2FAuth/app/Models/TwoFAccount.php

<?php

namespace App\Models;

use App\Events\TwoFAccountDeleted;
use App\Exceptions\InvalidOtpParameterException;
use App\Exceptions\InvalidSecretException;
use App\Exceptions\UndecipherableException;
use App\Exceptions\UnsupportedOtpTypeException;
use App\Facades\Settings;
use App\Helpers\Helpers;
use App\Models\Dto\HotpDto;
use App\Models\Dto\TotpDto;
use App\Services\LogoService;
use Exception;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Support\Arr;
use Illuminate\Support\Facades\App;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Storage;
use Illuminate\Validation\ValidationException;
use OTPHP\Factory;
use OTPHP\HOTP;
use OTPHP\TOTP;
use ParagonIE\ConstantTime\Base32;
use Spatie\EloquentSortable\Sortable;
use Spatie\EloquentSortable\SortableTrait;
use SteamTotp\SteamTotp;

class TwoFAccount extends Model implements Sortable
{
    use SortableTrait, HasFactory;

    const TOTP = 'totp';

    const HOTP = 'hotp';

    const STEAM_TOTP = 'steamtotp';

    const SHA1 = 'sha1';

    const MD5 = 'md5';

    const SHA256 = 'sha256';

    const SHA512 = 'sha512';

    const DEFAULT_PERIOD = 30;

    const DEFAULT_COUNTER = 0;

    const DEFAULT_DIGITS = 6;

    const DEFAULT_ALGORITHM = self::SHA1;

    const DUPLICATE_ID = -1;

    const FAKE_ID = -2;

    /**
     * List of OTP types supported by 2FAuth
     */
    private array $generatorClassMap = [
        'OTPHP\TOTP' => self::TOTP,
        'OTPHP\HOTP' => self::HOTP,
    ];

    /**
     * model's array form.
     *
     * @var string[]
     */
    protected $fillable = [
        // 'service',
        // 'account',
        // 'otp_type',
        // 'digits',
        // 'secret',
        // 'algorithm',
        // 'counter',
        // 'period',
        // 'icon'
    ];

    /**
     * The table associated with the model.
     *
     * @var string
     */
    protected $table = 'twofaccounts';

    /**
     * The accessors to append to the model's array form.
     *
     * @var array
     */
    public $appends = [];

    /**
     * The model's default values for attributes.
     *
     * @var array
     */
    protected $attributes = [
        'digits'    => 6,
        'algorithm' => self::SHA1,
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array<int, string>
     */
    protected $hidden = [];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    protected $casts = [];

    /**
     * The event map for the model.
     *
     * @var array
     */
    protected $dispatchesEvents = [
        'deleted' => TwoFAccountDeleted::class,
    ];

    /**
     * Override The "booting" method of the model
     *
     * @return void
     */
    protected static function boot()
    {
        parent::boot();

        static::saving(function (TwoFAccount $twofaccount) {
            if (!$twofaccount->legacy_uri) {
                $twofaccount->legacy_uri = $twofaccount->getURI();
            }
            if ($twofaccount->otp_type == TwoFAccount::TOTP && !$twofaccount->period) {
                $twofaccount->period = TwoFAccount::DEFAULT_PERIOD;
            }
            if ($twofaccount->otp_type == TwoFAccount::HOTP && !$twofaccount->counter) {
                $twofaccount->counter = TwoFAccount::DEFAULT_COUNTER;
            }
        });

        // static::deleted(function ($model) {
        //     Log::info(sprintf('TwoFAccount #%d deleted', $model->id));
        // });
    }

    /**
     * Settings for @spatie/eloquent-sortable package
     *
     * @var array
     */
    public $sortable = [
        'order_column_name'  => 'order_column',
        'sort_when_creating' => true,
    ];

    /**
     * The OTP generator.
     * Instanciated as null to keep the model light
     *
     * @var \OTPHP\OTPInterface|null
     */
    protected $generator = null;

    /**
     * Get legacy_uri attribute
     *
     * @param  string  $value
     * @return string
     */
    public function getLegacyUriAttribute($value)
    {
        return $this->decryptOrReturn($value);
    }

    /**
     * Set legacy_uri attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setLegacyUriAttribute($value)
    {
        // Encrypt if needed
        $this->attributes['legacy_uri'] = $this->encryptOrReturn($value);
    }

    /**
     * Get account attribute
     *
     * @param  string  $value
     * @return string
     */
    public function getAccountAttribute($value)
    {
        return $this->decryptOrReturn($value);
    }

    /**
     * Set account attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setAccountAttribute($value)
    {
        // Encrypt when needed
        $this->attributes['account'] = $this->encryptOrReturn($value);
    }

    /**
     * Get secret attribute
     *
     * @param  string  $value
     * @return string
     */
    public function getSecretAttribute($value)
    {
        return $this->decryptOrReturn($value);
    }

    /**
     * Set secret attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setSecretAttribute($value)
    {
        // Encrypt when needed
        $this->attributes['secret'] = $this->encryptOrReturn(Helpers::PadToBase32Format($value));
    }

    /**
     * Set digits attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setDigitsAttribute($value)
    {
        $this->attributes['digits'] = !$value ? 6 : $value;
    }

    /**
     * Set algorithm attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setAlgorithmAttribute($value)
    {
        $this->attributes['algorithm'] = !$value ? self::SHA1 : strtolower($value);
    }

    /**
     * Set period attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setPeriodAttribute($value)
    {
        $this->attributes['period'] = !$value && $this->otp_type === self::TOTP ? self::DEFAULT_PERIOD : $value;
    }

    /**
     * Set counter attribute
     *
     * @param  string  $value
     * @return void
     */
    public function setCounterAttribute($value)
    {
        $this->attributes['counter'] = blank($value) && $this->otp_type === self::HOTP ? self::DEFAULT_COUNTER : $value;
    }

    /**
     * Returns a One-Time Password with its parameters
     *
     * @return TotpDto|HotpDto
     *
     * @throws InvalidSecretException The secret is not a valid base32 encoded string
     * @throws UndecipherableException The secret cannot be deciphered
     * @throws UnsupportedOtpTypeException The defined OTP type is not supported
     * @throws InvalidOtpParameterException One OTP parameter is invalid
     */
    public function getOTP()
    {
        Log::info(sprintf('OTP requested for TwoFAccount (%s)', $this->id ? 'id:' . $this->id : 'preview'));

        // Early exit if the model has an undecipherable secret
        if (strtolower($this->secret) === __('errors.indecipherable')) {
            Log::error('Secret cannot be deciphered, OTP generation aborted');

            throw new UndecipherableException();
        }

        $this->initGenerator();

        try {
            if ($this->otp_type === self::HOTP) {
                $OtpDto           = new HotpDto();
                $OtpDto->otp_type = $this->otp_type;
                $counter          = $this->generator->getParameter('counter');
                $OtpDto->password = $this->generator->at($counter);
                $OtpDto->counter  = $this->counter = $counter + 1;

                // The updated HOTP counter must be saved to db for persisted account only
                if ($this->id) {
                    $this->save();
                }
            } else {
                $OtpDto               = new TotpDto();
                $OtpDto->otp_type     = $this->otp_type;
                $OtpDto->generated_at = time();
                $OtpDto->password     = $this->otp_type === self::TOTP
                    ? $this->generator->at($OtpDto->generated_at)
                    : SteamTotp::getAuthCode(base64_encode(Base32::decodeUpper($this->secret)));
                $OtpDto->period = $this->period;
            }

            Log::info(sprintf('New OTP generated for TwoFAccount (%s)', $this->id ? 'id:' . $this->id : 'preview'));

            return $OtpDto;
        } catch (\Exception | \Throwable $ex) {
            Log::error('An error occured, OTP generation aborted');
            // Currently a secret issue is the only possible exception thrown by OTPHP for this stack
            // so it is Ok to send the corresponding 2FAuth exception.
            // If the generator package change it could be necessary to throw a more generic exception.
            throw new InvalidSecretException($ex->getMessage());
        }
    }

    /**
     * Fill the model using an array of OTP parameters.
     * Missing parameters will be set with default values
     *
     * @return $this
     */
    public function fillWithOtpParameters(array $parameters, bool $skipIconFetching = false)
    {
        $this->otp_type  = strtolower(Arr::get($parameters, 'otp_type'));
        $this->account   = Arr::get($parameters, 'account');
        $this->service   = Arr::get($parameters, 'service');
        $this->icon      = Arr::get($parameters, 'icon');
        $this->secret    = Arr::get($parameters, 'secret');
        $this->algorithm = strtolower(Arr::get($parameters, 'algorithm', self::SHA1));
        $this->digits    = Arr::get($parameters, 'digits', self::DEFAULT_DIGITS);
        $this->period    = Arr::get($parameters, 'period', $this->otp_type == self::TOTP ? self::DEFAULT_PERIOD : null);
        $this->counter   = Arr::get($parameters, 'counter', $this->otp_type == self::HOTP ? self::DEFAULT_COUNTER : null);

        $this->initGenerator();

        // The generator could have been initialized without a secret, in that case it generates one on the fly.
        // The secret attribute has thus to be updated
        $this->secret = $this->secret ?: $this->generator->getSecret();

        if ($this->otp_type === self::STEAM_TOTP || strtolower($this->service) === 'steam') {
            $this->enforceAsSteam();
        }

        if (!$this->icon && Settings::get('getOfficialIcons') && !$skipIconFetching) {
            $this->icon = $this->getDefaultIcon();
        }

        Log::info(sprintf('TwoFAccount filled with OTP parameters'));

        return $this;
    }

    /**
     * Fill the model by parsing an otpauth URI
     *
     * @return $this
     */
    public function fillWithURI(string $uri, bool $isSteamTotp = false, bool $skipIconFetching = false)
    {
        // First we instanciate the OTP generator
        try {
            $this->generator = Factory::loadFromProvisioningUri($uri);
        } catch (\Assert\AssertionFailedException | \Assert\InvalidArgumentException | \Exception | \Throwable $ex) {
            throw ValidationException::withMessages([
                'uri' => __('validation.custom.uri.regex', ['attribute' => 'uri']),
            ]);
        }

        // As loadFromProvisioningUri() accept URI without label (nor account nor service) we check
        // that the account is set
        if (!$this->generator->getLabel()) {
            Log::error('URI passed to fillWithURI() must contain a label');

            throw ValidationException::withMessages([
                'label' => __('validation.custom.label.required'),
            ]);
        }

        $this->otp_type   = $this->getGeneratorOtpType();
        $this->account    = $this->generator->getLabel();
        $this->secret     = $this->generator->getSecret();
        $this->service    = $this->generator->getIssuer();
        $this->algorithm  = $this->generator->getDigest();
        $this->digits     = $this->generator->getDigits();
        $this->period     = $this->generator->hasParameter('period') ? $this->generator->getParameter('period') : null;
        $this->counter    = $this->generator->hasParameter('counter') ? $this->generator->getParameter('counter') : null;
        $this->legacy_uri = $uri;

        if ($isSteamTotp || strtolower($this->service) === 'steam') {
            $this->enforceAsSteam();
        }
        if ($this->generator->hasParameter('image')) {
            $this->icon = $this->storeImageAsIcon($this->generator->getParameter('image'));
        }

        if (!$this->icon && Settings::get('getOfficialIcons') && !$skipIconFetching) {
            $this->icon = $this->getDefaultIcon();
        }

        Log::info(sprintf('TwoFAccount filled with an URI'));

        return $this;
    }

    /**
     * Compare 2 TwoFAccounts
     */
    public function equals(self $other): bool
    {
        return $this->service === $other->service &&
            $this->account === $other->account &&
            $this->icon === $other->icon &&
            $this->otp_type === $other->otp_type &&
            $this->secret === $other->secret &&
            $this->digits === $other->digits &&
            $this->algorithm === $other->algorithm &&
            $this->period === $other->period &&
            $this->counter === $other->counter;
    }

    /**
     * Sets model attributes to STEAM values
     */
    private function enforceAsSteam(): void
    {
        $this->otp_type  = self::STEAM_TOTP;
        $this->digits    = 5;
        $this->algorithm = self::SHA1;
        $this->period    = 30;

        Log::info(sprintf('TwoFAccount configured as Steam account'));
    }

    /**
     * Returns the OTP type of the instanciated OTP generator
     *
     * @return mixed
     */
    private function getGeneratorOtpType()
    {
        return Arr::get($this->generatorClassMap, get_class($this->generator));
    }

    /**
     * Returns an otpauth URI built with model attribute values
     */
    public function getURI(): string
    {
        $this->initGenerator();

        return $this->generator->getProvisioningUri();
    }

    /**
     * Instanciates the OTP generator with model attribute values
     *
     * @throws UnsupportedOtpTypeException The defined OTP type is not supported
     * @throws InvalidOtpParameterException One OTP parameter is invalid
     */
    private function initGenerator(): void
    {
        try {
            switch ($this->otp_type) {
                case self::TOTP:
                    $this->generator = TOTP::create(
                        $this->secret,
                        $this->period ?: self::DEFAULT_PERIOD,
                        $this->algorithm ?: self::DEFAULT_ALGORITHM,
                        $this->digits ?: self::DEFAULT_DIGITS
                    );
                    break;

                case self::STEAM_TOTP:
                    $this->generator = TOTP::create($this->secret, 30, self::SHA1, 5);
                    break;

                case self::HOTP:
                    $this->generator = HOTP::create(
                        $this->secret,
                        $this->counter ?: self::DEFAULT_COUNTER,
                        $this->algorithm ?: self::DEFAULT_ALGORITHM,
                        $this->digits ?: self::DEFAULT_DIGITS
                    );
                    break;

                default:
                    throw new UnsupportedOtpTypeException();
            }

            if ($this->service) {
                $this->generator->setIssuer($this->service);
            }
            if ($this->account) {
                $this->generator->setLabel($this->account);
            }
        } catch (UnsupportedOtpTypeException $exception) {
            Log::error(sprintf('%s is not an OTP type supported by the current generator', $this->otp_type));
            throw $exception;
        } catch (\Exception | \Throwable $exception) {
            throw new InvalidOtpParameterException($exception->getMessage());
        }
    }

    /**
     * Gets the image resource pointed by the image url and store it as an icon
     *
     * @return string|null The filename of the stored icon or null if the operation fails
     */
    private function storeImageAsIcon(string $url)
    {
        try {
            $path_parts  = pathinfo($url);
            $newFilename = Helpers::getUniqueFilename($path_parts['extension']);

            try {
                $response = Http::retry(3, 100)->get($url);

                if ($response->successful()) {
                    Storage::disk('imagesLink')->put($newFilename, $response->body());
                }
            } catch (\Exception $exception) {
                Log::error(sprintf('Cannot fetch imageLink at "%s"', $url));
            }

            if (
                in_array(Storage::disk('imagesLink')->mimeType($newFilename), ['image/png', 'image/jpeg', 'image/webp', 'image/bmp'])
                && getimagesize(Storage::disk('imagesLink')->path($newFilename))
            ) {
                // Should be a valid image, we move it to the icons disk
                if (Storage::disk('icons')->put($newFilename, Storage::disk('imagesLink')->get($newFilename))) {
                    Storage::disk('imagesLink')->delete($newFilename);
                }

                Log::info(sprintf('Icon file %s stored', $newFilename));
            } else {
                Storage::disk('imagesLink')->delete($newFilename);
                throw new \Exception('Unsupported mimeType or missing image on storage');
            }

            return $newFilename;
        }
        // @codeCoverageIgnoreStart
        catch (\Exception | \Throwable $ex) {
            Log::error(sprintf('Icon storage failed: %s', $ex->getMessage()));

            return null;
        }
        // @codeCoverageIgnoreEnd
    }

    /**
     * Fetch a logo in the tfa directory and store it as a new stand alone icon
     *
     * @return string|null The icon
     */
    private function getDefaultIcon()
    {
        $logoService = App::make(LogoService::class);

        return Settings::get('getOfficialIcons') ? $logoService->getIcon($this->service) : null;
    }

    /**
     * Returns an acceptable value
     */
    private function decryptOrReturn(mixed $value): mixed
    {
        // Decipher when needed
        if (Settings::get('useEncryption') && $value) {
            try {
                return Crypt::decryptString($value);
            } catch (Exception $ex) {
                return __('errors.indecipherable');
            }
        } else {
            return $value;
        }
    }

    /**
     * Encrypt a value
     */
    private function encryptOrReturn(mixed $value): mixed
    {
        // should be replaced by laravel 8 attribute encryption casting
        return Settings::get('useEncryption') ? Crypt::encryptString($value) : $value;
    }
}