Proyectos de Subversion Moodle

<?php

// This file is part of Moodle - http://moodle.org/

//

// Moodle is free software: you can redistribute it and/or modify

// it under the terms of the GNU General Public License as published by

// the Free Software Foundation, either version 3 of the License, or

// (at your option) any later version.

//

// Moodle is distributed in the hope that it will be useful,

// but WITHOUT ANY WARRANTY; without even the implied warranty of

// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

// GNU General Public License for more details.

//

// You should have received a copy of the GNU General Public License

// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

namespace factor_webauthn;

defined('MOODLE_INTERNAL') || die();

require_once($CFG->libdir . '/webauthn/src/WebAuthn.php');

use lbuchs\WebAuthn\Binary\ByteBuffer;

use lbuchs\WebAuthn\WebAuthn;

use lbuchs\WebAuthn\WebAuthnException;

use stdClass;

use tool_mfa\local\factor\object_factor_base;

/**

 * WebAuthn factor class.

 *

 * @package     factor_webauthn

 * @author      Alex Morris <alex.morris@catalyst.net.nz>

 * @copyright   Catalyst IT

 * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later

 */

class factor extends object_factor_base {

    /** @var WebAuthn WebAuthn server */

    private $webauthn;

    /** @var string Relying party ID */

    private $rpid;

    /** @var string User verification setting */

    private $userverification;

    /** @var string Factor icon */

    protected $icon = 'fa-hand-pointer';

    /**

     * Create webauthn server.

     *

     * @param string $name

     */

    public function __construct($name) {

        global $CFG, $SITE;

        parent::__construct($name);

        $this->rpid = (new \moodle_url($CFG->wwwroot))->get_host();

        $this->webauthn = new WebAuthn($SITE->fullname, $this->rpid);

        $this->userverification = get_config('factor_webauthn', 'userverification');

    }

    /**

     * WebAuthn Factor implementation.

     *

     * @param stdClass $user the user to check against.

     * @return array

     */

    public function get_all_user_factors(stdClass $user): array {

        global $DB;

        return $DB->get_records('tool_mfa', ['userid' => $user->id, 'factor' => $this->name]);

    }

    /**

     * WebAuthn Factor implementation.

     *

     * {@inheritDoc}

     */

    public function has_input(): bool {

        return true;

    }

    /**

     * WebAuthn Factor implementation.

     *

     * {@inheritDoc}

     */

    public function has_revoke(): bool {

        return true;

    }

    /**

     * WebAuthn Factor implementation.

     */

    public function has_replace(): bool {

        return true;

    }

    /**

     * WebAuthn Factor implementation.

     *

     * {@inheritDoc}

     */

    public function has_setup(): bool {

        return true;

    }

    /**

     * WebAuthn Factor implementation.

     *

     * {@inheritDoc}

     */

    public function show_setup_buttons(): bool {

        return true;

    }

    /**

     * WebAuthn factor implementation.

     *

     * @param stdClass $user

     * @return array

     */

    public function possible_states(stdClass $user): array {

        return [

            \tool_mfa\plugininfo\factor::STATE_PASS,

            \tool_mfa\plugininfo\factor::STATE_NEUTRAL,

            \tool_mfa\plugininfo\factor::STATE_UNKNOWN,

        ];

    }

    /**

     * WebAuthn state

     *

     * {@inheritDoc}

     */

    public function get_state(): string {

        global $USER;

        $userfactors = $this->get_active_user_factors($USER);

        // If no authenticators are set up then we are neutral not unknown.

        if (count($userfactors) == 0) {

            return \tool_mfa\plugininfo\factor::STATE_NEUTRAL;

        }

        return parent::get_state();

    }

    /**

     * Gets the string for setup button on preferences page.

     *

     * @return string

     */

    public function get_setup_string(): string {

        return get_string('setupfactorbutton', 'factor_webauthn');

    }

    /**

     * Gets the string for manage button on preferences page.

     *

     * @return string

     */

    public function get_manage_string(): string {

        return get_string('managefactorbutton', 'factor_webauthn');

    }

    /**

     * WebAuthn Factor implementation.

     *

     * @param \MoodleQuickForm $mform

     * @return \MoodleQuickForm $mform

     */

    public function login_form_definition(\MoodleQuickForm $mform): \MoodleQuickForm {

        global $PAGE, $USER, $SESSION;

        $mform->addElement('hidden', 'response_input', '', ['id' => 'id_response_input']);

        $mform->setType('response_input', PARAM_RAW);

        // Required to attach verification errors, so they can be displayed to the user.

        $mform->addElement('static', 'verificationcode', '', '');

        $ids = [];

        $authenticators = $this->get_active_user_factors($USER);

        foreach ($authenticators as $authenticator) {

            $registration = json_decode($authenticator->secret);

            $ids[] = base64_decode($registration->credentialId);

        }

        $types = explode(',', get_config('factor_webauthn', 'authenticatortypes'));

        $getargs =

            $this->webauthn->getGetArgs($ids, 20, in_array('usb', $types), in_array('nfc', $types), in_array('ble', $types),

                in_array('hybrid', $types), in_array('internal', $types), $this->userverification);

        $PAGE->requires->js_call_amd('factor_webauthn/login', 'init', [json_encode($getargs)]);

        // Challenge is regenerated on form submission, at this point we aren't aware if the form is submitted for being

        // loaded for the first time, so we store the existing and new challenge.

        if (isset($SESSION->factor_webauthn_challenge_new)) {

            $SESSION->factor_webauthn_challenge = $SESSION->factor_webauthn_challenge_new;

        }

        $SESSION->factor_webauthn_challenge_new = $this->webauthn->getChallenge()->getHex();

        return $mform;

    }

    /**

     * WebAuthn Factor implementation.

     *

     * @param array $data

     * @return array

     */

    public function login_form_validation(array $data): array {

        global $USER, $SESSION;

        $errors = [];

        if (empty($data['response_input'])) {

            $errors['verificationcode'] = get_string('error', 'factor_webauthn');

            return $errors;

        }

        $post = json_decode($data['response_input'], null, 512, JSON_THROW_ON_ERROR);

        $id = base64_decode($post->id);

        $clientdata = base64_decode($post->clientDataJSON);

        $authenticatordata = base64_decode($post->authenticatorData);

        $signature = base64_decode($post->signature);

        $credentialpublickey = null;

        $challenge = ByteBuffer::fromHex($SESSION->factor_webauthn_challenge);

        unset($SESSION->factor_webauthn_challenge);

        $authenticators = $this->get_active_user_factors($USER);

        foreach ($authenticators as $authenticator) {

            $registration = json_decode($authenticator->secret);

            if (base64_decode($registration->credentialId) === $id) {

                $credentialpublickey = $registration->credentialPublicKey;

                break;

            }

        }

        if ($credentialpublickey === null) {

            $errors['verificationcode'] = get_string('error', 'factor_webauthn');

            return $errors;

        }

        try {

            // Throws exception if authentication fails.

            $this->webauthn->processGet($clientdata, $authenticatordata, $signature, $credentialpublickey, $challenge, null,

                $this->userverification === 'required');

        } catch (WebAuthnException $ex) {

            $errors['verificationcode'] = get_string('error', 'factor_webauthn');

        }

        return $errors;

    }

    /**

     * WebAuthn Factor implementation.

     *

     * @param \MoodleQuickForm $mform

     * @return \MoodleQuickForm $mform

     */

    public function setup_factor_form_definition(\MoodleQuickForm $mform): \MoodleQuickForm {

        global $PAGE, $USER, $SESSION, $OUTPUT;

        $headingstring = $mform->elementExists('replaceid') ? 'replacefactor' : 'setupfactor';

        $mform->addElement('html', $OUTPUT->heading(get_string($headingstring, 'factor_webauthn'), 2));

        $html = \html_writer::tag('p', get_string('setupfactor:intro', 'factor_webauthn'));

        $mform->addElement('html', $html);

        // Security key name.

        $mform->addElement('html', \html_writer::tag('p', get_string('setupfactor:instructionssecuritykeyname', 'factor_webauthn'),

            ['class' => 'bold']));

        $mform->addElement('text', 'webauthn_name', get_string('authenticatorname', 'factor_webauthn'));

        $mform->setType('webauthn_name', PARAM_TEXT);

        $mform->addRule('webauthn_name', get_string('required'), 'required', null, 'client');

        $html = \html_writer::tag('p', get_string('setupfactor:securitykeyinfo', 'factor_webauthn'));

        $mform->addElement('static', 'devicenameinfo', '', $html);

        // Register security key.

        $mform->addElement('html', \html_writer::tag('p',

            get_string('setupfactor:instructionsregistersecuritykey', 'factor_webauthn'), ['class' => 'bold']));

        $registerbtn = \html_writer::tag('btn', get_string('register', 'factor_webauthn'), [

            'class' => 'btn btn-primary',

            'type' => 'button',

            'id' => 'factor_webauthn-register',

            'tabindex' => '0',

        ]);

        $mform->addElement('static', 'register', '', $registerbtn);

        $mform->addElement('hidden', 'response_input', '', ['id' => 'id_response_input']);

        $mform->setType('response_input', PARAM_RAW);

        $mform->addRule('response_input', get_string('required'), 'required', null, 'client');

        // Cross-platform: true if type internal is not allowed,

        // false if only internal is allowed,

        // null if internal and cross-platform is allowed.

        $types = explode(',', get_config('factor_webauthn', 'authenticatortypes'));

        $crossplatformattachment = null;

        if ((in_array('usb', $types) || in_array('nfc', $types) || in_array('ble', $types) || in_array('hybrid', $types)) &&

            !in_array('internal', $types)) {

            $crossplatformattachment = true;

        } else if (!in_array('usb', $types) && !in_array('nfc', $types) && !in_array('ble', $types) &&

            !in_array('hybrid', $types) && in_array('internal', $types)) {

            $crossplatformattachment = false;

        }

        $createargs = $this->webauthn->getCreateArgs($USER->id, $USER->username, fullname($USER), 20, false,

            $this->userverification, $crossplatformattachment);

        $PAGE->requires->js_call_amd('factor_webauthn/register', 'init', [json_encode($createargs)]);

        // Challenge is regenerated on form submission, at this point we aren't aware if the form is submitted for being

        // loaded for the first time, so we store the existing and new challenge.

        if (isset($SESSION->factor_webauthn_challenge_new)) {

            $SESSION->factor_webauthn_challenge = $SESSION->factor_webauthn_challenge_new;

        }

        $SESSION->factor_webauthn_challenge_new = $this->webauthn->getChallenge()->getHex();

        return $mform;

    }

    /**

     * WebAuthn Factor implementation.

     *

     * @param object $data

     * @return stdClass|null

     */

    public function setup_user_factor(object $data): stdClass|null {

        global $DB, $USER, $SESSION;

        if (!empty($data->webauthn_name) && !empty($data->response_input) && isset($SESSION->factor_webauthn_challenge)) {

            $post = json_decode($data->response_input, null, 512, JSON_THROW_ON_ERROR);

            $clientdata = base64_decode($post->clientDataJSON);

            $attestationobject = base64_decode($post->attestationObject);

            $challenge = ByteBuffer::fromHex($SESSION->factor_webauthn_challenge);

            unset($SESSION->factor_webauthn_challenge);

            $registration =

                $this->webauthn->processCreate($clientdata, $attestationobject, $challenge, $this->userverification === 'required',

                    true, false);

            $registration->credentialId = base64_encode($registration->credentialId);

            $registration->AAGUID = base64_encode($registration->AAGUID);

            unset($registration->certificate);

            $row = new \stdClass();

            $row->userid = $USER->id;

            $row->factor = $this->name;

            $row->label = $data->webauthn_name;

            $row->secret = json_encode($registration);

            $row->timecreated = time();

            $row->createdfromip = $USER->lastip;

            $row->timemodified = time();

            $row->lastverified = time();

            $row->revoked = 0;

            // Check if a record with this configuration already exists, warning the user accordingly.

            $record = $DB->get_record('tool_mfa', [

                'userid' => $row->userid,

                'secret' => $row->secret,

                'factor' => $row->factor,

            ], '*', IGNORE_MULTIPLE);

            if ($record) {

                \core\notification::warning(get_string('error:alreadyregistered', 'factor_webauthn'));

                return null;

            }

            $id = $DB->insert_record('tool_mfa', $row);

            $record = $DB->get_record('tool_mfa', array('id' => $id));

            $this->create_event_after_factor_setup($USER);

            return $record;

        }

        return null;

    }

    /**

     * WebAuthn Factor implementation with replacement of existing factor.

     *

     * @param stdClass $data The new factor data.

     * @param int $id The id of the factor to replace.

     * @return stdClass|null the factor record, or null.

     */

    public function replace_user_factor(stdClass $data, int $id): stdClass|null {

        global $DB, $USER;

        $oldrecord = $DB->get_record('tool_mfa', ['id' => $id]);

        $newrecord = null;

        // Ensure we have a valid existing record before setting the new one.

        if ($oldrecord) {

            $newrecord = $this->setup_user_factor($data);

        }

        // Ensure the new record was created before revoking the old.

        if ($newrecord) {

            $this->revoke_user_factor($id);

        } else {

            \core\notification::warning(get_string('error:couldnotreplace', 'tool_mfa'));

            return null;

        }

        $this->create_event_after_factor_setup($USER);

        return $newrecord ?? null;

    }

}