2FAuth/app/Http/Controllers/TwoFAccountController.php

170 lines
4.1 KiB
PHP
Raw Normal View History

2019-05-20 07:37:41 +02:00
<?php
namespace App\Http\Controllers;
use App\TwoFAccount;
2020-01-24 22:37:48 +01:00
use App\Classes\OTP;
2019-05-20 07:37:41 +02:00
use Illuminate\Http\Request;
2019-05-26 16:42:09 +02:00
use ParagonIE\ConstantTime\Base32;
2020-01-07 16:46:50 +01:00
use Illuminate\Support\Facades\Storage;
2019-05-20 07:37:41 +02:00
class TwoFAccountController extends Controller
2019-05-20 07:37:41 +02:00
{
/**
* Display a listing of the resource.
*
* @return \Illuminate\Http\Response
*/
public function index()
{
return response()->json(TwoFAccount::all()->toArray());
2019-05-20 07:37:41 +02:00
}
/**
* Store a newly created resource in storage.
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function store(Request $request)
{
// see https://github.com/google/google-authenticator/wiki/Key-Uri-Format
// for otpauth uri format validation
$this->validate($request, [
'service' => 'required',
2020-01-24 12:56:38 +01:00
'uri' => 'required|regex:/^otpauth:\/\/[h,t]otp\//i',
]);
2020-01-25 18:22:45 +01:00
OTP::get($request->uri);
2020-01-25 00:01:30 +01:00
$twofaccount = TwoFAccount::create([
'service' => $request->service,
'account' => $request->account,
2020-01-02 00:09:19 +01:00
'uri' => $request->uri,
'icon' => $request->icon
2019-05-20 07:37:41 +02:00
]);
2019-05-25 23:51:20 +02:00
return response()->json($twofaccount, 201);
2019-05-20 07:37:41 +02:00
}
2019-05-20 07:37:41 +02:00
/**
* Display the specified resource.
*
* @param \App\TwoFAccount $twofaccount
2019-05-20 07:37:41 +02:00
* @return \Illuminate\Http\Response
*/
2020-02-02 20:46:41 +01:00
public function show(TwoFAccount $twofaccount)
2019-05-20 07:37:41 +02:00
{
2020-01-26 21:49:39 +01:00
return response()->json($twofaccount, 200);
2019-05-20 07:37:41 +02:00
}
2019-05-26 16:42:09 +02:00
/**
* Generate a TOTP
*
* @param \App\TwoFAccount $twofaccount
* @return \Illuminate\Http\Response
*/
2020-01-24 22:37:48 +01:00
public function generateOTP(TwoFAccount $twofaccount)
2019-05-26 16:42:09 +02:00
{
2020-01-25 18:22:45 +01:00
return response()->json(OTP::generate($twofaccount->uri), 200);
2019-05-26 16:42:09 +02:00
}
2019-05-20 07:37:41 +02:00
/**
* Update the specified resource in storage.
*
* @param \Illuminate\Http\Request $request
* @param \App\TwoFAccount $twofaccount
2019-05-20 07:37:41 +02:00
* @return \Illuminate\Http\Response
*/
2020-01-10 08:35:15 +01:00
public function update(Request $request, $id)
2019-05-20 07:37:41 +02:00
{
$this->validate($request, [
'service' => 'required',
]);
// Here we catch a possible missing model exception in order to
// delete orphan submited icon
try {
$twofaccount = TwoFAccount::FindOrFail($id);
} catch (\Illuminate\Database\Eloquent\ModelNotFoundException $e) {
if( $request->icon ) {
Storage::delete('public/icons/' . $request->icon);
}
throw $e;
}
2020-01-25 18:44:24 +01:00
2020-01-26 21:49:39 +01:00
if( $twofaccount->type === 'hotp' ) {
2020-01-25 18:44:24 +01:00
2020-01-26 21:49:39 +01:00
// HOTP can be desynchronized from the verification
// server so we let the user the possibility to force
// the counter.
2020-01-25 18:44:24 +01:00
2020-01-26 21:49:39 +01:00
$this->validate($request, [
'counter' => 'required|integer',
2020-01-25 18:44:24 +01:00
]);
2020-01-10 08:35:15 +01:00
2020-01-26 21:49:39 +01:00
// we set an OTP object to get the its current counter
// and we update it if a new one has been submited
$otp = OTP::get($twofaccount->uri);
2020-01-10 08:35:15 +01:00
2020-01-26 21:49:39 +01:00
if( $otp->getCounter() !== $request->counter ) {
$otp->setParameter( 'counter', $request->counter );
$twofaccount->uri = $otp->getProvisioningUri();
}
2020-01-10 08:35:15 +01:00
}
2020-01-26 21:49:39 +01:00
$twofaccount->update([
'service' => $request->service,
'account' => $request->account,
'icon' => $request->icon,
'uri' => $twofaccount->uri,
]);
return response()->json($twofaccount, 200);
2020-01-10 08:35:15 +01:00
2019-05-20 07:37:41 +02:00
}
2019-05-20 07:37:41 +02:00
/**
* Remove the specified resource from storage.
*
* @param \App\TwoFAccount $twofaccount
2019-05-20 07:37:41 +02:00
* @return \Illuminate\Http\Response
*/
public function destroy(TwoFAccount $twofaccount)
2019-05-20 07:37:41 +02:00
{
$twofaccount->delete();
2020-01-10 00:22:45 +01:00
return response()->json(null, 204);
}
2020-01-10 00:22:45 +01:00
/**
* Remove the specified resources from storage.
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function batchDestroy(Request $request)
{
$ids = $request->all();
TwoFAccount::destroy($ids);
2020-01-26 21:49:39 +01:00
return response()->json(null, 204);
}
2019-05-20 07:37:41 +02:00
}