-
-2) Google Authentation app
-
-
-
diff --git a/Docs/Documentation/Installation.md b/Docs/Documentation/Installation.md
index 18b244230..f9d8d8e8d 100644
--- a/Docs/Documentation/Installation.md
+++ b/Docs/Documentation/Installation.md
@@ -2,7 +2,7 @@ Installation
============
Composer
-------
+--------
```
composer require cakedc/users
@@ -18,13 +18,9 @@ composer require league/oauth2-linkedin:@stable
composer require league/oauth1-client:@stable
```
-NOTE: you'll need to enable social login in your bootstrap.php file if you want to use it, social
+NOTE: you'll need to enable social login if you want to use it, social
login is disabled by default. Check the [Configuration](Configuration.md#configuration-for-social-login) page for more details.
-```
-Configure::write('Users.Social.login', true); //to enable social login
-```
-
If you want to use reCaptcha features...
```
@@ -40,12 +36,61 @@ If you want to use Google Authenticator features...
composer require robthree/twofactorauth:"^1.5.2"
```
-NOTE: you'll need to enable `Users.GoogleAuthenticator.login`
+NOTE: you'll need to enable `OneTimePasswordAuthenticator.login` in your config/users.php file:
+```php
+'OneTimePasswordAuthenticator.login' => true,
```
-Configure::write('Users.GoogleAuthenticator.login', true);
+
+Load the Plugin
+---------------
+
+Ensure the Users Plugin is loaded in your src/Application.php file
+
+```
+ /**
+ * {@inheritdoc}
+ */
+ public function bootstrap()
+ {
+ parent::bootstrap();
+
+ $this->addPlugin(\CakeDC\Users\Plugin::class);
+ // Uncomment the line below to load your custom users.php config file
+ //Configure::write('Users.config', ['users']);
+ }
```
+**Important note: The plugin loads authentication and authorization plugin and
+uses RequestAuthorizationMiddleware with Rbac|Superuser policy you
+should not load then manually**
+
+Creating config files
+---------------------
+You need to create the file config/users.php to configure the plugin. This documentation
+assumes that you will create this file.
+
+Example config/users.php
+
+```php
+ true,
+];
+```
+
+***The plugin loads authentication and authorization plugins by default,
+to be able to access your pages you NEED to have defined rules at the
+file config/permissions.php.
+You can copy the one from the plugin and add your permissions rules.***
+
+```shell
+cd {project_dir}
+cp vendor/cakedc/users/config/permissions.php config/permissions.php
+```
+[Go to permission documentation for more information.](./Permissions.md)
+
+
Creating Required Tables
------------------------
If you want to use the Users tables to store your users and social accounts:
@@ -58,28 +103,26 @@ Note you don't need to use the provided tables, you could customize the table na
application and then use the plugin configuration to use your own tables instead. Please refer to the [Extending the Plugin](Extending-the-Plugin.md)
section to check all the customization options
-Load the Plugin
------------
-
-Ensure the Users Plugin is loaded in your config/bootstrap.php file
+You can create the first user, the super user by issuing the following command
```
-Plugin::load('CakeDC/Users', ['routes' => true, 'bootstrap' => true]);
+bin/cake users addSuperuser
```
Customization
-----------
+-------------
-config/bootstrap.php
+First, make sure to set the config `Users.config` at Application::bootstrap
```
+$this->addPlugin(\CakeDC\Users\Plugin::class);
Configure::write('Users.config', ['users']);
-Plugin::load('CakeDC/Users', ['routes' => true, 'bootstrap' => true]);
-Configure::write('Users.Social.login', true); //to enable social login
```
-If you want to use social login, then in your config/users.php
-```
+And update your config/users.php file, for example if you want to use social login:
+```php
+ true,
'OAuth.providers.facebook.options.clientId' => 'YOUR APP ID',
'OAuth.providers.facebook.options.clientSecret' => 'YOUR APP SECRET',
'OAuth.providers.twitter.options.clientId' => 'YOUR APP ID',
@@ -87,7 +130,7 @@ return [
//etc
];
```
-IMPORTANT: Remember you'll need to configure your social login application **callback url** to use the provider specific endpoint, for example:
+IMPORTANT: Remember you'll need to configure your social login application **callback url** to use the provider specific endpoint, for example:
* Facebook App Callback URL --> `http://yourdomain.com/auth/facebook`
* Twitter App Callback URL --> `http://yourdomain.com/auth/twitter`
* Google App Callback URL --> `http://yourdomain.com/auth/google`
@@ -96,20 +139,3 @@ IMPORTANT: Remember you'll need to configure your social login application **cal
Note: using social authentication is not required.
For more details, check the Configuration doc page
-
-Load the UsersAuth Component
----------------------
-
-Load the Component in your src/Controller/AppController.php, and use the passed Component configuration to customize the Users Plugin:
-
-```
- public function initialize()
- {
- parent::initialize();
-
- // Important: add the 'enableBeforeRedirect' config or or disable deprecation warnings
- $this->loadComponent('RequestHandler', ['enableBeforeRedirect' => false]);
- $this->loadComponent('Flash');
- $this->loadComponent('CakeDC/Users.UsersAuth');
- }
-```
diff --git a/Docs/Documentation/InterceptLoginAction.md b/Docs/Documentation/InterceptLoginAction.md
new file mode 100644
index 000000000..2e27b868d
--- /dev/null
+++ b/Docs/Documentation/InterceptLoginAction.md
@@ -0,0 +1,48 @@
+Intercept Login Action
+======================
+
+There is a moment when you may want to intercept the login action to perform
+some specific login, like redirect user to another url or set user data.
+A simple way to intercept the login action is by creating a custom middleware, the following
+example shows how to set user data and redirect to anothe url.
+
+```php
+checkActionOnRequest('login', $request)) {
+ return $next($request, $response);
+ }
+
+ if (!$request->getAttribute('session')->read('Auth')) {
+ //do some logic
+ //do more logic
+ $request->getAttribute('session')->write('Auth', $userIdentity);
+
+ $response = $response->withHeader('Location', '/pages/33');
+
+ return $response;
+ }
+
+ return $next($request, $response);
+ }
+
+}
+```
+
diff --git a/Docs/Documentation/Migration/8.x-9.0.md b/Docs/Documentation/Migration/8.x-9.0.md
new file mode 100644
index 000000000..c375d89cd
--- /dev/null
+++ b/Docs/Documentation/Migration/8.x-9.0.md
@@ -0,0 +1,131 @@
+Migration 8.x to 9.0
+======================
+
+The 9.0 version uses the new plugins cakephp/authentication[(read more)](../Authentication.md) and cakephp/authorization[(read more)](../Authorization.md) instead of CakePHP
+Authentication component. This version is compatible with CakePHP 4.x and the plugin
+code was updated to remove all deprecations.
+
+Configuration file users.php
+----------------------------
+We have added/removed/changed some configurations to work with new authentication/authorization
+plugins, if you created a custom config file, please compare your file with the default
+config/users.php from this plugin.
+
+* Users.middlewareQueueLoader was added;
+
+* Users.auth was removed since AuthComponent is not used;
+
+* Users.Social.authenticator was removed in favor of Auth.Authenticators.Social and Auth.Identifiers.Social;
+
+* Users.GoogleAuthenticator was renamed to OneTimePasswordAuthenticator;
+
+* GoogleAuthenticator was renamed to OneTimePasswordAuthenticator;
+
+* Auth.authenticate was removed in favor of Auth.Authentication, Auth.AuthenticationComponent,
+Auth.Authenticators, Auth.Identifiers
+
+* Auth.authorize was removed in favor of Auth.Authorization, Auth.AuthorizationMiddleware,
+Auth.AuthorizationComponent
+
+* Added Auth.SocialLoginFailure to handle social login
+
+* Added Auth.FormLoginFailure to handle form login
+
+* CakeDC/Auth was upgraded and now has a better way to handle social login.
+Oauth providers config like OAuth.providers.facebook requires two new config keys, 'service' and 'mapper'.
+
+* Users.controller config now is also used in mapping users routes (/login, register).
+You need to give permissions to your new controller actions.
+
+* Users controller rely on CakeDC/Users.Setup Component, when using a custom users controller make sure to load it.
+```php
+
+ /**
+ * Initialize
+ *
+ * @return void
+ */
+ public function initialize()
+ {
+ parent::initialize();
+ $this->loadComponent('CakeDC/Users.Setup');
+ if ($this->components()->has('Security')) {
+ $this->Security->setConfig(
+ 'unlockedActions',
+ ['login', 'u2fRegister', 'u2fRegisterFinish', 'u2fAuthenticate', 'u2fAuthenticateFinish']
+ );
+ }
+ }
+```
+
+Loading the Plugin
+------------------
+In this version you need to load the plugin in your [Application class](https://github.com/cakephp/app/blob/master/src/Application.php).
+```
+ /**
+ * {@inheritDoc}
+ */
+ public function bootstrap()
+ {
+ // Call parent to load bootstrap from files.
+ parent::bootstrap();
+
+ //your code
+
+ $this->addPlugin(\CakeDC\Users\Plugin::class);
+ }
+```
+
+Renamed Events
+--------------
+All events constants were moved from AuthComponent to Plugin class and
+their values was also updated.
+
+* `Users.Component.UsersAuth.afterLogin` renamed to `Users.Authentication.afterLogin`
+* `Users.Component.UsersAuth.beforeLogout` renamed to `Users.Authentication.beforeLogout`
+* `Users.Component.UsersAuth.afterLogout` renamed to `Users.Authentication.afterLogout`
+* `Users.Component.UsersAuth.beforeRegister` renamed to `Users.Global.beforeRegister`
+* `Users.Component.UsersAuth.afterRegister` renamed to `Users.Global.afterRegister`
+* `Users.Component.UsersAuth.afterResetPassword` renamed to `Users.Global.afterResetPassword`
+* `Users.Component.UsersAuth.beforeSocialLoginUserCreate` renamed to `Users.Global.beforeSocialLoginUserCreate`
+* `Users.Component.UsersAuth.onExpiredToken` renamed to `Users.Global.onExpiredToken`
+* `Users.Component.UsersAuth.afterResendTokenValidation` renamed to `Users.Global.afterResendTokenValidation`
+
+Removed Events
+--------------
+* `Users.Component.UsersAuth.isAuthorized` use cakephp\authorization components or \CakeDC\Auth\Traits\IsAuthorizedTrait instead.
+* `Users.Component.UsersAuth.beforeLogin` implement a middleware before authetication middleware.
+* `Users.Component.UsersAuth.failedSocialLogin`
+* `Users.Component.UsersAuth.afterCookieLogin`
+
+Getting Authenticated User
+--------------------------
+
+In previous version you usually used AuthComponent to get the authenticated
+user, now you should use the provided 'identity' attribute, you can do this
+in your controller.
+
+```
+$user = $this->getRequest()->getAttribute('identity');
+if ($user) {
+ //Do stuff
+}
+```
+
+Settting user data in session for unit tests
+--------------------------------------------
+
+Authentication process read and store user data at session key 'Auth' not 'Auth.User' and the
+value should be an User object.
+
+In your integration test class replace this:
+
+```
+$this->session(['Auth.User' => $userData]);
+```
+
+with
+
+```
+$this->session(['Auth' => new \CakeDC\Users\Model\Entity\User($userData)]);
+```
\ No newline at end of file
diff --git a/Docs/Documentation/GoogleAuthenticator/App.png b/Docs/Documentation/OneTimePasswordAuthenticator/App.png
similarity index 100%
rename from Docs/Documentation/GoogleAuthenticator/App.png
rename to Docs/Documentation/OneTimePasswordAuthenticator/App.png
diff --git a/Docs/Documentation/GoogleAuthenticator/FirstLogin.png b/Docs/Documentation/OneTimePasswordAuthenticator/FirstLogin.png
similarity index 100%
rename from Docs/Documentation/GoogleAuthenticator/FirstLogin.png
rename to Docs/Documentation/OneTimePasswordAuthenticator/FirstLogin.png
diff --git a/Docs/Documentation/Permissions.md b/Docs/Documentation/Permissions.md
new file mode 100644
index 000000000..d2b55f20f
--- /dev/null
+++ b/Docs/Documentation/Permissions.md
@@ -0,0 +1,183 @@
+Permissions
+===========
+The plugin is setup to perform permissions check for all requests using
+Superuser and Rbac policies.
+
+Superuser policy allow the superuser to access any page.
+
+The Rbac policy allows you to define a list of rules at config/permissions.php
+to perform checks based on request information (prefix, plugin, controller, action, etc)
+and user data.
+
+You can find the permission rule syntax at [CakeDC/auth documentation.](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/Rbac.md#permission-rules-syntax)
+
+I want to allow access to public actions (non-logged user)
+----------------------------------------------------------
+To allow access to public actions (that does not requires a looged) we need to include a new rule at config/permissions.php
+using the 'bypassAuth' key.
+
+```php
+ [
+ //...... all other rules
+ [
+ 'controller' => 'Pages',
+ 'action' => ['home', 'contact', 'projects']
+ 'bypassAuth' => true,
+ ],
+ ],
+];
+```
+
+I want to allow access to one specific action
+---------------------------------------------
+To allow access to specific action we need to include a new rule at config/permissions.php
+
+- Path: /{controler}/{action}
+```php
+ [
+ //...... all other rules
+ [
+ //Allow user, manager and author roles to access /books
+ 'role' => ['user', 'manager', 'author'],
+ 'controller' => 'Books',
+ 'action' => 'index',
+ ],
+ [
+ //Allow user to access /dashboard/home
+ 'role' => 'user',
+ 'controller' => 'Dashbord',
+ 'action' => 'home',
+ ],
+ [
+ //Allow user to access /articles, /articles/add and /article/edit
+ 'role' => ['manager'],
+ 'controller' => 'Articles',
+ 'action' => ['index', 'add', 'edit'],
+ ],
+ ],
+];
+```
+
+- Path: /{plugin}/{prefix}/{controler}/{action}
+```php
+ [
+ //...... all other rules
+ [
+ //Allow user to access /reports/admin/categories
+ 'plugin' => 'Reports',
+ 'prefix' => 'Admin',
+ 'role' => ['manager'],
+ 'controller' => 'Categories',
+ 'action' => ['index'],
+ ],
+ ],
+];
+```
+
+I want to allow access to all actions from one controller
+---------------------------------------------------------
+To allow access to specific all actions from one controller we need to include a new rule at config/permissions.php
+using the value '*' for 'action' key.
+
+```php
+ [
+ //...... all other rules
+ [
+ //Allow user, manager and author roles to access any action from books controller
+ 'role' => ['user', 'manager', 'author'],
+ 'controller' => 'Books',
+ 'action' => '*',
+ ],
+ ]
+];
+```
+
+I want to allow access to all controllers from one prefix
+---------------------------------------------
+To allow access to specific to all pages from one prefix we need to include a new rule at config/permissions.php
+using the value '*' for 'plugin', 'controller' and 'action' keys.
+
+```php
+ [
+ //...... all other rules
+ [
+ //Allow user, manager and author roles to access any action from books controller
+ 'role' => ['user', 'manager', 'author'],
+ 'plugin' => '*',
+ 'prefix' => 'Admin',
+ 'controller' => '*',
+ 'action' => '*',
+ ],
+ ],
+];
+```
+
+I want to allow access to entity owned by the user
+--------------------------------------------------
+To allow access to entity owned by the user we need to include a new rule
+at config/permissions.php using the 'allowed' key.
+
+```php
+ [
+ //...... all other rules
+ [
+ //
+ 'role' => 'user',
+ 'controller' => 'Articles',
+ 'action' => ['edit']
+ 'allowed' => new \CakeDC\Auth\Rbac\Rules\Owner([
+ 'table' => 'Articles',
+ 'id' => 'id',
+ 'ownerForeignKey' => 'owner_id'
+ ]),
+ ],
+ ],
+];
+```
+
+[For more information check owner rule documentation](https://github.com/CakeDC/auth/blob/6.next-cake4/Docs/Documentation/OwnerRule.md)
+
+
+I want to allow access to action using a custom logic
+----------------------------------------------------
+Permission rule can have a custom callback. Adde the rule at config/permissions.php using the 'allowed' key.
+
+```php
+ [
+ //...... all other rules
+ [
+ //
+ 'role' => 'user',
+ 'controller' => 'Posts',
+ 'action' => ['edit']
+ 'allowed' => function (array $user, $role, \Cake\Http\ServerRequest $request) {
+ $postId = \Cake\Utility\Hash::get($request->params, 'pass.0');
+ $post = \Cake\ORM\TableRegistry::get('Posts')->get($postId);
+ $userId = $user['id'];
+ if (!empty($post->user_id) && !empty($userId)) {
+ return $post->user_id === $userId;
+ }
+ return false;
+ }
+ ],
+ ],
+];
+```
+
+[For more information check CakeDC/Auth documentation](https://github.com/CakeDC/auth/blob/6.next-cake4/Docs/Documentation/Rbac.md#permission-callbacks)
+
+
diff --git a/Docs/Documentation/SocialAuthenticate.md b/Docs/Documentation/SocialAuthenticate.md
deleted file mode 100644
index 937039366..000000000
--- a/Docs/Documentation/SocialAuthenticate.md
+++ /dev/null
@@ -1,97 +0,0 @@
-SocialAuthenticate
-=============
-
-We currently support the following providers to perform login as well as to link an existing account:
-
-* Facebook
-* Twitter
-* Google
-* LinkedIn
-* Instagram
-* Amazon
-
-Please [contact us](https://cakedc.com/contact) if you need to support another provider.
-
-Setup
----------------------
-
-Create the Facebook/Twitter applications you want to use and setup the configuration like this:
-
-Config/bootstrap.php
-```
-Configure::write('OAuth.providers.facebook.options.clientId', 'YOUR APP ID');
-Configure::write('OAuth.providers.facebook.options.clientSecret', 'YOUR APP SECRET');
-
-Configure::write('OAuth.providers.twitter.options.clientId', 'YOUR APP ID');
-Configure::write('OAuth.providers.twitter.options.clientSecret', 'YOUR APP SECRET');
-```
-
-You can also change the default settings for social authenticate:
-
-```
-Configure::write('Users', [
- 'Email' => [
- //determines if the user should include email
- 'required' => true,
- //determines if registration workflow includes email validation
- 'validate' => true,
- ],
- 'Social' => [
- //enable social login
- 'login' => false,
- ],
- 'Key' => [
- 'Session' => [
- //session key to store the social auth data
- 'social' => 'Users.social',
- ],
- //form key to store the social auth data
- 'Form' => [
- 'social' => 'social'
- ],
- 'Data' => [
- //data key to store email coming from social networks
- 'socialEmail' => 'info.email',
- ],
- ],
-]);
-```
-
-If email is required and the social network does not return the user email then the user will be required to input the email. Additionally, validation could be enabled, in that case the user will be asked to validate the email before be able to login. There are some cases where the email address already exists onto database, if so, the user will receive an email and will be asked to validate the social account in the app. It is important to take into account that the user account itself will remain active and accessible by other ways (other social network account or username/password).
-
-In most situations you would not need to change any Oauth setting besides applications details.
-
-For new facebook aps you must use the graphApiVersion 2.8 or greater:
-
-```
-Configure::write('OAuth.providers.facebook.options.graphApiVersion', 'v2.8');
-```
-
-User Helper
----------------------
-
-You can use the helper included with the plugin to create Facebook/Twitter buttons:
-
-In templates
-```
-$this->User->facebookLogin();
-
-$this->User->twitterLogin();
-```
-
-We recommend the use of [Bootstrap Social](http://lipis.github.io/bootstrap-social/) in order to automatically apply styles to buttons. Anyway you can always add your own style to the buttons.
-
-Social Authentication was inspired by [UseMuffin/OAuth2](https://github.com/UseMuffin/OAuth2) library.
-
-Custom username field
----------------------
-
-In your customized users table, add the SocialBehavior with the following configuration:
-
-```php
-$this->addBehavior('CakeDC.Users/Social', [
- 'username' => 'email'
-]);
-```
-
-By default it will use `username` field.
diff --git a/Docs/Documentation/SocialAuthentication.md b/Docs/Documentation/SocialAuthentication.md
new file mode 100644
index 000000000..f74b36e7a
--- /dev/null
+++ b/Docs/Documentation/SocialAuthentication.md
@@ -0,0 +1,171 @@
+Social Authentication
+=====================
+
+We currently support the following providers to perform login as well as to link an existing account:
+
+* Facebook
+* Twitter
+* Google
+* LinkedIn
+* Instagram
+* Amazon
+
+Please [contact us](https://cakedc.com/contact) if you need to support another provider.
+
+The main source code for social integration is provided by ['CakeDC/auth' plugin](https://github.com/cakedc/auth)
+
+Setup
+-----
+By default social login is disabled, to enable you need to create the
+Facebook/Twitter applications you want to use and update your file config/users.php with:
+
+```php
+//This enable social login (authentication)
+'Users.Social.login' => true,
+//This is the required config to setup facebook.
+'OAuth.providers.facebook.options.clientId', 'YOUR APP ID';
+'OAuth.providers.facebook.options.clientSecret', 'YOUR APP SECRET';
+//This is the required config to setup twitter
+'OAuth.providers.twitter.options.clientId', 'YOUR APP ID';
+'OAuth.providers.twitter.options.clientSecret', 'YOUR APP SECRET';
+```
+Check optional configs at [config/users.php](./../../config/users.php) inside 'OAuth' key
+
+
+You can also change the default settings for social authenticate in your config/users.php file:
+
+```php
+ 'Users.Email' => [
+ //determines if the user should include email
+ 'required' => true,
+ //determines if registration workflow includes email validation
+ 'validate' => true,
+ ],
+ 'Users.Social' => [
+ //enable social login
+ 'login' => false,
+ ],
+ 'Users.Key' => [
+ 'Session' => [
+ //session key to store the social auth data
+ 'social' => 'Users.social',
+ ],
+ //form key to store the social auth data
+ 'Form' => [
+ 'social' => 'social'
+ ],
+ 'Data' => [
+ //data key to store email coming from social networks
+ 'socialEmail' => 'info.email',
+ ],
+ ],
+```
+
+If email is required and the social network does not return the user email then the user will be required to input the email. Additionally, validation could be enabled, in that case the user will be asked to validate the email before be able to login. There are some cases where the email address already exists onto database, if so, the user will receive an email and will be asked to validate the social account in the app. It is important to take into account that the user account itself will remain active and accessible by other ways (other social network account or username/password).
+
+In most situations you would not need to change any Oauth setting besides applications details.
+
+For new facebook aps you must use the graphApiVersion 2.8 or greater:
+
+```php
+'OAuth.providers.facebook.options.graphApiVersion' => 'v2.8',
+```
+
+User Helper
+-----------
+
+You can use the helper included with the plugin to create Facebook/Twitter buttons:
+
+In templates
+```php
+$this->User->facebookLogin();
+
+$this->User->twitterLogin();
+```
+
+We recommend the use of [Bootstrap Social](http://lipis.github.io/bootstrap-social/) in order to automatically apply styles to buttons. Anyway you can always add your own style to the buttons.
+
+Social Authentication was inspired by [UseMuffin/OAuth2](https://github.com/UseMuffin/OAuth2) library.
+
+Custom username field
+---------------------
+
+In your customized users table, add the SocialBehavior with the following configuration:
+
+```php
+$this->addBehavior('CakeDC/Users.Social', [
+ 'username' => 'email'
+]);
+```
+Or if you extend the users table, the behavior is already loaded, so just configure it with:
+```php
+$this->behaviors()->get('Social')->config(['username' => 'email']);
+```
+
+By default it will use `username` field.
+
+
+Social Middlewares
+------------------
+We provide two middleware to help us the integration with social providers, the SocialAuthMiddleware is
+the main one, it is responsible to redirect the user to the social provider site and setup information
+needed by the CakeDC/Users.Social authenticator. The second one SocialEmailMiddleware is used when social provider does
+not returns user email.
+
+Social Authenticators
+---------------------
+The social authentication works with cakephp/authentication, we have two authenticators they work
+in combination with the two social middlewares:
+ - CakeDC/Users.Social, works with SocialAuthMiddleware
+ - CakeDC/Users.SocialPendingEmai, works with SocialEmailMiddleware
+
+
+Social Indentifier
+------------------
+The social identifier "CakeDC/Users.Social", works with data provider by both social authenticator,
+it is responsible of finding or creating a user registry for the social user data request.
+By default, it'll fetch user data with finder 'all', but you can use a custom one. Add this to your
+config/users.php:
+
+```php
+'Auth.Identifiers.Social.authFinder' => 'customSocialAuth',
+```
+
+
+Handling Social Login Result
+----------------------------
+We use a base component 'CakeDC/Users.Login' to handle login, it checks the result of authentication
+service to redirects user to an internal page or show an authentication error. It provide some error messages for social login.
+There are two custom messages (Auth.SocialLoginFailure.messages) and one default message (Auth.SocialLoginFailure.defaultMessage).
+
+
+To use a custom component to handle the login add this to your config/users.php file:
+```php
+'Auth.SocialLoginFailure.component' => 'MyLoginA',
+```
+
+The default configuration is:
+```php
+[
+ ...
+ 'Auth' => [
+ ...
+ 'SocialLoginFailure' => [
+ 'component' => 'CakeDC/Users.Login',
+ 'defaultMessage' => __d('cake_d_c/users', 'Could not proceed with social account. Please try again'),
+ 'messages' => [
+ 'FAILURE_USER_NOT_ACTIVE' => __d(
+ 'cake_d_c/users',
+ 'Your user has not been validated yet. Please check your inbox for instructions'
+ ),
+ 'FAILURE_ACCOUNT_NOT_ACTIVE' => __d(
+ 'cake_d_c/users',
+ 'Your social account has not been validated yet. Please check your inbox for instructions'
+ )
+ ],
+ 'targetAuthenticator' => 'CakeDC\Users\Authenticator\SocialAuthenticator'
+ ],
+ ...
+ ]
+]
+```
diff --git a/Docs/Documentation/Translations.md b/Docs/Documentation/Translations.md
index 41abc4e08..d9cc74def 100644
--- a/Docs/Documentation/Translations.md
+++ b/Docs/Documentation/Translations.md
@@ -10,8 +10,9 @@ The Plugin is translated into several languages:
* Polish (pl) by @joulbex
* Hungarian (hu_HU) by @rrd108
* Italian (it) by @arturmamedov
-* Turkish (tr_TR) by @sayinserdar
+* Turkish (tr_TR) by @sayinserdar
+* Ukrainian (uk) by @yarkm13
-**Note:** To overwrite the plugin translations, create a file inside your project 'src/Locale/{$lang}/' folder, with the name 'Users.po' and add the strings with the new translations.
+**Note:** To overwrite the plugin translations, create a file inside your project 'resources/locales//{$lang}/' folder, with the name 'users.po' and add the strings with the new translations.
Remember to clean the translations cache!
diff --git a/Docs/Documentation/Two-Factor-Authenticator.md b/Docs/Documentation/Two-Factor-Authenticator.md
new file mode 100644
index 000000000..022445a01
--- /dev/null
+++ b/Docs/Documentation/Two-Factor-Authenticator.md
@@ -0,0 +1,54 @@
+Two Factor Authenticator
+===============================
+The plugin offers an easy way to integrate OTP Two-Factor authentication
+in the users login flow of your application.
+
+
+Installation Requirement
+------------------------
+Before you enable the feature you need to run
+
+```
+composer require robthree/twofactorauth
+```
+
+By default the feature is disabled.
+
+Enabling
+--------
+
+First install robthree/twofactorauth using composer:
+
+```
+composer require robthree/twofactorauth
+```
+
+Then add this in your config/users.php file:
+
+```php
+ 'OneTimePasswordAuthenticator.login' => true,
+```
+
+Disabling
+---------
+You can disable it by adding this in your config/users.php file:
+
+```php
+ 'OneTimePasswordAuthenticator.login' => false,
+```
+
+How does it work
+----------------
+When the user log-in, he is requested (image 1) to inform the current validation
+code for your site in Google Authentation app (image 2), if this is the first
+time he access he need to add your site to Google Authentation by reading
+the QR code shown (image 1).
+
+1) Validation code page
+
+
+
+2) Google Authentation app
+
+
+
diff --git a/Docs/Documentation/Yubico-U2F.md b/Docs/Documentation/Yubico-U2F.md
new file mode 100644
index 000000000..73511f16c
--- /dev/null
+++ b/Docs/Documentation/Yubico-U2F.md
@@ -0,0 +1,37 @@
+YubicoKey U2F
+=============
+
+The plugin offers an easy way to integrate U2F in the users login flow
+of your application.
+
+Enabling
+--------
+
+First install yubico/u2flib-server using composer:
+
+```
+composer require yubico/u2flib-server:^1.0
+```
+
+Then add this in your config/users.php file:
+
+```php
+ 'U2f.enabled' => true,
+```
+
+Disabling
+---------
+You can disable it by adding this in your config/users.php file:
+
+```php
+ 'U2f.enabled' => false,
+```
+
+How does it work
+----------------
+When the user log-in, he is requested to insert and tap his registered yubico key,
+if this is the first time he access he need to register the yubico key.
+
+Please check the yubico site for more information about U2F
+https://developers.yubico.com/U2F/
+
diff --git a/Docs/Home.md b/Docs/Home.md
index 378d61db9..4223b0e82 100644
--- a/Docs/Home.md
+++ b/Docs/Home.md
@@ -13,20 +13,236 @@ Documentation
* [Overview](Documentation/Overview.md)
* [Installation](Documentation/Installation.md)
* [Configuration](Documentation/Configuration.md)
+* [Authentication](Documentation/Authentication.md)
+* [Authorization](Documentation/Authorization.md)
* [SimpleRbacAuthorize](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/SimpleRbacAuthorize.md)
* [SuperuserAuthorize](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/SuperuserAuthorize.md)
-* [ApiKeyAuthenticate](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/ApiKeyAuthenticate.md)
-* [SocialAuthenticate](Documentation/SocialAuthenticate.md)
-* [Google Authenticator](Documentation/Google-Two-Factor-Authenticator.md)
+* [Intercept Login Action](Documentation/InterceptLoginAction.md)
+* [Social Authentication](Documentation/SocialAuthentication.md)
+* [Google Authenticator](Documentation/Two-Factor-Authenticator.md)
+* [Yubico U2F](Documentation/Yubico-U2F.md)
* [UserHelper](Documentation/UserHelper.md)
+* [AuthLinkHelper](Documentation/AuthLinkHelper.md)
* [Events](Documentation/Events.md)
* [Extending the Plugin](Documentation/Extending-the-Plugin.md)
* [Translations](Documentation/Translations.md)
+I want to
+---------
+* extend the
+ * [model](Documentation/Extending-the-Plugin.md#extending-the-model-tableentity)
+ * [controller](Documentation/Extending-the-Plugin.md#extending-the-controller)
+ * [templates](Documentation/Extending-the-Plugin.md#updating-the-templates)
+
+* enable or disable
+ *
+
+ * email validation
+ + Add this to your config/users.php file to disable email validation + + ```php + 'Users.Email.validate' => false, + ``` + or this to enable (default) + + ```php + 'Users.Email.validate' => true, + ``` +
+
+ * registration
+ + Add this to your config/users.php file to disable registration + + ```php + 'Users.Registration.active' => false, + ``` + or this to enable (default) + + ```php + 'Users.Registration.active' => true, + ``` +
+
+ * reCaptcha on registration
+ + To enable reCaptcha you need to register your site at google reCaptcha console + and add this to your config/users.php file to enable on registration: + + ```php + 'Users.reCaptcha.key' => 'YOUR RECAPTCHA KEY', + 'Users.reCaptcha.secret' => 'YOUR RECAPTCHA SECRET', + 'Users.reCaptcha.registration' => true, + ``` + To disable (default) add this to your config/users.php + + ```php + 'Users.reCaptcha.registration' => false, + ``` +
+
+ * [social login](./Documentation/SocialAuthentication.md#setup)
+ * [OTP Two-factor authenticator](./Documentation/Two-Factor-Authenticator.md)
+ * [Yubico Key U2F Two-factor authenticator](./Documentation/Yubico-U2F.md)
+ * reCaptcha on login
+ + To enable reCaptcha you need to register your site at google reCaptcha console + and add this to your config/users.php file to enable on login: + + ```php + 'Users.reCaptcha.key' => 'YOUR RECAPTCHA KEY', + 'Users.reCaptcha.secret' => 'YOUR RECAPTCHA SECRET', + 'Users.reCaptcha.login' => true, + ``` + To disable (default) add this to your config/users.php + + ```php + 'Users.reCaptcha.login' => false, + ``` +
+
+ * Authentication component
+ + Add this to your config/users.php file to autoload the component (default): + + ```php + 'Auth.AuthenticationComponent.load' => true, + ``` + + To not autoload add this to your config/users.php + + ```php + 'Auth.AuthenticationComponent.load' => false, + ``` +
+
+
+ * Authorization component
+ + Add this to your config/users.php file to autoload the component (default): + + ```php + 'Auth.AuthorizationComponent.enabled' => true, + ``` + + To not autoload add this to your config/users.php + + ```php + 'Auth.AuthorizationComponent.enabled' => false, + ``` +
+
+
+ * TOS validation
+ + Add this to your config/users.php file to enable (default): + + ```php + 'Users.Tos.required' => true, + ``` + + To disable add this to your config/users.php + + ```php + 'Users.Tos.required' => false, + ``` +
+
+
+- allow access to
+ - [public actions (non-logged user)](./Documentation/Permissions.md#i-want-to-allow-access-to-public-actions-non-logged-user)
+ - [one specific action](./Documentation/Permissions.md#i-want-to-allow-access-to-one-specific-action)
+ - [all actions from one controller](./Documentation/Permissions.md#i-want-to-allow-access-to-all-actions-from-one-controller)
+ - [all controllers from one prefix](./Documentation/Permissions.md#i-want-to-allow-access-to-all-controllers-from-one-prefix)
+ - [entity owned by the user](./Documentation/Permissions.md#i-want-to-allow-access-to-entity-owned-by-the-user)
+ - [action using a custom logic](./Documentation/Permissions.md#i-want-to-allow-access-to-action-using-a-custom-logic)
+
+- customize my login page to
+ - remember me
+ + Add this to your config/users.php file to enable (default): + + ```php + 'Users.RememberMe.active' => true, + ``` + + To disable add this to your config/users.php + + ```php + 'Users.RememberMe.active' => false, + ``` +
+
+
+ - use my template
+ Copy the login file from `{project_dir}/vendor/cakedc/users/templates/Users/` + to `{project_dir}/templates/plugin/CakeDC/Users/Users`. +
+
+
+ - use a custom finder
+ First add this to your config/users.php: + + ``` + 'Auth.Identifiers.Password.resolver.finder' => 'myFinderName', + 'Auth.Identifiers.Social.authFinder' => 'myFinderName', + 'Auth.Identifiers.Token.resolver.finder' => 'myFinderName', + ``` + Important: You must have extended the model, see how to at [Extending the Plugin](Documentation/Extending-the-Plugin.md) +
+
+
+ - use a custom redirect url
+ To use a custom redirect url on login add this to your config/users.php: + + ``` + 'Auth.AuthenticationComponent.loginRedirect' => '/some/url/', + ``` + or + ``` + 'Auth.AuthenticationComponent.loginRedirect' => ['plugin' => false, 'controller' => 'Example', 'action' => 'home'], + ``` + Important: when using array you should pass `'plugin' => false,` to match your app controller. +
+
+ - [use user's email to login](./Documentation/Configuration.md#using-the-users-email-to-login)
+ - [override the password hasher](./Documentation/Configuration.md#password-hasher-customization)
+
+- add custom logic before
+ - [user logout](./Documentation/Events.md#i-want-to-add-custom-logic-before-user-logout)
+ - [user register](./Documentation/Events.md#i-want-to-add-custom-logic-before-user-register)
+ - [linking social account](./Documentation/Events.md#i-want-to-add-custom-logic-before-linking-social-account)
+ - [creating social account](./Documentation/Events.md#i-want-to-add-custom-logic-before-creating-social-account)
+
+- add custom logic after
+ - [user login](./Documentation/Events.md#i-want-to-add-custom-logic-after-user-login)
+ - [user logout](./Documentation/Events.md#i-want-to-add-custom-logic-after-user-logout)
+ - [user register](./Documentation/Events.md#i-want-to-add-custom-logic-after-user-register)
+ - [user changed the password](./Documentation/Events.md#i-want-to-add-custom-logic-after-user-changed-the-password)
+ - [sending the token for user validation](./Documentation/Events.md#i-want-to-add-custom-logic-after-sending-the-token-for-user-validation)
+ - [user email is validated](./Documentation/Events.md#i-want-to-add-custom-logic-after-user-email-is-validated)
+ - [user email is validated to autologin user](./Documentation/Events.md#i-want-to-add-custom-logic-after-user-email-is-validated-to-autologin-user)
+ - [intercept login action](./Documentation/InterceptLoginAction.md)
+
+
Migration guides
----------------
* [4.x to 5.0](Documentation/Migration/4.x-5.0.md)
* [6.x to 7.0](Documentation/Migration/6.x-7.0.md)
-
-
+* [8.x to 9.0](Documentation/Migration/8.x-9.0.md)
diff --git a/README.md b/README.md
index 1c213f6a7..fbd5af5f4 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
CakeDC Users Plugin
===================
-[](http://travis-ci.org/CakeDC/users)
+[](https://github.com/CakeDC/users/actions?query=workflow%3ACI+branch%3Amaster)
[](https://codecov.io/gh/CakeDC/users)
[](https://packagist.org/packages/CakeDC/users)
[](https://packagist.org/packages/CakeDC/users)
@@ -12,16 +12,19 @@ Versions and branches
| CakePHP | CakeDC Users Plugin | Tag | Notes |
| :-------------: | :------------------------: | :--: | :---- |
-| ^3.6 | [master](https://github.com/cakedc/users/tree/master) | 7.0.0 | stable |
-| ^3.6 | [develop](https://github.com/cakedc/users/tree/develop) | - | unstable |
-| 3.5 | [6.x](https://github.com/cakedc/users/tree/6.x) | 6.0.1 | stable |
-| 3.4 | [5.x](https://github.com/cakedc/users/tree/5.x) | 5.2.0 | stable |
-| 3.3 | [4.x](https://github.com/cakedc/users/tree/4.x) | 4.2.0 | stable |
-| 2.x | [2.x](https://github.com/cakedc/users/tree/2.x) | 2.2.0 |stable |
+| ^4.3 | [master](https://github.com/cakedc/users/tree/master) | 11.0.0 | stable |
+| ^4.3 | [11.0](https://github.com/cakedc/users/tree/11.next-cake4) | 11.0.0 | stable |
+| ^4.0 | [9.0](https://github.com/cakedc/users/tree/9.next) | 9.0.5 | stable |
+| ^3.7 <4.0 | [8.5](https://github.com/cakedc/users/tree/8.next) | 8.5.1 | stable |
+| ^3.7 <4.0 | [develop](https://github.com/cakedc/users/tree/develop) | - | unstable |
+| 3.6 | [8.1](https://github.com/cakedc/users/tree/8.1.0) | 8.1.0 | stable |
+| 3.5 | [6.x](https://github.com/cakedc/users/tree/6.x) | 6.0.1 | stable |
+| 3.4 | [5.x](https://github.com/cakedc/users/tree/5.x) | 5.2.0 | stable |
+| >=3.2.9 <3.4.0 | [4.x](https://github.com/cakedc/users/tree/4.x) | 4.2.1 | stable |
+| ^2.10 | [2.x](https://github.com/cakedc/users/tree/2.x) | 2.2.0 |stable |
+
+The **Users** plugin covers the following features:
-The **Users** plugin is back!
-
-It covers the following features:
* User registration
* Login/logout
* Social login (Facebook, Twitter, Instagram, Google, Linkedin, etc)
@@ -29,8 +32,11 @@ It covers the following features:
* Remember me (Cookie) via https://github.com/CakeDC/auth
* Manage user's profile
* Admin management
+* Yubico U2F for Two-Factor Authentication
+* One-Time Password for Two-Factor Authentication
The plugin is here to provide users related features following 2 approaches:
+
* Quick drop-in working solution for users login/registration. Get users working in 5 minutes.
* Extensible solution for a bigger/custom application. You'll be able to extend:
* UsersAuth Component
@@ -46,8 +52,8 @@ Another decision made was limiting the plugin dependencies on other packages as
Requirements
------------
-* CakePHP 3.6.0+
-* PHP 5.6+
+* CakePHP 4.0+
+* PHP 7.2+
Documentation
-------------
@@ -69,6 +75,6 @@ This repository follows the [CakeDC Plugin Standard](https://www.cakedc.com/plug
License
-------
-Copyright 2017 Cake Development Corporation (CakeDC). All rights reserved.
+Copyright 2019 Cake Development Corporation (CakeDC). All rights reserved.
Licensed under the [MIT](http://www.opensource.org/licenses/mit-license.php) License. Redistributions of the source code included in this repository must retain the copyright notice found in each file.
diff --git a/composer.json b/composer.json
index 93d1a1dbd..3a94372d7 100644
--- a/composer.json
+++ b/composer.json
@@ -26,19 +26,29 @@
"issues": "https://github.com/CakeDC/users/issues",
"source": "https://github.com/CakeDC/users"
},
+ "minimum-stability": "dev",
+ "prefer-stable": true,
"require": {
- "cakephp/cakephp": "^3.6",
- "cakedc/auth": "^2.0"
+ "php": ">=7.2.0",
+ "cakephp/cakephp": "^4.0",
+ "cakedc/auth": "^7.0",
+ "cakephp/authorization": "^2.0.0",
+ "cakephp/authentication": "^2.0.0"
},
"require-dev": {
- "phpunit/phpunit": "^5.0",
+ "phpunit/phpunit": "^9.5",
"league/oauth2-facebook": "@stable",
"league/oauth2-instagram": "@stable",
"league/oauth2-google": "@stable",
"league/oauth2-linkedin": "@stable",
"luchianenco/oauth2-amazon": "^1.1",
"google/recaptcha": "@stable",
- "robthree/twofactorauth": "~1.6.0"
+ "robthree/twofactorauth": "^1.6",
+ "yubico/u2flib-server": "^1.0",
+ "php-coveralls/php-coveralls": "^2.1",
+ "league/oauth1-client": "^1.7",
+ "cakephp/cakephp-codesniffer": "^4.0",
+ "web-auth/webauthn-lib": "v3.3.x-dev"
},
"suggest": {
"league/oauth1-client": "Provides Social Authentication with Twitter",
@@ -48,7 +58,8 @@
"luchianenco/oauth2-amazon": "Provides Social Authentication with Amazon",
"league/oauth2-linkedin": "Provides Social Authentication with LinkedIn",
"google/recaptcha": "Provides reCAPTCHA validation for registration form",
- "robthree/twofactorauth": "Provides Google Authenticator functionality"
+ "robthree/twofactorauth": "Provides Google Authenticator functionality",
+ "cakephp/authorization": "Provide authorization for users"
},
"autoload": {
"psr-4": {
@@ -58,7 +69,30 @@
"autoload-dev": {
"psr-4": {
"CakeDC\\Users\\Test\\": "tests",
- "CakeDC\\Users\\Test\\Fixture\\": "tests"
+ "CakeDC\\Users\\Test\\Fixture\\": "tests",
+ "TestApp\\": "tests/test_app/TestApp/"
}
+ },
+ "scripts": {
+ "analyse": [
+ "@stan",
+ "@psalm"
+ ],
+ "check": [
+ "@cs-check",
+ "@test",
+ "@analyse"
+ ],
+ "cs-check": "phpcs -n -p --standard=vendor/cakephp/cakephp-codesniffer/CakePHP ./src ./tests",
+ "cs-fix": "phpcbf --standard=vendor/cakephp/cakephp-codesniffer/CakePHP ./src ./tests",
+ "test": "phpunit --stderr",
+ "stan": "phpstan analyse src/",
+ "psalm": "php vendor/psalm/phar/psalm.phar --show-info=false src/ ",
+ "stan-setup": "cp composer.json composer.backup && composer require --dev phpstan/phpstan:0.12.94 psalm/phar:~4.9.2 && mv composer.backup composer.json",
+ "stan-rebuild-baseline": "phpstan analyse --configuration phpstan.neon --error-format baselineNeon src/ > phpstan-baseline.neon",
+ "psalm-rebuild-baseline": "php vendor/psalm/phar/psalm.phar --show-info=false --set-baseline=psalm-baseline.xml src/",
+ "rector": "rector process src/",
+ "rector-setup": "cp composer.json composer.backup && composer require --dev rector/rector:^0.11.2 && mv composer.backup composer.json",
+ "coverage-test": "phpunit --stderr --coverage-clover=clover.xml"
}
}
diff --git a/config/Migrations/20150513201111_initial.php b/config/Migrations/20150513201111_initial.php
index 55b00f094..2379afa67 100644
--- a/config/Migrations/20150513201111_initial.php
+++ b/config/Migrations/20150513201111_initial.php
@@ -1,11 +1,11 @@
table('users');
+ $table->addColumn('additional_data', 'text', [
+ 'default' => null,
+ 'null' => true,
+ ]);
+ $table->update();
+ }
+}
diff --git a/config/Migrations/20210929202041_AddLastLoginToUsers.php b/config/Migrations/20210929202041_AddLastLoginToUsers.php
new file mode 100644
index 000000000..5a533c250
--- /dev/null
+++ b/config/Migrations/20210929202041_AddLastLoginToUsers.php
@@ -0,0 +1,24 @@
+table('users');
+ $table->addColumn('last_login', 'datetime', [
+ 'default' => null,
+ 'null' => true,
+ ]);
+ $table->update();
+ }
+}
diff --git a/config/Migrations/schema-dump-default.lock b/config/Migrations/schema-dump-default.lock
index f4f542a73..9c437b3c1 100644
Binary files a/config/Migrations/schema-dump-default.lock and b/config/Migrations/schema-dump-default.lock differ
diff --git a/config/bootstrap.php b/config/bootstrap.php
index 42d2bb0c2..d78acc8b7 100644
--- a/config/bootstrap.php
+++ b/config/bootstrap.php
@@ -1,19 +1,16 @@
each(function ($file) {
Configure::load($file);
});
+UsersUrl::setupConfigUrls();
-TableRegistry::getTableLocator()->setConfig('Users', ['className' => Configure::read('Users.table')]);
-TableRegistry::getTableLocator()->setConfig('CakeDC/Users.Users', ['className' => Configure::read('Users.table')]);
-
-if (Configure::check('Users.auth')) {
- Configure::write('Auth.authenticate.all.userModel', Configure::read('Users.table'));
-}
-
-if (Configure::read('Users.Social.login') && php_sapi_name() != 'cli') {
- try {
- EventManager::instance()->on(\CakeDC\Users\Controller\Component\UsersAuthComponent::EVENT_FAILED_SOCIAL_LOGIN, [new \CakeDC\Users\Controller\UsersController(), 'failedSocialLoginListener']);
- } catch (MissingPluginException $e) {
- Log::error($e->getMessage());
+$locator = TableRegistry::getTableLocator();
+foreach (['Users', 'CakeDC/Users.Users'] as $modelKey) {
+ if (!$locator->exists($modelKey)) {
+ $locator->setConfig($modelKey, ['className' => Configure::read('Users.table')]);
}
}
-
-$oauthPath = Configure::read('OAuth.path');
-if (is_array($oauthPath)) {
- Router::scope('/auth', function ($routes) use ($oauthPath) {
- $routes->connect(
- '/:provider',
- $oauthPath,
- ['provider' => implode('|', array_keys(Configure::read('OAuth.providers')))]
- );
- });
+$oldConfigs = [
+ 'Users.auth',
+ 'Users.Social.authenticator',
+ 'Users.GoogleAuthenticator',
+ 'GoogleAuthenticator',
+ 'Auth.authenticate',
+ 'Auth.authorize',
+];
+foreach ($oldConfigs as $configKey) {
+ if (Configure::check($configKey)) {
+ trigger_error(__("Users plugin configuration key \"{0}\" was removed, please check migration guide https://github.com/CakeDC/users/blob/master/Docs/Documentation/Migration/8.x-9.0.md", $configKey));
+ }
}
diff --git a/config/permissions.php b/config/permissions.php
index 79a4ae957..5c52467fb 100644
--- a/config/permissions.php
+++ b/config/permissions.php
@@ -1,11 +1,11 @@
[
+ //all bypass
+ [
+ 'prefix' => false,
+ 'plugin' => 'CakeDC/Users',
+ 'controller' => 'Users',
+ 'action' => [
+ // LoginTrait
+ 'socialLogin',
+ 'login',
+ 'logout',
+ 'socialEmail',
+ 'verify',
+ // RegisterTrait
+ 'register',
+ 'validateEmail',
+ // PasswordManagementTrait used in RegisterTrait
+ 'changePassword',
+ 'resetPassword',
+ 'requestResetPassword',
+ // UserValidationTrait used in PasswordManagementTrait
+ 'resendTokenValidation',
+ 'linkSocial',
+ //U2F actions
+ 'u2f',
+ 'u2fRegister',
+ 'u2fRegisterFinish',
+ 'u2fAuthenticate',
+ 'u2fAuthenticateFinish',
+ 'webauthn2fa',
+ 'webauthn2faRegister',
+ 'webauthn2faRegisterOptions',
+ 'webauthn2faAuthenticate',
+ 'webauthn2faAuthenticateOptions',
+ ],
+ 'bypassAuth' => true,
+ ],
+ [
+ 'prefix' => false,
+ 'plugin' => 'CakeDC/Users',
+ 'controller' => 'SocialAccounts',
+ 'action' => [
+ 'validateAccount',
+ 'resendValidation',
+ ],
+ 'bypassAuth' => true,
+ ],
//admin role allowed to all the things
[
'role' => 'admin',
@@ -71,7 +117,7 @@
'role' => '*',
'plugin' => 'CakeDC/Users',
'controller' => 'Users',
- 'action' => 'resetGoogleAuthenticator',
+ 'action' => 'resetOneTimePasswordAuthenticator',
'allowed' => function (array $user, $role, \Cake\Http\ServerRequest $request) {
$userId = \Cake\Utility\Hash::get($request->getAttribute('params'), 'pass.0');
if (!empty($userId) && !empty($user)) {
@@ -87,5 +133,12 @@
'controller' => 'Pages',
'action' => 'display',
],
+ [
+ 'role' => '*',
+ 'plugin' => 'DebugKit',
+ 'controller' => '*',
+ 'action' => '*',
+ 'bypassAuth' => true,
+ ],
]
];
diff --git a/config/routes.php b/config/routes.php
index f19f356a3..81ac70cc1 100644
--- a/config/routes.php
+++ b/config/routes.php
@@ -1,52 +1,52 @@
'/users'], function ($routes) {
- $routes->fallbacks('DashedRoute');
-});
+use Cake\Routing\RouteBuilder;
+use CakeDC\Users\Utility\UsersUrl;
-Router::connect('/auth/twitter', [
- 'plugin' => 'CakeDC/Users',
- 'controller' => 'Users',
- 'action' => 'twitterLogin',
- 'provider' => 'twitter'
-]);
-Router::connect('/accounts/validate/*', [
+$routes->connect('/accounts/validate/*', [
'plugin' => 'CakeDC/Users',
'controller' => 'SocialAccounts',
'action' => 'validate'
]);
// Google Authenticator related routes
-if (Configure::read('Users.GoogleAuthenticator.login')) {
- Router::connect('/verify', ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'verify']);
+if (Configure::read('OneTimePasswordAuthenticator.login')) {
+ $routes->connect('/verify', UsersUrl::actionRouteParams('verify'));
- Router::connect('/resetGoogleAuthenticator', [
- 'plugin' => 'CakeDC/Users',
- 'controller' => 'Users',
- 'action' => 'resetGoogleAuthenticator'
- ]);
+ $routes->connect('/resetOneTimePasswordAuthenticator', UsersUrl::actionRouteParams('resetOneTimePasswordAuthenticator'));
}
-Router::connect('/profile/*', ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'profile']);
-Router::connect('/login', ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'login']);
-Router::connect('/logout', ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'logout']);
-Router::connect('/link-social/*', [
- 'controller' => 'Users',
- 'action' => 'linkSocial',
- 'plugin' => 'CakeDC/Users',
-]);
-Router::connect('/callback-link-social/*', [
- 'controller' => 'Users',
- 'action' => 'callbackLinkSocial',
+$routes->connect('/profile/*', UsersUrl::actionRouteParams('profile'));
+$routes->connect('/login', UsersUrl::actionRouteParams('login'));
+$routes->connect('/logout', UsersUrl::actionRouteParams('logout'));
+$routes->connect('/link-social/*', UsersUrl::actionRouteParams('linkSocial'));
+$routes->connect('/callback-link-social/*', UsersUrl::actionRouteParams('callbackLinkSocial'));
+$routes->connect('/register', UsersUrl::actionRouteParams('register'));
+
+$oauthPath = Configure::read('OAuth.path');
+if (is_array($oauthPath)) {
+ $routes->scope('/auth', function (RouteBuilder $routes) use ($oauthPath) {
+ $routes->connect(
+ '/{provider}',
+ $oauthPath,
+ ['provider' => implode('|', array_keys(Configure::read('OAuth.providers')))]
+ );
+ });
+}
+
+$routes->connect('/social-accounts/:action/*', [
'plugin' => 'CakeDC/Users',
+ 'controller' => 'SocialAccounts',
]);
+$routes->connect('/users/{action}/*', UsersUrl::actionRouteParams(null));
diff --git a/config/users.php b/config/users.php
index 52bba11e8..23dfeb9d1 100644
--- a/config/users.php
+++ b/config/users.php
@@ -1,16 +1,34 @@
getHost();
+ if ($fullBaseHost) {
+ $allowedRedirectHosts[] = $fullBaseHost;
+ }
+ } catch (Exception $ex) {
+ Log::warning('Invalid host from App.fullBasedUrl in CakeDC/Users configuration: ' . $ex->getMessage());
+ }
+}
$config = [
'Users' => [
@@ -18,10 +36,9 @@
'table' => 'CakeDC/Users.Users',
// Controller used to manage users plugin features & actions
'controller' => 'CakeDC/Users.Users',
- // configure Auth component
- 'auth' => true,
// Password Hasher
'passwordHasher' => '\Cake\Auth\DefaultPasswordHasher',
+ 'middlewareQueueLoader' => \CakeDC\Users\Loader\MiddlewareQueueLoader::class,
// token expiration, 1 hour
'Token' => ['expiration' => 3600],
'Email' => [
@@ -41,6 +58,8 @@
'ensureActive' => false,
// default role name used in registration
'defaultRole' => 'user',
+ // show verbose error to users
+ 'showVerboseError' => false,
],
'reCaptcha' => [
// reCaptcha key goes here
@@ -59,28 +78,10 @@
'Social' => [
// enable social login
'login' => false,
- // enable social login
- 'authenticator' => 'CakeDC/Users.Social',
- ],
- 'GoogleAuthenticator' => [
- // enable Google Authenticator
- 'login' => false,
- 'issuer' => null,
- // The number of digits the resulting codes will be
- 'digits' => 6,
- // The number of seconds a code will be valid
- 'period' => 30,
- // The algorithm used
- 'algorithm' => 'sha1',
- // QR-code provider (more on this later)
- 'qrcodeprovider' => null,
- // Random Number Generator provider (more on this later)
- 'rngprovider' => null
],
'Profile' => [
// Allow view other users profiles
'viewOthers' => true,
- 'route' => ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'profile'],
],
'Key' => [
'Session' => [
@@ -91,7 +92,7 @@
],
// form key to store the social auth data
'Form' => [
- 'social' => 'social'
+ 'social' => 'social',
],
'Data' => [
// data key to store the users email
@@ -111,95 +112,206 @@
'Cookie' => [
'name' => 'remember_me',
'Config' => [
- 'expires' => '1 month',
- 'httpOnly' => true,
- ]
- ]
+ 'expires' => new \DateTime('+1 month'),
+ 'httponly' => true,
+ ],
+ ],
],
+ 'Superuser' => ['allowedToChangePasswords' => false], // able to reset any users password
+ // list of valid hosts to allow redirects after valid login via the `redirect` query param
+ 'AllowedRedirectHosts' => $allowedRedirectHosts,
],
- 'GoogleAuthenticator' => [
- 'verifyAction' => [
- 'plugin' => 'CakeDC/Users',
- 'controller' => 'Users',
- 'action' => 'verify',
- 'prefix' => false,
- ],
+ 'OneTimePasswordAuthenticator' => [
+ 'checker' => \CakeDC\Auth\Authentication\DefaultOneTimePasswordAuthenticationChecker::class,
+ 'login' => false,
+ 'issuer' => null,
+ // The number of digits the resulting codes will be
+ 'digits' => 6,
+ // The number of seconds a code will be valid
+ 'period' => 30,
+ // The algorithm used
+ 'algorithm' => 'sha1',
+ // QR-code provider (more on this later)
+ 'qrcodeprovider' => null,
+ // Random Number Generator provider (more on this later)
+ 'rngprovider' => null,
+ ],
+ 'U2f' => [
+ 'enabled' => false,
+ 'checker' => \CakeDC\Auth\Authentication\DefaultU2fAuthenticationChecker::class,
+ ],
+ 'Webauthn2fa' => [
+ 'enabled' => false,
+ 'appName' => null,//App must set a valid name here
+ 'id' => null,//default value is the current domain
+ 'checker' => \CakeDC\Auth\Authentication\DefaultWebauthn2fAuthenticationChecker::class,
],
// default configuration used to auto-load the Auth Component, override to change the way Auth works
'Auth' => [
- 'loginAction' => [
- 'plugin' => 'CakeDC/Users',
- 'controller' => 'Users',
- 'action' => 'login',
- 'prefix' => false
+ 'Authentication' => [
+ 'serviceLoader' => \CakeDC\Users\Loader\AuthenticationServiceLoader::class,
],
- 'authenticate' => [
- 'all' => [
- 'finder' => 'auth',
+ 'AuthenticationComponent' => [
+ 'load' => true,
+ 'loginRedirect' => '/',
+ 'requireIdentity' => false,
+ ],
+ 'Authenticators' => [
+ 'Session' => [
+ 'className' => 'Authentication.Session',
+ 'skipTwoFactorVerify' => true,
+ 'sessionKey' => 'Auth',
+ ],
+ 'Form' => [
+ 'className' => 'CakeDC/Auth.Form',
+ 'urlChecker' => 'Authentication.CakeRouter',
+ ],
+ 'Token' => [
+ 'className' => 'Authentication.Token',
+ 'skipTwoFactorVerify' => true,
+ 'header' => null,
+ 'queryParam' => 'api_key',
+ 'tokenPrefix' => null,
+ ],
+ 'Cookie' => [
+ 'className' => 'CakeDC/Auth.Cookie',
+ 'skipTwoFactorVerify' => true,
+ 'rememberMeField' => 'remember_me',
+ 'cookie' => [
+ 'expires' => new \DateTime('+1 month'),
+ 'httponly' => true,
+ ],
+ 'urlChecker' => 'Authentication.CakeRouter',
+ ],
+ 'Social' => [
+ 'className' => 'CakeDC/Users.Social',
+ 'skipTwoFactorVerify' => true,
+ ],
+ 'SocialPendingEmail' => [
+ 'className' => 'CakeDC/Users.SocialPendingEmail',
+ 'skipTwoFactorVerify' => true,
+ ],
+ ],
+ 'Identifiers' => [
+ 'Password' => [
+ 'className' => 'Authentication.Password',
+ 'fields' => [
+ 'username' => ['username', 'email'],
+ 'password' => 'password',
+ ],
+ 'resolver' => [
+ 'className' => 'Authentication.Orm',
+ 'finder' => 'active',
+ ],
+ ],
+ 'Social' => [
+ 'className' => 'CakeDC/Users.Social',
+ 'authFinder' => 'active',
+ ],
+ 'Token' => [
+ 'className' => 'Authentication.Token',
+ 'tokenField' => 'api_token',
+ 'resolver' => [
+ 'className' => 'Authentication.Orm',
+ 'finder' => 'active',
+ ],
],
- 'CakeDC/Auth.ApiKey',
- 'CakeDC/Auth.RememberMe',
- 'Form',
],
- 'authorize' => [
- 'CakeDC/Auth.Superuser',
- 'CakeDC/Auth.SimpleRbac',
+ 'Authorization' => [
+ 'enable' => true,
+ 'serviceLoader' => \CakeDC\Users\Loader\AuthorizationServiceLoader::class,
+ ],
+ 'AuthorizationMiddleware' => [
+ 'unauthorizedHandler' => [
+ 'className' => 'CakeDC/Users.DefaultRedirect',
+ ],
+ ],
+ 'AuthorizationComponent' => [
+ 'enabled' => true,
+ ],
+ 'RbacPolicy' => [],
+ 'PasswordRehash' => [
+ 'identifiers' => ['Password'],
],
],
'OAuth' => [
- 'path' => ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'socialLogin', 'prefix' => null],
'providers' => [
'facebook' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth2Service',
'className' => 'League\OAuth2\Client\Provider\Facebook',
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\Facebook',
+ 'authParams' => ['scope' => ['public_profile', 'email', 'user_birthday', 'user_gender', 'user_link']],
'options' => [
'graphApiVersion' => 'v2.8', //bio field was deprecated on >= v2.8
'redirectUri' => Router::fullBaseUrl() . '/auth/facebook',
'linkSocialUri' => Router::fullBaseUrl() . '/link-social/facebook',
'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/facebook',
- ]
+ ],
],
'twitter' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth1Service',
+ 'className' => 'League\OAuth1\Client\Server\Twitter',
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\Twitter',
'options' => [
'redirectUri' => Router::fullBaseUrl() . '/auth/twitter',
'linkSocialUri' => Router::fullBaseUrl() . '/link-social/twitter',
'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/twitter',
- ]
+ ],
],
'linkedIn' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth2Service',
'className' => 'League\OAuth2\Client\Provider\LinkedIn',
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\LinkedIn',
'options' => [
'redirectUri' => Router::fullBaseUrl() . '/auth/linkedIn',
'linkSocialUri' => Router::fullBaseUrl() . '/link-social/linkedIn',
'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/linkedIn',
- ]
+ ],
],
'instagram' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth2Service',
'className' => 'League\OAuth2\Client\Provider\Instagram',
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\Instagram',
'options' => [
'redirectUri' => Router::fullBaseUrl() . '/auth/instagram',
'linkSocialUri' => Router::fullBaseUrl() . '/link-social/instagram',
'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/instagram',
- ]
+ ],
],
'google' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth2Service',
'className' => 'League\OAuth2\Client\Provider\Google',
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\Google',
'options' => [
'userFields' => ['url', 'aboutMe'],
'redirectUri' => Router::fullBaseUrl() . '/auth/google',
'linkSocialUri' => Router::fullBaseUrl() . '/link-social/google',
'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/google',
- ]
+ ],
],
'amazon' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth2Service',
'className' => 'Luchianenco\OAuth2\Client\Provider\Amazon',
- 'options' => [
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\Amazon',
+ 'options' => [
'redirectUri' => Router::fullBaseUrl() . '/auth/amazon',
'linkSocialUri' => Router::fullBaseUrl() . '/link-social/amazon',
'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/amazon',
- ]
+ ],
+ ],
+ 'cognito' => [
+ 'service' => 'CakeDC\Auth\Social\Service\OAuth2Service',
+ 'className' => 'CakeDC\OAuth2\Client\Provider\Cognito',
+ 'mapper' => 'CakeDC\Auth\Social\Mapper\Cognito',
+ 'options' => [
+ 'redirectUri' => Router::fullBaseUrl() . '/auth/cognito',
+ 'linkSocialUri' => Router::fullBaseUrl() . '/link-social/cognito',
+ 'callbackLinkSocialUri' => Router::fullBaseUrl() . '/callback-link-social/cognito',
+ 'scope' => 'email openid',
+ ],
],
],
- ]
+ ],
];
return $config;
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
new file mode 100644
index 000000000..52b966521
--- /dev/null
+++ b/phpstan-baseline.neon
@@ -0,0 +1,267 @@
+parameters:
+ ignoreErrors:
+ -
+ message: "#^Access to an undefined property Cake\\\\Controller\\\\Controller\\:\\:\\$Authentication\\.$#"
+ count: 1
+ path: src/Controller/Component/LoginComponent.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\Controller\\\\Controller\\:\\:getUsersTable\\(\\)\\.$#"
+ count: 2
+ path: src/Controller/Component/LoginComponent.php
+
+ -
+ message: "#^Access to an undefined property CakeDC\\\\Users\\\\Controller\\\\UsersController\\:\\:\\$Authentication\\.$#"
+ count: 2
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Access to an undefined property CakeDC\\\\Users\\\\Controller\\\\UsersController\\:\\:\\$OneTimePasswordAuthenticator\\.$#"
+ count: 3
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$u2f_registration\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\Controller\\\\Component\\:\\:handleLogin\\(\\)\\.$#"
+ count: 3
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:changePassword\\(\\)\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:linkSocialAccount\\(\\)\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:register\\(\\)\\.$#"
+ count: 2
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:resetToken\\(\\)\\.$#"
+ count: 2
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:validate\\(\\)\\.$#"
+ count: 2
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:validationCurrentPassword\\(\\)\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:validationPasswordConfirm\\(\\)\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Parameter \\#1 \\$message of method Cake\\\\Controller\\\\Controller\\:\\:log\\(\\) expects string, Exception given\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Parameter \\#1 \\$object of method Cake\\\\Controller\\\\Controller\\:\\:paginate\\(\\) expects Cake\\\\ORM\\\\Query\\|Cake\\\\ORM\\\\Table\\|string\\|null, Cake\\\\Datasource\\\\RepositoryInterface given\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Parameter \\#2 \\$options of method Cake\\\\Controller\\\\Component\\\\FlashComponent\\:\\:error\\(\\) expects array, string given\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Parameter \\#2 \\$options of method Cake\\\\Controller\\\\Component\\\\FlashComponent\\:\\:success\\(\\) expects array, string given\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Parameter \\#2 \\$usersTable of class CakeDC\\\\Users\\\\Webauthn\\\\RegisterAdapter constructor expects CakeDC\\\\Users\\\\Model\\\\Table\\\\UsersTable\\|null, Cake\\\\ORM\\\\Table given\\.$#"
+ count: 1
+ path: src/Controller/UsersController.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:socialLogin\\(\\)\\.$#"
+ count: 1
+ path: src/Identifier/SocialIdentifier.php
+
+ -
+ message: "#^Parameter \\#1 \\$request of method CakeDC\\\\Users\\\\Middleware\\\\SocialAuthMiddleware\\:\\:goNext\\(\\) expects Cake\\\\Http\\\\ServerRequest, Psr\\\\Http\\\\Message\\\\ServerRequestInterface given\\.$#"
+ count: 1
+ path: src/Middleware/SocialAuthMiddleware.php
+
+ -
+ message: "#^Parameter \\#2 \\$request of method CakeDC\\\\Users\\\\Utility\\\\UsersUrl\\:\\:checkActionOnRequest\\(\\) expects Cake\\\\Http\\\\ServerRequest, Psr\\\\Http\\\\Message\\\\ServerRequestInterface given\\.$#"
+ count: 1
+ path: src/Middleware/SocialAuthMiddleware.php
+
+ -
+ message: "#^Parameter \\#1 \\$request of method CakeDC\\\\Users\\\\Middleware\\\\SocialAuthMiddleware\\:\\:goNext\\(\\) expects Cake\\\\Http\\\\ServerRequest, Psr\\\\Http\\\\Message\\\\ServerRequestInterface given\\.$#"
+ count: 1
+ path: src/Middleware/SocialEmailMiddleware.php
+
+ -
+ message: "#^Parameter \\#2 \\$request of method CakeDC\\\\Users\\\\Utility\\\\UsersUrl\\:\\:checkActionOnRequest\\(\\) expects Cake\\\\Http\\\\ServerRequest, Psr\\\\Http\\\\Message\\\\ServerRequestInterface given\\.$#"
+ count: 1
+ path: src/Middleware/SocialEmailMiddleware.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\Datasource\\\\EntityInterface\\:\\:updateToken\\(\\)\\.$#"
+ count: 1
+ path: src/Model/Behavior/BaseTokenBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$social_accounts\\.$#"
+ count: 2
+ path: src/Model/Behavior/LinkSocialBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\ORM\\\\Table\\:\\:\\$SocialAccounts\\.$#"
+ count: 5
+ path: src/Model/Behavior/LinkSocialBehavior.php
+
+ -
+ message: "#^Negated boolean expression is always false\\.$#"
+ count: 1
+ path: src/Model/Behavior/LinkSocialBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$password\\.$#"
+ count: 1
+ path: src/Model/Behavior/PasswordBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$password_confirm\\.$#"
+ count: 1
+ path: src/Model/Behavior/PasswordBehavior.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\Datasource\\\\EntityInterface\\:\\:checkPassword\\(\\)\\.$#"
+ count: 1
+ path: src/Model/Behavior/PasswordBehavior.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:findByUsernameOrEmail\\(\\)\\.$#"
+ count: 1
+ path: src/Model/Behavior/PasswordBehavior.php
+
+ -
+ message: "#^Method CakeDC\\\\Users\\\\Model\\\\Behavior\\\\PasswordBehavior\\:\\:resetToken\\(\\) should return string but returns Cake\\\\Datasource\\\\EntityInterface\\|false\\.$#"
+ count: 1
+ path: src/Model/Behavior/PasswordBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$activation_date\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$active\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$token_expires\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\Datasource\\\\EntityInterface\\:\\:\\$validated\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\ORM\\\\Table\\:\\:\\$isValidateEmail\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Call to an undefined method Cake\\\\ORM\\\\Table\\:\\:validationRegister\\(\\)\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Cannot call method tokenExpired\\(\\) on array\\|Cake\\\\Datasource\\\\EntityInterface\\.$#"
+ count: 1
+ path: src/Model/Behavior/RegisterBehavior.php
+
+ -
+ message: "#^Access to an undefined property CakeDC\\\\Users\\\\Model\\\\Entity\\\\SocialAccount\\:\\:\\$active\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Cannot access property \\$active on array\\|Cake\\\\Datasource\\\\EntityInterface\\.$#"
+ count: 2
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Cannot access property \\$token on array\\|Cake\\\\Datasource\\\\EntityInterface\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Cannot access property \\$user on array\\|Cake\\\\Datasource\\\\EntityInterface\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Method CakeDC\\\\Users\\\\Model\\\\Behavior\\\\SocialAccountBehavior\\:\\:resendValidation\\(\\) should return CakeDC\\\\Users\\\\Model\\\\Entity\\\\User but returns array\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Method CakeDC\\\\Users\\\\Model\\\\Behavior\\\\SocialAccountBehavior\\:\\:validateAccount\\(\\) should return CakeDC\\\\Users\\\\Model\\\\Entity\\\\User but returns Cake\\\\Datasource\\\\EntityInterface\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Parameter \\#1 \\$socialAccount of method CakeDC\\\\Users\\\\Model\\\\Behavior\\\\SocialAccountBehavior\\:\\:_activateAccount\\(\\) expects CakeDC\\\\Users\\\\Model\\\\Entity\\\\SocialAccount, array\\|Cake\\\\Datasource\\\\EntityInterface given\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialAccountBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\ORM\\\\Table\\:\\:\\$SocialAccounts\\.$#"
+ count: 4
+ path: src/Model/Behavior/SocialBehavior.php
+
+ -
+ message: "#^Access to an undefined property Cake\\\\ORM\\\\Table\\:\\:\\$isValidateEmail\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialBehavior.php
+
+ -
+ message: "#^Parameter \\#3 \\$tokenExpiration of method CakeDC\\\\Users\\\\Model\\\\Behavior\\\\BaseTokenBehavior\\:\\:_updateActive\\(\\) expects int, string given\\.$#"
+ count: 1
+ path: src/Model/Behavior/SocialBehavior.php
+
+ -
+ message: "#^Method CakeDC\\\\Users\\\\Model\\\\Entity\\\\User\\:\\:_setTos\\(\\) should return bool but returns string\\.$#"
+ count: 1
+ path: src/Model/Entity/User.php
+
+ -
+ message: "#^Cannot access property \\$username on bool\\.$#"
+ count: 2
+ path: src/Shell/UsersShell.php
+
+ -
+ message: "#^Property CakeDC\\\\Users\\\\Shell\\\\UsersShell\\:\\:\\$Users \\(CakeDC\\\\Users\\\\Model\\\\Table\\\\UsersTable\\) does not accept Cake\\\\Datasource\\\\RepositoryInterface\\.$#"
+ count: 1
+ path: src/Shell/UsersShell.php
+
+ -
+ message: "#^Parameter \\#2 \\$usersTable of class CakeDC\\\\Users\\\\Webauthn\\\\Repository\\\\UserCredentialSourceRepository constructor expects CakeDC\\\\Users\\\\Model\\\\Table\\\\UsersTable\\|null, Cake\\\\ORM\\\\Table given\\.$#"
+ count: 1
+ path: src/Webauthn/BaseAdapter.php
+
diff --git a/phpstan.neon b/phpstan.neon
new file mode 100644
index 000000000..f6dbf5f0b
--- /dev/null
+++ b/phpstan.neon
@@ -0,0 +1,16 @@
+includes:
+ - phpstan-baseline.neon
+
+parameters:
+ level: 6
+ checkMissingIterableValueType: false
+ checkGenericClassInNonGenericObjectType: false
+ bootstrapFiles:
+ - tests/bootstrap.php
+ excludes_analyse:
+ - src/Controller/SocialAccountsController.php
+ - src/Controller/UsersAccountsController.php
+ - src/Controller/AppAccountsController.php
+ ignoreErrors:
+
+services:
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 500c19975..3a1684f67 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -1,36 +1,33 @@
-enable|disable reCaptcha
+ + To enable reCaptcha you need to register your site at google reCaptcha console + and add this to your config/users.php file to enable on login: + + ```php + 'Users.reCaptcha.login' => true, + 'Users.reCaptcha.key' => 'YOUR RECAPTCHA KEY', + 'Users.reCaptcha.secret' => 'YOUR RECAPTCHA SECRET', + ``` + To disable (default) add this to your config/users.php + ```php + 'Users.reCaptcha.login' => false, + ``` +BaseController
+ getConfig
+ $checker
+ $checker
+ getConfig
+ AppController
+ public function resetOneTimePasswordAuthenticator($id = null)
+ \ReCaptcha\ReCaptcha
+ AppController
+ SocialIdentifier
+ $exception->getPrevious()
+ $exp
+ function ($exp) use ($identifier, $where) {
+ $result
+ \Cake\Datasource\EntityInterface
+ updateToken
+ $user->id
+ $socialAccount->user_id
+ $user->id
+ $user->social_accounts
+ $socialAccount->id
+ $user->social_accounts
+ $socialAccount
+ $accountData['avatar']
+ $saveResult
+ string
+ $user->id
+ $user->current_password
+ $currentUser->password
+ $user->password_confirm
+ checkPassword
+ $user
+ $context
+ $user->validated
+ $user->active
+ $user->activation_date
+ $user->token_expires
+ $user->active
+ tokenExpired
+ $validateEmail
+ $tokenExpiration
+ tokenExpired
+ $this->_table->isValidateEmail
+ $this->validateEmail
+ $this->useTos
+ $this->validateEmail
+ $this->validateEmail
+ $result
+ $socialAccount
+ \Cake\Datasource\EntityInterface
+ $this->sendSocialValidationEmail($socialAccount, $socialAccount->user)
+ \CakeDC\Users\Model\Entity\User
+ $this->_activateAccount($socialAccount)
+ \CakeDC\Users\Model\Entity\User
+ $socialAccount->token
+ $socialAccount->active
+ $socialAccount->active
+ $socialAccount->user
+ $user
+ $socialAccount
+ $tokenExpiration
+ $existingAccount->user
+ $existingUser
+ $useEmail
+ $validateEmail
+ $tokenExpiration
+ $userData['username'] ?? null
+ $userData['username'] ?? null
+ $accountData['avatar']
+ $userData
+ $userData
+ SocialBehavior
+ $this->_table->isValidateEmail
+ $tos
+ bool
+ SocialAccountsTable
+ \CakeDC\Users\Model\Entity\User|bool
+ UsersTable
+ Plugin
+ Shell
+ parent::getOptionParser()
+ parent::initialize()
+ $user->username
+ $user->username
+ $this->_updateUser($username, $data)
+ bool
+ $error
+ $field
+ $value
+ $field
+ $value
+ $field
+ $user->id
+ $savedUser->role
+ UsersShell
+ $this->Users
+ $title
+ AuthLinkHelper
+ $options['options']
+ $options['options']
+ $this->name
+ \Cake\Mailer\Mailer
+ $indexed
+ - , -
-- Html->link(__d('CakeDC/Users', 'Reset your password here'), $activationUrl) ?> -
--Url->build($activationUrl) -) ?> -
-- , -
diff --git a/src/Template/Email/html/social_account_validation.ctp b/src/Template/Email/html/social_account_validation.ctp deleted file mode 100644 index acef3fbc5..000000000 --- a/src/Template/Email/html/social_account_validation.ctp +++ /dev/null @@ -1,40 +0,0 @@ - - -- , -
-- true, - 'plugin' => 'CakeDC/Users', - 'controller' => 'SocialAccounts', - 'action' => 'validateAccount', - $socialAccount['provider'], - $socialAccount['reference'], - $socialAccount['token'], - ]; - echo $this->Html->link($text, $activationUrl); - ?> -
--Url->build($activationUrl) -) ?> -
-- , -
diff --git a/src/Template/Email/html/validation.ctp b/src/Template/Email/html/validation.ctp deleted file mode 100644 index 8a1840468..000000000 --- a/src/Template/Email/html/validation.ctp +++ /dev/null @@ -1,35 +0,0 @@ - true, - 'plugin' => 'CakeDC/Users', - 'controller' => 'Users', - 'action' => 'validateEmail', - isset($token) ? $token : '' -]; -?> -- , -
-- Html->link(__d('CakeDC/Users', 'Activate your account here'), $activationUrl) ?> -
--Url->build($activationUrl) -) ?> -
-- , -
diff --git a/src/Template/Email/text/reset_password.ctp b/src/Template/Email/text/reset_password.ctp deleted file mode 100644 index 96f001565..000000000 --- a/src/Template/Email/text/reset_password.ctp +++ /dev/null @@ -1,29 +0,0 @@ - true, - 'plugin' => 'CakeDC/Users', - 'controller' => 'Users', - 'action' => 'resetPassword', - isset($token) ? $token : '' -]; -?> -, - -Url->build($activationUrl) -) ?> - -, - diff --git a/src/Template/Email/text/social_account_validation.ctp b/src/Template/Email/text/social_account_validation.ctp deleted file mode 100644 index 87e2d6813..000000000 --- a/src/Template/Email/text/social_account_validation.ctp +++ /dev/null @@ -1,31 +0,0 @@ - true, - 'plugin' => 'CakeDC/Users', - 'controller' => 'SocialAccounts', - 'action' => 'validateAccount', - $socialAccount['provider'], - $socialAccount['reference'], - $socialAccount['token'], -]; -?> -, - -Url->build($activationUrl) -) ?> - -, - diff --git a/src/Template/Email/text/validation.ctp b/src/Template/Email/text/validation.ctp deleted file mode 100644 index ecf9d96a8..000000000 --- a/src/Template/Email/text/validation.ctp +++ /dev/null @@ -1,29 +0,0 @@ - true, - 'plugin' => 'CakeDC/Users', - 'controller' => 'Users', - 'action' => 'validateEmail', - isset($token) ? $token : '' -]; -?> -, - -Url->build($activationUrl) -) ?> - -, - diff --git a/src/Template/Users/index.ctp b/src/Template/Users/index.ctp deleted file mode 100644 index 6c9e49871..000000000 --- a/src/Template/Users/index.ctp +++ /dev/null @@ -1,55 +0,0 @@ - -
-
-
--
-
- Html->link(__d('CakeDC/Users', 'New {0}', $tableAlias), ['action' => 'add']) ?> -
-
-
-
-
diff --git a/src/Template/Users/request_reset_password.ctp b/src/Template/Users/request_reset_password.ctp
deleted file mode 100644
index e406ff573..000000000
--- a/src/Template/Users/request_reset_password.ctp
+++ /dev/null
@@ -1,10 +0,0 @@
-| Paginator->sort('username', __d('CakeDC/Users', 'Username')) ?> | -Paginator->sort('email', __d('CakeDC/Users', 'Email')) ?> | -Paginator->sort('first_name', __d('CakeDC/Users', 'First name')) ?> | -Paginator->sort('last_name', __d('CakeDC/Users', 'Last name')) ?> | -- |
|---|---|---|---|---|
| username) ?> | -email) ?> | -first_name) ?> | -last_name) ?> | -- Html->link(__d('CakeDC/Users', 'View'), ['action' => 'view', $user->id]) ?> - Html->link(__d('CakeDC/Users', 'Change password'), ['action' => 'changePassword', $user->id]) ?> - Html->link(__d('CakeDC/Users', 'Edit'), ['action' => 'edit', $user->id]) ?> - Form->postLink(__d('CakeDC/Users', 'Delete'), ['action' => 'delete', $user->id], ['confirm' => __d('CakeDC/Users', 'Are you sure you want to delete # {0}?', $user->id)]) ?> - | -
-
--
- Paginator->prev('< ' . __d('CakeDC/Users', 'previous')) ?>
- Paginator->numbers() ?>
- Paginator->next(__d('CakeDC/Users', 'next') . ' >') ?>
-
Paginator->counter() ?>
-
- Flash->render('auth') ?>
- Form->create('User') ?>
-
- Form->button(__d('CakeDC/Users', 'Submit')); ?>
- Form->end() ?>
-
diff --git a/src/Template/Users/social_email.ctp b/src/Template/Users/social_email.ctp
deleted file mode 100644
index b0a272b6d..000000000
--- a/src/Template/Users/social_email.ctp
+++ /dev/null
@@ -1,21 +0,0 @@
-
-
- Flash->render() ?>
- Form->create('User') ?>
-
- Form->button(__d('CakeDC/Users', 'Submit')); ?>
- Form->end() ?>
-
diff --git a/src/Traits/RandomStringTrait.php b/src/Traits/RandomStringTrait.php
index 668a0c828..6caffad7b 100644
--- a/src/Traits/RandomStringTrait.php
+++ b/src/Traits/RandomStringTrait.php
@@ -1,11 +1,13 @@
$prefix, 'plugin' => $plugin, 'controller' => $controller, 'action' => $action];
+ }
+
+ /**
+ * Check if the action is the one from a request
+ *
+ * @param string $action users action
+ * @param \Cake\Http\ServerRequest $request the request
+ * @return bool
+ */
+ public static function checkActionOnRequest($action, ServerRequest $request)
+ {
+ $route = static::actionParams($action);
+ foreach ($route as $param => $value) {
+ if ($request->getParam($param, null) !== $value) {
+ return false;
+ }
+ }
+
+ return true;
+ }
+
+ /**
+ * Setup needed config urls but without overwriting
+ *
+ * @return void
+ */
+ public static function setupConfigUrls()
+ {
+ $urls = self::getDefaultConfigUrls();
+ foreach ($urls as $configKey => $url) {
+ if (!Configure::check($configKey)) {
+ Configure::write($configKey, $url);
+ }
+ }
+ }
+
+ /**
+ * Get a list of default config urls using static::actionUrl method for users url.
+ *
+ * @return array
+ */
+ private static function getDefaultConfigUrls()
+ {
+ $loginAction = static::actionUrl('login');
+
+ return [
+ 'Users.Profile.route' => static::actionUrl('profile'),
+ 'OneTimePasswordAuthenticator.verifyAction' => static::actionUrl('verify'),
+ 'U2f.startAction' => static::actionUrl('u2f'),
+ 'Webauthn2fa.startAction' => static::actionUrl('webauthn2fa'),
+ 'Auth.AuthenticationComponent.loginAction' => $loginAction,
+ 'Auth.AuthenticationComponent.logoutRedirect' => $loginAction,
+ 'Auth.Authenticators.Form.loginUrl' => $loginAction,
+ 'Auth.Authenticators.Cookie.loginUrl' => $loginAction,
+ 'Auth.Authenticators.SocialPendingEmail.loginUrl' => $loginAction,
+ 'Auth.AuthorizationMiddleware.unauthorizedHandler.url' => $loginAction,
+ 'OAuth.path' => static::actionParams('socialLogin'),
+ ];
+ }
+}
diff --git a/src/View/Helper/AuthLinkHelper.php b/src/View/Helper/AuthLinkHelper.php
index b9b8e0c97..06274ae37 100644
--- a/src/View/Helper/AuthLinkHelper.php
+++ b/src/View/Helper/AuthLinkHelper.php
@@ -1,28 +1,31 @@
isAuthorized($url)) {
- return Hash::get($options, 'before') .
+ return ($options['before'] ?? '') .
parent::link($title, $url, $linkOptions) .
- Hash::get($options, 'after');
+ ($options['after'] ?? '');
}
- return false;
+ return '';
}
/**
- * Returns true if the target url is authorized for the logged in user
+ * Wrapper for FormHelper.postLink.
+ * Write the link only if user is authorized.
*
- * @param string|array|null $url url that the user is making request.
- * @return bool
+ * @param string $title Link's title
+ * @param string|array $url Link's url
+ * @param array $options Link's options
+ * @return string Link as a string.
*/
- public function isAuthorized($url = null)
+ public function postLink($title, $url = null, array $options = []): string
{
- $event = new Event(UsersAuthComponent::EVENT_IS_AUTHORIZED, $this, ['url' => $url]);
- $result = EventManager::instance()->dispatch($event);
+ return $this->isAuthorized($url)
+ ? $this->Form->postLink($title, $url, $options)
+ : '';
+ }
- return $result->result;
+ /**
+ * Get the current request
+ *
+ * @return \Cake\Http\ServerRequest
+ */
+ public function getRequest()
+ {
+ return $this->getView()->getRequest();
}
}
diff --git a/src/View/Helper/UserHelper.php b/src/View/Helper/UserHelper.php
index c1f4cb7b7..00d32bd93 100644
--- a/src/View/Helper/UserHelper.php
+++ b/src/View/Helper/UserHelper.php
@@ -1,25 +1,30 @@
Html->tag('i', '', [
'class' => 'fa fa-' . strtolower($name),
@@ -51,13 +56,17 @@ public function socialLogin($name, $options = [])
if (isset($options['title'])) {
$providerTitle = $options['title'];
} else {
- $providerTitle = Hash::get($options, 'label') . ' ' . Inflector::camelize($name);
+ $providerTitle = ($options['label'] ?? '') . ' ' . Inflector::camelize($name);
}
- $providerClass = 'btn btn-social btn-' . strtolower($name) . ((Hash::get($options, 'class')) ? ' ' . Hash::get($options, 'class') : '');
+ $providerClass = 'btn btn-social btn-' . strtolower($name);
+ $optionClass = $options['class'] ?? null;
+ if ($optionClass) {
+ $providerClass .= " $optionClass";
+ }
return $this->Html->link($icon . $providerTitle, "/auth/$name", [
- 'escape' => false, 'class' => $providerClass
+ 'escape' => false, 'class' => $providerClass,
]);
}
@@ -75,7 +84,8 @@ public function socialLoginList(array $providerOptions = [])
$outProviders = [];
$providers = Configure::read('OAuth.providers');
foreach ($providers as $provider => $options) {
- if (!empty($options['options']['redirectUri']) &&
+ if (
+ !empty($options['options']['redirectUri']) &&
!empty($options['options']['clientId']) &&
!empty($options['options']['clientSecret'])
) {
@@ -99,30 +109,40 @@ public function socialLoginList(array $providerOptions = [])
*/
public function logout($message = null, $options = [])
{
- return $this->AuthLink->link(empty($message) ? __d('CakeDC/Users', 'Logout') : $message, [
- 'plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'logout'
- ], $options);
+ $url = UsersUrl::actionUrl('logout');
+ $title = empty($message) ? __d('cake_d_c/users', 'Logout') : $message;
+
+ return $this->AuthLink->link($title, $url, $options);
}
/**
* Welcome display
- * @return mixed
+ *
+ * @return string|null
*/
public function welcome()
{
- $userId = $this->request->getSession()->read('Auth.User.id');
- if (empty($userId)) {
- return;
+ $identity = $this->getView()->getRequest()->getAttribute('identity');
+ if (!$identity) {
+ return null;
}
$profileUrl = Configure::read('Users.Profile.route');
- $label = __d('CakeDC/Users', 'Welcome, {0}', $this->AuthLink->link($this->request->getSession()->read('Auth.User.first_name') ?: $this->request->getSession()->read('Auth.User.username'), $profileUrl));
+ $title = $identity['first_name'] ?? null;
+ $title = $title ?: ($identity['username'] ?? null);
+ $title = is_array($title) ? '-' : (string)$title;
+ $label = __d(
+ 'cake_d_c/users',
+ 'Welcome, {0}',
+ $this->AuthLink->link($title, $profileUrl)
+ );
return $this->Html->tag('span', $label, ['class' => 'welcome']);
}
/**
* Add reCaptcha script
+ *
* @return void
*/
public function addReCaptchaScript()
@@ -134,19 +154,32 @@ public function addReCaptchaScript()
/**
* Add reCaptcha to the form
+ *
* @return mixed
*/
public function addReCaptcha()
{
if (!Configure::read('Users.reCaptcha.key')) {
- return $this->Html->tag('p', __d('CakeDC/Users', 'reCaptcha is not configured! Please configure Users.reCaptcha.key'));
+ return $this->Html->tag(
+ 'p',
+ __d(
+ 'cake_d_c/users',
+ 'reCaptcha is not configured! Please configure Users.reCaptcha.key'
+ )
+ );
}
$this->addReCaptchaScript();
- $this->Form->unlockField('g-recaptcha-response');
+ try {
+ $this->Form->unlockField('g-recaptcha-response');
+ } catch (\Exception $e) {
+ }
return $this->Html->tag('div', '', [
'class' => 'g-recaptcha',
- 'data-sitekey' => Configure::read('Users.reCaptcha.key')
+ 'data-sitekey' => Configure::read('Users.reCaptcha.key'),
+ 'data-theme' => Configure::read('Users.reCaptcha.theme') ?: 'light',
+ 'data-size' => Configure::read('Users.reCaptcha.size') ?: 'normal',
+ 'data-tabindex' => Configure::read('Users.reCaptcha.tabindex') ?: '3',
]);
}
@@ -154,7 +187,6 @@ public function addReCaptcha()
* Generate a link if the target url is authorized for the logged in user
*
* @deprecated Since 3.2.1. Use AuthLinkHelper::link() instead
- *
* @param string $title link's title.
* @param string|array|null $url url that the user is making request.
* @param array $options Array with option data.
@@ -170,49 +202,32 @@ public function link($title, $url = null, array $options = [])
return $this->AuthLink->link($title, $url, $options);
}
- /**
- * Returns true if the target url is authorized for the logged in user
- *
- * @deprecated Since 3.2.1. Use AuthLinkHelper::link() instead
- *
- * @param string|array|null $url url that the user is making request.
- * @return bool
- */
- public function isAuthorized($url = null)
- {
- trigger_error(
- 'UserHelper::isAuthorized() deprecated since 3.2.1. Use AuthLinkHelper::isAuthorized() instead',
- E_USER_DEPRECATED
- );
-
- return $this->AuthLink->isAuthorized($url);
- }
/**
* Create links for all social providers enabled social link (connect)
*
* @param string $name Provider name in lowercase
* @param array $provider Provider configuration
* @param bool $isConnected User is connected with this provider
- *
* @return string
*/
public function socialConnectLink($name, $provider, $isConnected = false)
{
- $linkClass = 'btn btn-social btn-' . strtolower($name) . ((Hash::get($provider['options'], 'class')) ? ' ' . Hash::get($provider['options'], 'class') : '');
+ $optionClass = $provider['options']['class'] ?? null;
+ $linkClass = 'btn btn-social btn-' . strtolower($name) . ($optionClass ? ' ' . $optionClass : '');
if ($isConnected) {
- $title = __d('CakeDC/Users', 'Connected with {0}', Inflector::camelize($name));
+ $title = __d('cake_d_c/users', 'Connected with {0}', Inflector::camelize($name));
return " $title";
}
- $title = __d('CakeDC/Users', 'Connect with {0}', Inflector::camelize($name));
+ $title = __d('cake_d_c/users', 'Connect with {0}', Inflector::camelize($name));
return $this->Html->link(
" $title",
"/link-social/$name",
[
'escape' => false,
- 'class' => $linkClass
+ 'class' => $linkClass,
]
);
}
@@ -221,22 +236,25 @@ public function socialConnectLink($name, $provider, $isConnected = false)
* Create links for all social providers enabled social link (connect)
*
* @param array $socialAccounts All social accounts connected by a user.
- *
* @return string
*/
public function socialConnectLinkList($socialAccounts = [])
{
if (!Configure::read('Users.Social.login')) {
- return "";
+ return '';
}
- $html = "";
- $connectedProviders = array_map(function ($item) {
- return strtolower($item->provider);
- }, (array)$socialAccounts);
+ $html = '';
+ $connectedProviders = array_map(
+ function ($item) {
+ return strtolower($item->provider);
+ },
+ (array)$socialAccounts
+ );
$providers = Configure::read('OAuth.providers');
foreach ($providers as $name => $provider) {
- if (!empty($provider['options']['callbackLinkSocialUri']) &&
+ if (
+ !empty($provider['options']['callbackLinkSocialUri']) &&
!empty($provider['options']['linkSocialUri']) &&
!empty($provider['options']['clientId']) &&
!empty($provider['options']['clientSecret'])
diff --git a/src/Webauthn/AuthenticateAdapter.php b/src/Webauthn/AuthenticateAdapter.php
new file mode 100644
index 000000000..592c9590a
--- /dev/null
+++ b/src/Webauthn/AuthenticateAdapter.php
@@ -0,0 +1,68 @@
+getUserEntity();
+ $allowed = array_map(function (PublicKeyCredentialSource $credential) {
+ return $credential->getPublicKeyCredentialDescriptor();
+ }, $this->repository->findAllForUserEntity($userEntity));
+
+ $options = $this->server->generatePublicKeyCredentialRequestOptions(
+ PublicKeyCredentialRequestOptions::USER_VERIFICATION_REQUIREMENT_PREFERRED, // Default value
+ $allowed
+ );
+ $this->request->getSession()->write(
+ 'Webauthn2fa.authenticateOptions',
+ $options
+ );
+
+ return $options;
+ }
+
+ /**
+ * Verify the registration response
+ *
+ * @return \Webauthn\PublicKeyCredentialSource
+ */
+ public function verifyResponse(): \Webauthn\PublicKeyCredentialSource
+ {
+ $options = $this->request->getSession()->read('Webauthn2fa.authenticateOptions');
+
+ return $this->loadAndCheckAssertionResponse($options);
+ }
+
+ /**
+ * @param \Webauthn\PublicKeyCredentialRequestOptions $options request options
+ * @return \Webauthn\PublicKeyCredentialSource
+ */
+ protected function loadAndCheckAssertionResponse($options): PublicKeyCredentialSource
+ {
+ return $this->server->loadAndCheckAssertionResponse(
+ json_encode($this->request->getData()),
+ $options,
+ $this->getUserEntity(),
+ $this->request
+ );
+ }
+}
diff --git a/src/Webauthn/BaseAdapter.php b/src/Webauthn/BaseAdapter.php
new file mode 100644
index 000000000..4ee30b09c
--- /dev/null
+++ b/src/Webauthn/BaseAdapter.php
@@ -0,0 +1,94 @@
+request = $request;
+ $rpEntity = new PublicKeyCredentialRpEntity(
+ Configure::read('Webauthn2fa.appName'), // The application name
+ Configure::read('Webauthn2fa.id')
+ );
+ /**
+ * @var \Cake\ORM\Entity $userSession
+ */
+ $userSession = $request->getSession()->read('Webauthn2fa.User');
+ $usersTable = $usersTable ?? TableRegistry::getTableLocator()
+ ->get($userSession->getSource());
+ $this->user = $usersTable->get($userSession->id);
+ $this->repository = new UserCredentialSourceRepository(
+ $this->user,
+ $usersTable
+ );
+
+ $this->server = new Server(
+ $rpEntity,
+ $this->repository
+ );
+ }
+
+ /**
+ * @return \Webauthn\PublicKeyCredentialUserEntity
+ */
+ protected function getUserEntity(): PublicKeyCredentialUserEntity
+ {
+ $user = $this->getUser();
+
+ return new PublicKeyCredentialUserEntity(
+ $user->webauthn_username ?? $user->username,
+ (string)$user->id,
+ (string)$user->first_name
+ );
+ }
+
+ /**
+ * @return array|mixed|null
+ */
+ public function getUser()
+ {
+ return $this->user;
+ }
+
+ /**
+ * @return bool
+ */
+ public function hasCredential(): bool
+ {
+ return (bool)$this->repository->findAllForUserEntity(
+ $this->getUserEntity()
+ );
+ }
+}
diff --git a/src/Webauthn/RegisterAdapter.php b/src/Webauthn/RegisterAdapter.php
new file mode 100644
index 000000000..c28b0504a
--- /dev/null
+++ b/src/Webauthn/RegisterAdapter.php
@@ -0,0 +1,65 @@
+getUserEntity();
+ $options = $this->server->generatePublicKeyCredentialCreationOptions(
+ $userEntity,
+ PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_NONE,
+ []
+ );
+ $this->request->getSession()->write('Webauthn2fa.registerOptions', $options);
+ $this->request->getSession()->write('Webauthn2fa.userEntity', $userEntity);
+
+ return $options;
+ }
+
+ /**
+ * Verify the registration response
+ *
+ * @return \Webauthn\PublicKeyCredentialSource
+ */
+ public function verifyResponse(): \Webauthn\PublicKeyCredentialSource
+ {
+ $options = $this->request->getSession()->read('Webauthn2fa.registerOptions');
+ $credential = $this->loadAndCheckAttestationResponse($options);
+ $this->repository->saveCredentialSource($credential);
+
+ return $credential;
+ }
+
+ /**
+ * @param \Webauthn\PublicKeyCredentialCreationOptions $options creation options
+ * @return \Webauthn\PublicKeyCredentialSource
+ */
+ protected function loadAndCheckAttestationResponse($options): \Webauthn\PublicKeyCredentialSource
+ {
+ $credential = $this->server->loadAndCheckAttestationResponse(
+ json_encode($this->request->getData()),
+ $options,
+ $this->request
+ );
+
+ return $credential;
+ }
+}
diff --git a/src/Webauthn/Repository/UserCredentialSourceRepository.php b/src/Webauthn/Repository/UserCredentialSourceRepository.php
new file mode 100644
index 000000000..ecda3cbb0
--- /dev/null
+++ b/src/Webauthn/Repository/UserCredentialSourceRepository.php
@@ -0,0 +1,77 @@
+user = $user;
+ $this->usersTable = $usersTable;
+ }
+
+ /**
+ * @param string $publicKeyCredentialId Public key credential id
+ * @return \Webauthn\PublicKeyCredentialSource|null
+ */
+ public function findOneByCredentialId(string $publicKeyCredentialId): ?PublicKeyCredentialSource
+ {
+ $encodedId = Base64Url::encode($publicKeyCredentialId);
+ $credential = $this->user['additional_data']['webauthn_credentials'][$encodedId] ?? null;
+
+ return $credential
+ ? PublicKeyCredentialSource::createFromArray($credential)
+ : null;
+ }
+
+ /**
+ * @inheritDoc
+ */
+ public function findAllForUserEntity(PublicKeyCredentialUserEntity $publicKeyCredentialUserEntity): array
+ {
+ if ($publicKeyCredentialUserEntity->getId() != $this->user->id) {
+ return [];
+ }
+ $credentials = $this->user['additional_data']['webauthn_credentials'] ?? [];
+ $list = [];
+ foreach ($credentials as $credential) {
+ $list[] = PublicKeyCredentialSource::createFromArray($credential);
+ }
+
+ return $list;
+ }
+
+ /**
+ * @param \Webauthn\PublicKeyCredentialSource $publicKeyCredentialSource Public key credential source
+ */
+ public function saveCredentialSource(PublicKeyCredentialSource $publicKeyCredentialSource): void
+ {
+ $credentials = $this->user['additional_data']['webauthn_credentials'] ?? [];
+ $id = Base64Url::encode($publicKeyCredentialSource->getPublicKeyCredentialId());
+ $credentials[$id] = json_decode(json_encode($publicKeyCredentialSource), true);
+ $this->user['additional_data'] = $this->user['additional_data'] ?? [];
+ $this->user['additional_data']['webauthn_credentials'] = $credentials;
+ $this->usersTable->saveOrFail($this->user);
+ }
+}
diff --git a/src/Template/Users/add.ctp b/templates/Users/add.php
similarity index 59%
rename from src/Template/Users/add.ctp
rename to templates/Users/add.php
index 751b2f3c6..2b795d20b 100644
--- a/src/Template/Users/add.ctp
+++ b/templates/Users/add.php
@@ -1,36 +1,36 @@
-
+
-
-
- Html->link(__d('CakeDC/Users', 'List Users'), ['action' => 'index']) ?> +
- Html->link(__d('cake_d_c/users', 'List Users'), ['action' => 'index']) ?>
Form->create(${$tableAlias}); ?>
- Form->button(__d('CakeDC/Users', 'Submit')) ?>
+ Form->button(__d('cake_d_c/users', 'Submit')) ?>
Form->end() ?>
diff --git a/src/Template/Users/change_password.ctp b/templates/Users/change_password.php
similarity index 64%
rename from src/Template/Users/change_password.ctp
rename to templates/Users/change_password.php
index 339f2fc65..7efba8f10 100644
--- a/src/Template/Users/change_password.ctp
+++ b/templates/Users/change_password.php
@@ -2,26 +2,26 @@
Flash->render('auth') ?>
Form->create($user) ?>
- Form->button(__d('CakeDC/Users', 'Submit')); ?>
+ Form->button(__d('cake_d_c/users', 'Submit')); ?>
Form->end() ?>
\ No newline at end of file
diff --git a/src/Template/Users/edit.ctp b/templates/Users/edit.php
similarity index 52%
rename from src/Template/Users/edit.ctp
rename to templates/Users/edit.php
index 91794b822..551076252 100644
--- a/src/Template/Users/edit.ctp
+++ b/templates/Users/edit.php
@@ -1,73 +1,74 @@
-
+
- Form->postLink( - __d('CakeDC/Users', 'Delete'), + __d('cake_d_c/users', 'Delete'), ['action' => 'delete', $Users->id], - ['confirm' => __d('CakeDC/Users', 'Are you sure you want to delete # {0}?', $Users->id)] + ['confirm' => __d('cake_d_c/users', 'Are you sure you want to delete # {0}?', $Users->id)] ); ?> -
- Html->link(__d('CakeDC/Users', 'List Users'), ['action' => 'index']) ?> +
- Html->link(__d('cake_d_c/users', 'List Users'), ['action' => 'index']) ?>
Form->create($Users); ?>
- Form->button(__d('CakeDC/Users', 'Submit')) ?>
+ Form->button(__d('cake_d_c/users', 'Submit')) ?>
Form->end() ?>
-
+
diff --git a/src/Template/Users/profile.ctp b/templates/Users/profile.php
similarity index 67%
rename from src/Template/Users/profile.ctp
rename to templates/Users/profile.php
index 8b59d9ee2..bd786ffc1 100644
--- a/src/Template/Users/profile.ctp
+++ b/templates/Users/profile.php
@@ -1,11 +1,11 @@
@@ -18,37 +18,37 @@
Html->tag(
'span',
- __d('CakeDC/Users', '{0} {1}', $user->first_name, $user->last_name),
+ __d('cake_d_c/users', '{0} {1}', $user->first_name, $user->last_name),
['class' => 'full_name']
)
?>
- Html->link(__d('CakeDC/Users', 'Change Password'), ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'changePassword']); ?>
+ Html->link(__d('cake_d_c/users', 'Change Password'), ['plugin' => 'CakeDC/Users', 'controller' => 'Users', 'action' => 'changePassword']); ?>
-
+
username) ?>
- +email) ?>
User->socialConnectLinkList($user->social_accounts) ?> social_accounts)): ?> - +| - | - | + | + | + | |
|---|---|---|---|---|---|
| provider) ?> | Html->link( + $socialAccount->link && $socialAccount->link != '#' ? $this->Html->link( $linkText, $socialAccount->link, ['target' => '_blank'] - ) ?> | + ) : '-' ?>