoOrDsn, [
parent::__construct($connection->getNativeConnection(), [
'db_table' => 'kimai2_sessions',
'db_id_col' => 'id',
'db_data_col' => 'data',
'db_lifetime_col' => 'lifetime',
'db_time_col' => 'time',
'lock_mode' => $lockMode,
'lock_mode' => PdoSessionHandler::LOCK_ADVISORY,
]);
}
}

159
src/Security/TokenAuthenticator.php
View File

@@ -1,159 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Security;
use App\Entity\User;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
class TokenAuthenticator extends AbstractGuardAuthenticator
{
public const HEADER_USERNAME = 'X-AUTH-USER';
public const HEADER_TOKEN = 'X-AUTH-TOKEN';
private $encoderFactory;
public function __construct(EncoderFactoryInterface $encoderFactory)
{
$this->encoderFactory = $encoderFactory;
}
/**
* @param Request $request
* @return bool
*/
public function supports(Request $request)
{
// API docs can only be access, when the user is logged in
if (strpos($request->getRequestUri(), '/api/doc') !== false) {
return false;
}
// only try to use this authenticator, when the URL contains the /api/ path
if (strpos($request->getRequestUri(), '/api/') !== false) {
// javascript requests can set a header to disable this authenticator and use the existing session
return $request->headers->has(self::HEADER_USERNAME) && $request->headers->has(self::HEADER_TOKEN);
}
return false;
}
/**
* @param Request $request
* @return array|bool
*/
public function getCredentials(Request $request)
{
return [
'user' => $request->headers->get(self::HEADER_USERNAME),
'token' => $request->headers->get(self::HEADER_TOKEN),
];
}
/**
* @param array $credentials
* @param UserProviderInterface $userProvider
* @return null|UserInterface
*/
public function getUser($credentials, UserProviderInterface $userProvider)
{
$token = $credentials['token'] ?? null;
$user = $credentials['user'] ?? null;
if (empty($token) || empty($user)) {
return null;
}
return $userProvider->loadUserByUsername($user);
}
/**
* @param array $credentials
* @param UserInterface $user
* @return bool
*/
public function checkCredentials($credentials, UserInterface $user)
{
$token = $credentials['token'];
if (!empty($token) && $user instanceof User && !empty($user->getApiToken())) {
$encoder = $this->encoderFactory->getEncoder($user);
return $encoder->isPasswordValid($user->getApiToken(), $token, $user->getSalt());
}
return false;
}
/**
* @param Request $request
* @param TokenInterface $token
* @param string $providerKey
* @return null|Response
*/
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
{
return null;
}
/**
* @param Request $request
* @param AuthenticationException $exception
* @return null|JsonResponse|Response
*/
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
{
if (!$request->headers->has(self::HEADER_USERNAME) || !$request->headers->has(self::HEADER_TOKEN)) {
return new JsonResponse(
['message' => 'Authentication required, missing headers: ' . self::HEADER_USERNAME . ', ' . self::HEADER_TOKEN],
Response::HTTP_FORBIDDEN
);
}
$data = [
'message' => 'Invalid credentials'
// security measure: do not leak real reason (unknown user, invalid credentials ...)
// you can uncomment this for debugging
// 'message' => strtr($exception->getMessageKey(), $exception->getMessageData())
];
return new JsonResponse($data, Response::HTTP_FORBIDDEN);
}
/**
* @param Request $request
* @param AuthenticationException|null $authException
* @return JsonResponse|Response
*/
public function start(Request $request, AuthenticationException $authException = null)
{
$data = [
'message' => 'Authentication required, missing headers: ' . self::HEADER_USERNAME . ', ' . self::HEADER_TOKEN
];
return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
}
/**
* @return bool
*/
public function supportsRememberMe()
{
return false;
}
}

42
src/Security/TwoFactorCondition.php Normal file
View File

@@ -0,0 +1,42 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Security;
use App\Entity\User;
use Scheb\TwoFactorBundle\Security\TwoFactor\AuthenticationContextInterface;
use Scheb\TwoFactorBundle\Security\TwoFactor\Condition\TwoFactorConditionInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
final class TwoFactorCondition implements TwoFactorConditionInterface
{
public function __construct(private AuthorizationCheckerInterface $authorizationChecker)
{
}
public function shouldPerformTwoFactorAuthentication(AuthenticationContextInterface $context): bool
{
/** @var User $user */
$user = $context->getUser();
// only internal users support 2FA currently
if (!$user->isInternalUser()) {
return false;
}
// never require 2FA on API calls
if (str_starts_with($context->getRequest()->getRequestUri(), '/api/')) {
return false;
}
// if a user is remembered, it means he already passed the TOTP code
// do not bother again with the code
return !$this->authorizationChecker->isGranted('IS_AUTHENTICATED_REMEMBERED');
}
}

6
src/Security/UserChecker.php
View File

@@ -18,13 +18,13 @@ use Symfony\Component\Security\Core\User\UserInterface;
/**
* Advanced checks during authentication to make sure the user is allowed to use Kimai.
*/
class UserChecker implements UserCheckerInterface
final class UserChecker implements UserCheckerInterface
{
/**
* @param UserInterface $user
* @throws AccountStatusException
*/
public function checkPreAuth(UserInterface $user)
public function checkPreAuth(UserInterface $user): void
{
if (!($user instanceof User)) {
return;
@@ -41,7 +41,7 @@ class UserChecker implements UserCheckerInterface
* @param UserInterface $user
* @throws AccountStatusException
*/
public function checkPostAuth(UserInterface $user)
public function checkPostAuth(UserInterface $user): void
{
if (!($user instanceof User)) {
return;