access_token.class.php 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185
  1. <?php
  2. /**
  3. * An access token. Can be passed between applications to grant access.
  4. *
  5. * The token aggregate several values together (key id, api key, user id). This
  6. * is useful to pass a single value between application and avoid passing
  7. * each value as a separate parameter.
  8. *
  9. * Note that values are aggregated but not crypted. An external application could
  10. * have access to individual components.
  11. *
  12. * @see /main/auth/key_auth.class.php
  13. * @see table user_api_key
  14. *
  15. * Usage:
  16. *
  17. * Validate token:
  18. *
  19. * $data = Request::get('access_token');
  20. * $token = AccessToken::parse($data);
  21. * $token->is_valid();
  22. *
  23. * Pass token
  24. *
  25. * $token = new AccessToken(1, 1, '+*ç*%ç*ç');
  26. * $url = '.....?access_token=' . $token;
  27. *
  28. * @license see /license.txt
  29. * @author Laurent Opprecht <laurent@opprecht.info> for the Univesity of Geneva
  30. */
  31. class AccessToken
  32. {
  33. static function empty_token()
  34. {
  35. static $result = null;
  36. if (empty($result)) {
  37. $result = new self(0, 0, '');
  38. }
  39. return $result;
  40. }
  41. /**
  42. *
  43. * @param type $string
  44. * @return AccessToken
  45. */
  46. static function parse($string)
  47. {
  48. if (empty($string)) {
  49. return self::empty_token();
  50. }
  51. $data = base64_decode($string);
  52. $data = explode('/', $data);
  53. if (count($data) != 3) {
  54. return self::empty_token();
  55. }
  56. $id = $data[0];
  57. $user_id = $data[1];
  58. $key = $data[2];
  59. return new self($id, $user_id, $key);
  60. }
  61. /**
  62. *
  63. * @param int $id
  64. * @param int $user_id
  65. * @param string $key
  66. * @return AccessToken
  67. */
  68. static function create($id, $user_id, $key)
  69. {
  70. $is_valid = !empty($id) && !empty($user_id) && !empty($key);
  71. return $is_valid ? new self($id, $user_id, $key) : self::empty_token();
  72. }
  73. protected $id = 0;
  74. protected $user_id = 0;
  75. protected $key = '';
  76. /**
  77. *
  78. * @param int $id
  79. * @param int $user_id
  80. * @param string $key
  81. */
  82. function __construct($id, $user_id, $key)
  83. {
  84. $this->id = $id;
  85. $this->user_id = $user_id;
  86. $this->key = $key;
  87. }
  88. /**
  89. * The user_api_key id.
  90. *
  91. * @return int
  92. */
  93. function get_id()
  94. {
  95. return $this->id;
  96. }
  97. /**
  98. * User id.
  99. *
  100. * @return string
  101. */
  102. function get_user_id()
  103. {
  104. return $this->user_id;
  105. }
  106. /**
  107. * User api key.
  108. *
  109. * @return string
  110. */
  111. function get_key()
  112. {
  113. return $this->key;
  114. }
  115. /**
  116. * True if the token is an empty token. I.e. a no access token.
  117. *
  118. * @return bool
  119. */
  120. function is_empty()
  121. {
  122. return empty($this->id) || empty($this->user_id) || empty($this->key);
  123. }
  124. /**
  125. * Validate token against the database. Returns true if token is valid,
  126. * false otherwise.
  127. *
  128. * @return boolean
  129. */
  130. function is_valid()
  131. {
  132. if ($this->is_empty()) {
  133. return false;
  134. }
  135. $key = UserApiKeyManager::get_by_id($this->id);
  136. if (empty($key)) {
  137. return false;
  138. }
  139. if ($key['api_key'] != $this->key) {
  140. return false;
  141. }
  142. if ($key['user_id'] != $this->user_id) {
  143. return false;
  144. }
  145. $time = time();
  146. $validity_start_date = $key['validity_start_date'] ? strtotime($key['validity_start_date']) : $time;
  147. $validity_end_date = $key['validity_end_date'] ? strtotime($key['validity_end_date']) : $time + 100000;
  148. return $validity_start_date <= $time && $time <= $validity_end_date;
  149. }
  150. /**
  151. * Returns a string representation of the token that can be passed in a url or a form.
  152. * The string representation can be parsed by calling AccessToken::parse();
  153. *
  154. * @return string
  155. */
  156. function __toString()
  157. {
  158. $data[] = $this->id;
  159. $data[] = $this->user_id;
  160. $data[] = $this->key;
  161. $result = implode('/', $data);
  162. $result = base64_encode($result);
  163. return $result;
  164. }
  165. }