Initial Version
This commit is contained in:
root
180
core/lib/Security/Authentication/AuthenticationRequest.php
Normal file
180
core/lib/Security/Authentication/AuthenticationRequest.php
Normal file
@@ -0,0 +1,180 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace KTXC\Security\Authentication;
|
||||
|
||||
/**
|
||||
* Authentication Request
|
||||
*
|
||||
* Request DTO from controller to AuthenticationManager.
|
||||
* Encapsulates all input data for authentication operations.
|
||||
*/
|
||||
readonly class AuthenticationRequest
|
||||
{
|
||||
// Action types
|
||||
public const ACTION_START = 'start';
|
||||
public const ACTION_IDENTIFY = 'identify';
|
||||
public const ACTION_VERIFY = 'verify';
|
||||
public const ACTION_CHALLENGE = 'challenge';
|
||||
public const ACTION_REDIRECT = 'redirect';
|
||||
public const ACTION_CALLBACK = 'callback';
|
||||
public const ACTION_STATUS = 'status';
|
||||
public const ACTION_CANCEL = 'cancel';
|
||||
public const ACTION_REFRESH = 'refresh';
|
||||
public const ACTION_LOGOUT = 'logout';
|
||||
|
||||
public function __construct(
|
||||
/** Action to perform */
|
||||
public string $action,
|
||||
|
||||
/** Session ID (for ongoing auth flows) */
|
||||
public ?string $sessionId = null,
|
||||
|
||||
/** User identity (email/username) */
|
||||
public ?string $identity = null,
|
||||
|
||||
/** Authentication method/provider ID */
|
||||
public ?string $method = null,
|
||||
|
||||
/** Secret/code/password */
|
||||
public ?string $secret = null,
|
||||
|
||||
/** Callback URL for redirect flows */
|
||||
public ?string $callbackUrl = null,
|
||||
|
||||
/** Return URL after authentication */
|
||||
public ?string $returnUrl = null,
|
||||
|
||||
/** Additional parameters (OIDC callback params, etc.) */
|
||||
public array $params = [],
|
||||
|
||||
/** Token for refresh/logout operations */
|
||||
public ?string $token = null,
|
||||
) {}
|
||||
|
||||
// =========================================================================
|
||||
// Factory Methods
|
||||
// =========================================================================
|
||||
|
||||
/**
|
||||
* Create a start request
|
||||
*/
|
||||
public static function start(): self
|
||||
{
|
||||
return new self(action: self::ACTION_START);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an identify request
|
||||
*/
|
||||
public static function identify(string $sessionId, string $identity): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_IDENTIFY,
|
||||
sessionId: $sessionId,
|
||||
identity: $identity,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a verify request (password, TOTP code, etc.)
|
||||
*/
|
||||
public static function verify(string $sessionId, string $method, string $secret): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_VERIFY,
|
||||
sessionId: $sessionId,
|
||||
method: $method,
|
||||
secret: $secret,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a begin challenge request
|
||||
*/
|
||||
public static function challenge(string $sessionId, string $method): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_CHALLENGE,
|
||||
sessionId: $sessionId,
|
||||
method: $method,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a begin redirect request
|
||||
*/
|
||||
public static function redirect(
|
||||
string $sessionId,
|
||||
string $method,
|
||||
string $callbackUrl,
|
||||
?string $returnUrl = null
|
||||
): self {
|
||||
return new self(
|
||||
action: self::ACTION_REDIRECT,
|
||||
sessionId: $sessionId,
|
||||
method: $method,
|
||||
callbackUrl: $callbackUrl,
|
||||
returnUrl: $returnUrl,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a callback request (OIDC/SAML return)
|
||||
*/
|
||||
public static function callback(string $sessionId, string $method, array $params): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_CALLBACK,
|
||||
sessionId: $sessionId,
|
||||
method: $method,
|
||||
params: $params,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a status request
|
||||
*/
|
||||
public static function status(string $sessionId): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_STATUS,
|
||||
sessionId: $sessionId,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a cancel request
|
||||
*/
|
||||
public static function cancel(string $sessionId): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_CANCEL,
|
||||
sessionId: $sessionId,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a refresh token request
|
||||
*/
|
||||
public static function refresh(string $token): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_REFRESH,
|
||||
token: $token,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a logout request
|
||||
*/
|
||||
public static function logout(?string $token = null, bool $allDevices = false): self
|
||||
{
|
||||
return new self(
|
||||
action: self::ACTION_LOGOUT,
|
||||
token: $token,
|
||||
params: ['all_devices' => $allDevices],
|
||||
);
|
||||
}
|
||||
}
|
||||
272
core/lib/Security/Authentication/AuthenticationResponse.php
Normal file
272
core/lib/Security/Authentication/AuthenticationResponse.php
Normal file
@@ -0,0 +1,272 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace KTXC\Security\Authentication;
|
||||
|
||||
/**
|
||||
* Authentication Response
|
||||
*
|
||||
* Response DTO from AuthenticationManager to controller.
|
||||
* Contains all data needed to build the HTTP response.
|
||||
*/
|
||||
readonly class AuthenticationResponse
|
||||
{
|
||||
// Status constants
|
||||
public const STATUS_SUCCESS = 'success';
|
||||
public const STATUS_PENDING = 'pending';
|
||||
public const STATUS_CHALLENGE = 'challenge';
|
||||
public const STATUS_REDIRECT = 'redirect';
|
||||
public const STATUS_FAILED = 'failed';
|
||||
public const STATUS_CANCELLED = 'cancelled';
|
||||
|
||||
// Error codes
|
||||
public const ERROR_INVALID_REQUEST = 'invalid_request';
|
||||
public const ERROR_INVALID_CREDENTIALS = 'invalid_credentials';
|
||||
public const ERROR_INVALID_PROVIDER = 'invalid_provider';
|
||||
public const ERROR_INVALID_SESSION = 'invalid_session';
|
||||
public const ERROR_SESSION_EXPIRED = 'session_expired';
|
||||
public const ERROR_USER_NOT_FOUND = 'user_not_found';
|
||||
public const ERROR_USER_DISABLED = 'user_disabled';
|
||||
public const ERROR_ACCOUNT_LOCKED = 'account_locked';
|
||||
public const ERROR_RATE_LIMITED = 'rate_limited';
|
||||
public const ERROR_INTERNAL = 'internal_error';
|
||||
|
||||
public function __construct(
|
||||
/** Response status */
|
||||
public string $status,
|
||||
|
||||
/** Suggested HTTP status code */
|
||||
public int $httpStatus = 200,
|
||||
|
||||
/** Session ID (for ongoing flows) */
|
||||
public ?string $sessionId = null,
|
||||
|
||||
/** Current session state */
|
||||
public ?string $sessionState = null,
|
||||
|
||||
/** Serialized user data (on success) */
|
||||
public ?array $user = null,
|
||||
|
||||
/** Auth tokens (on success) */
|
||||
public ?array $tokens = null,
|
||||
|
||||
/** Available authentication methods */
|
||||
public ?array $methods = null,
|
||||
|
||||
/** Challenge information */
|
||||
public ?array $challenge = null,
|
||||
|
||||
/** Redirect URL (for OIDC/SAML) */
|
||||
public ?string $redirectUrl = null,
|
||||
|
||||
/** Return URL (after redirect auth) */
|
||||
public ?string $returnUrl = null,
|
||||
|
||||
/** Error code */
|
||||
public ?string $errorCode = null,
|
||||
|
||||
/** Error message */
|
||||
public ?string $errorMessage = null,
|
||||
) {}
|
||||
|
||||
// =========================================================================
|
||||
// Factory Methods
|
||||
// =========================================================================
|
||||
|
||||
/**
|
||||
* Session started response
|
||||
*/
|
||||
public static function started(string $sessionId, array $methods): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_SUCCESS,
|
||||
sessionId: $sessionId,
|
||||
methods: $methods,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* User identified response
|
||||
*/
|
||||
public static function identified(string $sessionId, string $state, array $methods): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_SUCCESS,
|
||||
sessionId: $sessionId,
|
||||
sessionState: $state,
|
||||
methods: $methods,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Authentication successful
|
||||
*/
|
||||
public static function success(array $user, array $tokens): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_SUCCESS,
|
||||
user: $user,
|
||||
tokens: $tokens,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* MFA/additional factor required
|
||||
*/
|
||||
public static function pending(string $sessionId, array $methods): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_PENDING,
|
||||
sessionId: $sessionId,
|
||||
methods: $methods,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Challenge sent (SMS, email, etc.)
|
||||
*/
|
||||
public static function challenge(string $sessionId, array $challengeInfo): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_CHALLENGE,
|
||||
sessionId: $sessionId,
|
||||
challenge: $challengeInfo,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Redirect required (OIDC/SAML)
|
||||
*/
|
||||
public static function redirect(string $sessionId, string $redirectUrl): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_REDIRECT,
|
||||
sessionId: $sessionId,
|
||||
redirectUrl: $redirectUrl,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Authentication failed
|
||||
*/
|
||||
public static function failed(
|
||||
string $errorCode,
|
||||
?string $errorMessage = null,
|
||||
int $httpStatus = 401
|
||||
): self {
|
||||
return new self(
|
||||
status: self::STATUS_FAILED,
|
||||
httpStatus: $httpStatus,
|
||||
errorCode: $errorCode,
|
||||
errorMessage: $errorMessage,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Session cancelled
|
||||
*/
|
||||
public static function cancelled(): self
|
||||
{
|
||||
return new self(
|
||||
status: self::STATUS_CANCELLED,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Status check response
|
||||
*/
|
||||
public static function status(
|
||||
string $sessionId,
|
||||
string $state,
|
||||
array $methods,
|
||||
?string $identity = null
|
||||
): self {
|
||||
return new self(
|
||||
status: self::STATUS_SUCCESS,
|
||||
sessionId: $sessionId,
|
||||
sessionState: $state,
|
||||
methods: $methods,
|
||||
user: $identity ? ['identity' => $identity] : null,
|
||||
);
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// Status Checks
|
||||
// =========================================================================
|
||||
|
||||
public function isSuccess(): bool
|
||||
{
|
||||
return $this->status === self::STATUS_SUCCESS;
|
||||
}
|
||||
|
||||
public function isPending(): bool
|
||||
{
|
||||
return $this->status === self::STATUS_PENDING;
|
||||
}
|
||||
|
||||
public function isRedirect(): bool
|
||||
{
|
||||
return $this->status === self::STATUS_REDIRECT;
|
||||
}
|
||||
|
||||
public function isFailed(): bool
|
||||
{
|
||||
return $this->status === self::STATUS_FAILED;
|
||||
}
|
||||
|
||||
public function hasTokens(): bool
|
||||
{
|
||||
return $this->tokens !== null && !empty($this->tokens);
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// Serialization
|
||||
// =========================================================================
|
||||
|
||||
/**
|
||||
* Convert to array for JSON response
|
||||
*/
|
||||
public function toArray(): array
|
||||
{
|
||||
$result = ['status' => $this->status];
|
||||
|
||||
if ($this->sessionId !== null) {
|
||||
$result['session'] = $this->sessionId;
|
||||
}
|
||||
|
||||
if ($this->sessionState !== null) {
|
||||
$result['state'] = $this->sessionState;
|
||||
}
|
||||
|
||||
if ($this->user !== null) {
|
||||
$result['user'] = $this->user;
|
||||
}
|
||||
|
||||
if ($this->methods !== null) {
|
||||
$result['methods'] = $this->methods;
|
||||
}
|
||||
|
||||
if ($this->challenge !== null) {
|
||||
$result['challenge'] = $this->challenge;
|
||||
}
|
||||
|
||||
if ($this->redirectUrl !== null) {
|
||||
$result['redirect_url'] = $this->redirectUrl;
|
||||
}
|
||||
|
||||
if ($this->returnUrl !== null) {
|
||||
$result['return_url'] = $this->returnUrl;
|
||||
}
|
||||
|
||||
if ($this->errorCode !== null) {
|
||||
$result['error_code'] = $this->errorCode;
|
||||
}
|
||||
|
||||
if ($this->errorMessage !== null) {
|
||||
$result['error'] = $this->errorMessage;
|
||||
}
|
||||
|
||||
return $result;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user