openstackid/app/Http/Controllers/AdminController.php

<?php namespace App\Http\Controllers;
/**
 * Copyright 2015 OpenStack Foundation
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * http://www.apache.org/licenses/LICENSE-2.0
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 **/

use App\Http\Utils\CountryList;
use App\libs\Auth\Repositories\IBannedIPRepository;
use App\libs\Auth\Repositories\IGroupRepository;
use Auth\Repositories\IUserRepository;
use Illuminate\Support\Facades\Request;
use Illuminate\Support\Facades\Response;
use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Facades\View;
use Illuminate\Support\Facades\Redirect;
use OAuth2\Repositories\IAccessTokenRepository;
use OAuth2\Repositories\IApiEndpointRepository;
use OAuth2\Repositories\IApiRepository;
use OAuth2\Repositories\IApiScopeRepository;
use OAuth2\Repositories\IClientRepository;
use OAuth2\Repositories\IRefreshTokenRepository;
use OAuth2\Repositories\IResourceServerRepository;
use OAuth2\Repositories\IApiScopeGroupRepository;
use OAuth2\Repositories\IServerPrivateKeyRepository;
use OAuth2\Services\IApiEndpointService;
use OAuth2\Services\IApiScopeService;
use OAuth2\Services\IApiService;
use OAuth2\Services\IClientService;
use OAuth2\Services\IResourceServerService;
use OpenId\Services\IUserService;
use Sokil\IsoCodes\IsoCodesFactory;
use utils\Filter;
use utils\FilterElement;
use utils\PagingInfo;
use Utils\Services\IAuthService;
use Utils\Services\IBannedIPService;
use Utils\Services\IServerConfigurationService;
use Illuminate\Support\Facades\Log;
/**
 * Class AdminController
 * @package App\Http\Controllers
 */
class AdminController extends Controller {

    /**
     * @var IClientService
     */
    private $client_service;
    /**
     * @var IApiScopeService
     */
    private $scope_service;

    /**
     * @var IAccessTokenRepository
     */
    private $access_token_repository;

    /**
     * @var IRefreshTokenRepository
     */
    private $refresh_token_repository;

    /**
     * @var IResourceServerService
     */
    private $resource_server_service;
    /**
     * @var IApiService
     */
    private $api_service;
    /**
     * @var IApiEndpointService
     */
    private $endpoint_service;
    /**
     * @var IAuthService
     */
    private $auth_service;
    /**
     * @var IUserService
     */
    private $user_service;
    /**
     * @var IServerConfigurationService
     */
    private $configuration_service;
    /**
     * @var IBannedIPService
     */
    private $banned_ips_service;

    /**
     * @var IServerPrivateKeyRepository
     */
    private $private_keys_repository;

    /**
     * @var IApiScopeGroupRepository
     */
    private $api_group_repository;

    /**
     * @var IClientRepository
     */
    private $client_repository;

    /**
     * @var IUserRepository
     */
    private $user_repository;

    /**
     * @var IApiEndpointRepository
     */
    private $endpoint_repository;

    /**
     * @var IApiScopeRepository
     */
    private $scope_repository;

    /**
     * @var IApiRepository
     */
    private $api_repository;

    /**
     * @var IResourceServerRepository
     */
    private $resource_server_repository;

    /**
     * @var IGroupRepository
     */
    private $group_repository;

    /**
     * @var IBannedIPRepository
     */
    private $banned_ips_repository;

    const TokenPageSize = 25;

    /**
     * AdminController constructor.
     * @param IClientService $client_service
     * @param IApiScopeService $scope_service
     * @param IAccessTokenRepository $access_token_repository
     * @param IRefreshTokenRepository $refresh_token_repository
     * @param IResourceServerService $resource_server_service
     * @param IApiService $api_service
     * @param IApiEndpointService $endpoint_service
     * @param IAuthService $auth_service
     * @param IUserService $user_service
     * @param IServerConfigurationService $configuration_service
     * @param IBannedIPService $banned_ips_service
     * @param IServerPrivateKeyRepository $private_keys_repository
     * @param IApiScopeGroupRepository $api_group_repository
     * @param IClientRepository $client_repository
     * @param IUserRepository $user_repository
     * @param IApiEndpointRepository $endpoint_repository
     * @param IApiScopeRepository $scope_repository
     * @param IApiRepository $api_repository
     * @param IResourceServerRepository $resource_server_repository
     * @param IBannedIPRepository $banned_ips_repository
     * @param IGroupRepository $group_repository
     */
    public function __construct(
        IClientService $client_service,
        IApiScopeService $scope_service,
        IAccessTokenRepository $access_token_repository,
        IRefreshTokenRepository $refresh_token_repository,
        IResourceServerService $resource_server_service,
        IApiService $api_service,
        IApiEndpointService $endpoint_service,
        IAuthService $auth_service,
        IUserService $user_service,
        IServerConfigurationService $configuration_service,
        IBannedIPService $banned_ips_service,
        IServerPrivateKeyRepository $private_keys_repository,
        IApiScopeGroupRepository $api_group_repository,
        IClientRepository $client_repository,
        IUserRepository $user_repository,
        IApiEndpointRepository $endpoint_repository,
        IApiScopeRepository $scope_repository,
        IApiRepository $api_repository,
        IResourceServerRepository $resource_server_repository,
        IBannedIPRepository $banned_ips_repository,
        IGroupRepository $group_repository
    )
    {

        $this->client_service             = $client_service;
        $this->scope_service              = $scope_service;
        $this->access_token_repository    = $access_token_repository;
        $this->refresh_token_repository   = $refresh_token_repository;
        $this->resource_server_service    = $resource_server_service;
        $this->api_service                = $api_service;
        $this->endpoint_service           = $endpoint_service;
        $this->auth_service               = $auth_service;
        $this->user_service               = $user_service;
        $this->configuration_service      = $configuration_service;
        $this->banned_ips_service         = $banned_ips_service;
        $this->private_keys_repository    = $private_keys_repository;
        $this->api_group_repository       = $api_group_repository;
        $this->client_repository          = $client_repository;
        $this->user_repository            = $user_repository;
        $this->endpoint_repository        = $endpoint_repository;
        $this->scope_repository           = $scope_repository;
        $this->api_repository             = $api_repository;
        $this->resource_server_repository = $resource_server_repository;
        $this->banned_ips_repository      = $banned_ips_repository;
        $this->group_repository           = $group_repository;
    }

    /**
     * @param $id
     * @return \Illuminate\Contracts\View\View
     */
    public function editRegisteredClient($id)
    {
        $user    = $this->auth_service->getCurrentUser();
        $client  = $this->client_repository->getClientByIdentifier($id);

        if (is_null($client)) {
            Log::warning(sprintf("invalid oauth2 client id %s", $id));
            return View::make("errors.404");
        }

        $selected_scopes = $client->getClientScopes();
        $aux_scopes      = [];

        foreach ($selected_scopes as $scope) {
            array_push($aux_scopes, $scope->getId());
        }

        // scope pre processing
        $scopes           = $this->scope_repository->getAvailableScopes();
        $group_scopes     = $user->getGroupScopes();
        $merged_scopes    = array_merge($scopes, $group_scopes);
        $final_scopes     = [];
        $processed_scopes = [];
        foreach($merged_scopes as  $test_scope){
            if(isset($processed_scopes[$test_scope->getId()])) continue;

            $processed_scopes[$test_scope->getId()] = $test_scope->getId();
            $final_scopes[] = $test_scope;
        }

        usort($final_scopes, function($elem1, $elem2){
            return $elem1->getApiId() > $elem2->getApiId() ;
        });
        // scope pre processing

        $access_tokens = $this->access_token_repository->getAllValidByClientIdentifier($client->getId(), new PagingInfo(1 , self::TokenPageSize));

        foreach ($access_tokens->getItems() as $token) {
            $friendly_scopes = $this->scope_repository->getFriendlyScopesByName(explode(' ', $token->scope));
            $token->setFriendlyScopes(implode(',', $friendly_scopes));
        }

        $refresh_tokens = $this->refresh_token_repository->getAllValidByClientIdentifier($client->getId(), new PagingInfo(1 , self::TokenPageSize));

        foreach ($refresh_tokens->getItems() as $token) {
            $friendly_scopes = $this->scope_repository->getFriendlyScopesByName(explode(' ', $token->scope));
            $token->setFriendlyScopes(implode(',', $friendly_scopes));
        }

        return View::make("oauth2.profile.edit-client",
            [
                'client'               => $client,
                'selected_scopes'      => $aux_scopes,
                'scopes'               => $final_scopes,
                'access_tokens'        => $access_tokens->getItems(),
                'access_tokens_pages'  => $access_tokens->getTotal() > 0 ? intval(ceil($access_tokens->getTotal() / self::TokenPageSize)) : 0,
                "use_system_scopes"    => $user->canUseSystemScopes(),
                'refresh_tokens'       => $refresh_tokens->getItems(),
                'refresh_tokens_pages' => $refresh_tokens->getTotal() > 0 ? intval(ceil($refresh_tokens->getTotal() / self::TokenPageSize)) : 0,
            ]);
    }

    // Api Scope Groups

    public function listApiScopeGroups()
    {
        $user                = $this->auth_service->getCurrentUser();
        $groups              = $this->api_group_repository->getAllByPage(new PagingInfo(1, PHP_INT_MAX));
        $non_selected_scopes = $this->scope_repository->getAssignableByGroups();
        return View::make("oauth2.profile.admin.api-scope-groups", [
            'groups'               => $groups,
            'non_selected_scopes'  => $non_selected_scopes,
        ]);
    }

    /**
     * @param $id
     * @return \Illuminate\Contracts\View\View|\Illuminate\Http\Response
     */
    public function editApiScopeGroup($id){
        $group = $this->api_group_repository->getById($id);

        if(is_null($group))
            return Response::view('errors.404', [], 404);

        $user   = $this->auth_service->getCurrentUser();
        $non_selected_scopes = $this->scope_repository->getAssignableByGroups();
        return View::make("oauth2.profile.admin.edit-api-scope-group",
            array
            (
                'group'                => $group,
                'non_selected_scopes'  => $non_selected_scopes,
            )
        );
    }

    // Resource servers

    /**
     * @return \Illuminate\Contracts\View\View
     */
    public function listResourceServers() {
        $user             = $this->auth_service->getCurrentUser();
        $resource_servers = $this->resource_server_repository->getAllByPage(new PagingInfo(1, PHP_INT_MAX));
        return View::make("oauth2.profile.admin.resource-servers",
            [
            'resource_servers'     => $resource_servers
            ]
        );
    }

    /**
     * @param $id
     * @return \Illuminate\Contracts\View\View|\Illuminate\Http\Response
     */
    public function editResourceServer($id){
        $resource_server = $this->resource_server_repository->getById($id);
        if(is_null($resource_server))
            return Response::view('errors.404', [], 404);
        $user   = $this->auth_service->getCurrentUser();
        return View::make("oauth2.profile.admin.edit-resource-server",array(
            'resource_server'=>$resource_server
        ));
    }

    /**
     * @param $id
     * @return \Illuminate\Contracts\View\View|\Illuminate\Http\Response
     */
    public function editApi($id){
        $api = $this->api_repository->getById($id);
        if(is_null($api))
            return Response::view('errors.404', [], 404);
        $user = $this->auth_service->getCurrentUser();
        return View::make("oauth2.profile.admin.edit-api",['api'=>$api]);
    }

    /**
     * @param $id
     * @return \Illuminate\Contracts\View\View|\Illuminate\Http\Response
     */
    public function editScope($id){
        $scope = $this->scope_repository->getById($id);
        if(is_null($scope))
            return Response::view('errors.404', [], 404);
        $user   = $this->auth_service->getCurrentUser();
        return View::make("oauth2.profile.admin.edit-scope",array(
            'scope'=>$scope));
    }

    /**
     * @param $id
     * @return \Illuminate\Contracts\View\View|\Illuminate\Http\Response
     */
    public function editEndpoint($id){
        $endpoint = $this->endpoint_repository->getById($id);
        if(is_null($endpoint)) return Response::view('errors.404', [], 404);
        $user   = $this->auth_service->getCurrentUser();
        $selected_scopes = [];
        $list = $endpoint->getScope();
        foreach($list as $selected_scope){
            $selected_scopes[] = $selected_scope->getId();
        }
        return View::make('oauth2.profile.admin.edit-endpoint',array(
            'endpoint' => $endpoint ,
            'selected_scopes' => $selected_scopes));
    }

    /**
     * @return \Illuminate\Contracts\View\View
     */
    public function editIssuedGrants(){

        $user           = $this->auth_service->getCurrentUser();
        $access_tokens  = $this->access_token_repository->getAllValidByUserId($user->getId(), new PagingInfo(1, self::TokenPageSize));
        $refresh_tokens = $this->refresh_token_repository->getAllValidByUserId($user->getId(), new PagingInfo(1, self::TokenPageSize));

        foreach($access_tokens->getItems() as $access_token){
            $friendly_scopes = $this->scope_repository->getFriendlyScopesByName(explode(' ',$access_token->getScope()));
            $access_token->setFriendlyScopes(implode(', ',$friendly_scopes));
        }

        foreach($refresh_tokens->getItems() as $refresh_token){
            $friendly_scopes = $this->scope_repository->getFriendlyScopesByName(explode(' ',$refresh_token->getScope()));
            $refresh_token->setFriendlyScopes(implode(', ',$friendly_scopes));
        }

        return View::make("oauth2.profile.edit-user-grants",
            array
            (
                'user_id'              => $user->getId(),
                'access_tokens'        => $access_tokens->getItems() ,
                'access_tokens_pages'  => $access_tokens->getTotal() > 0 ? intval(ceil($access_tokens->getTotal() / self::TokenPageSize)) : 0,
                'refresh_tokens'       => $refresh_tokens->getItems(),
                'refresh_tokens_pages' => $refresh_tokens->getTotal() > 0 ? intval(ceil($refresh_tokens->getTotal() / self::TokenPageSize)) : 0,
            )
        );
    }

    /**
     * @return \Illuminate\Contracts\View\View
     */
    public function listOAuth2Clients(){
        $user    = $this->auth_service->getCurrentUser();
        $clients = $user->getAvailableClients();

        return View::make("oauth2.profile.clients", [
            "username"             => $user->getFullName(),
            "user_id"              => $user->getId(),
            "use_system_scopes"    => $user->canUseSystemScopes(),
            'clients'              => $clients,
        ]);
    }

    /**
     * @return \Illuminate\Contracts\View\View
     */
    public function listLockedClients(){
        $filter  = new Filter();
        $filter->addFilterCondition(FilterElement::makeEqual('locked', true));
        $clients = $this->client_repository->getAllByPage(new PagingInfo(1, PHP_INT_MAX), $filter);

        return View::make("oauth2.profile.admin.clients",[
            'clients' => $clients
        ]);
    }

    public function listServerConfig(){

        $user          = $this->auth_service->getCurrentUser();
        $config_values = [];
        $dictionary    = array
        (
            'MaxFailed.Login.Attempts',
            'MaxFailed.LoginAttempts.2ShowCaptcha',
            'OpenId.Private.Association.Lifetime',
            'OpenId.Session.Association.Lifetime',
            'OpenId.Nonce.Lifetime',
            'OAuth2.AuthorizationCode.Lifetime',
            'OAuth2.AccessToken.Lifetime',
            'OAuth2.IdToken.Lifetime',
            'OAuth2.RefreshToken.Lifetime',
            'OAuth2.AccessToken.Revoked.Lifetime',
            'OAuth2.AccessToken.Void.Lifetime',
            'OAuth2.RefreshToken.Revoked.Lifetime',
            'OAuth2SecurityPolicy.MaxBearerTokenDisclosureAttempts',
            'OAuth2SecurityPolicy.MinutesWithoutExceptions',
            'OAuth2SecurityPolicy.MaxInvalidClientExceptionAttempts',
            'OAuth2SecurityPolicy.MaxInvalidRedeemAuthCodeAttempts',
            'OAuth2SecurityPolicy.MaxInvalidClientCredentialsAttempts',
        );

        foreach($dictionary as $key)
            $config_values[$key] = $this->configuration_service->getConfigValue($key);

        return View::make("admin.server-config",
            array
            (
                "username"             => $user->getFullName(),
                "user_id"              => $user->getId(),
                'config_values'        => $config_values,
            )
        );
    }

    public function saveServerConfig(){

        $values = Request::all();

        $rules = array
        (
            'general-max-failed-login-attempts'                                 => 'required|integer',
            'general-max-failed-login-attempts-captcha'                         => 'required|integer',
            'openid-private-association-lifetime'                               => 'required|integer',
            'openid-session-association-lifetime'                               => 'required|integer',
            'openid-nonce-lifetime'                                             => 'required|integer',
            'oauth2-auth-code-lifetime'                                         => 'required|integer',
            'oauth2-refresh-token-lifetime'                                     => 'required|integer',
            'oauth2-access-token-lifetime'                                      => 'required|integer',
            'oauth2-id-token-lifetime'                                          => 'required|integer',
            'oauth2-id-access-token-revoked-lifetime'                           => 'required|integer',
            'oauth2-id-access-token-void-lifetime'                              => 'required|integer',
            'oauth2-id-refresh-token-revoked-lifetime'                          => 'required|integer',
            'oauth2-id-security-policy-minutes-without-exceptions'              => 'required|integer',
            'oauth2-id-security-policy-max-bearer-token-disclosure-attempts'    => 'required|integer',
            'oauth2-id-security-policy-max-invalid-client-exception-attempts'   => 'required|integer',
            'oauth2-id-security-policy-max-invalid-redeem-auth-code-attempts'   => 'required|integer',
            'oauth2-id-security-policy-max-invalid-client-credentials-attempts' => 'required|integer',
        );

        $dictionary = array
        (
            'general-max-failed-login-attempts'                                 => 'MaxFailed.Login.Attempts',
            'general-max-failed-login-attempts-captcha'                         => 'MaxFailed.LoginAttempts.2ShowCaptcha',
            'openid-private-association-lifetime'                               => 'OpenId.Private.Association.Lifetime',
            'openid-session-association-lifetime'                               => 'OpenId.Session.Association.Lifetime',
            'openid-nonce-lifetime'                                             => 'OpenId.Nonce.Lifetime',
            'oauth2-auth-code-lifetime'                                         => 'OAuth2.AuthorizationCode.Lifetime',
            'oauth2-access-token-lifetime'                                      => 'OAuth2.AccessToken.Lifetime',
            'oauth2-id-token-lifetime'                                          => 'OAuth2.IdToken.Lifetime',
            'oauth2-refresh-token-lifetime'                                     => 'OAuth2.RefreshToken.Lifetime',
            'oauth2-id-access-token-revoked-lifetime'                           => 'OAuth2.AccessToken.Revoked.Lifetime',
            'oauth2-id-access-token-void-lifetime'                              => 'OAuth2.AccessToken.Void.Lifetime',
            'oauth2-id-refresh-token-revoked-lifetime'                          => 'OAuth2.RefreshToken.Revoked.Lifetime',
            'oauth2-id-security-policy-minutes-without-exceptions'              => 'OAuth2SecurityPolicy.MinutesWithoutExceptions',
            'oauth2-id-security-policy-max-bearer-token-disclosure-attempts'    => 'OAuth2SecurityPolicy.MaxBearerTokenDisclosureAttempts',
            'oauth2-id-security-policy-max-invalid-client-exception-attempts'   => 'OAuth2SecurityPolicy.MaxInvalidClientExceptionAttempts',
            'oauth2-id-security-policy-max-invalid-redeem-auth-code-attempts'   => 'OAuth2SecurityPolicy.MaxInvalidRedeemAuthCodeAttempts',
            'oauth2-id-security-policy-max-invalid-client-credentials-attempts' => 'OAuth2SecurityPolicy.MaxInvalidClientCredentialsAttempts',
        );

        // Creates a Validator instance and validates the data.
        $validation = Validator::make($values, $rules);

        if ($validation->fails())
        {
            return Redirect::action("AdminController@listServerConfig")->withErrors($validation);
        }

        foreach($values as $field => $value)
        {
            if(array_key_exists($field, $dictionary))
                $this->configuration_service->saveConfigValue($dictionary[$field], $value);
        }

        return Redirect::action("AdminController@listServerConfig");
    }

    public function listBannedIPs(){
        $page     = $this->banned_ips_repository->getAllByPage(new PagingInfo(1, PHP_INT_MAX));
            return View::make("admin.banned-ips",[
                "page" => $page
            ]
        );
    }

    public function listServerPrivateKeys(){
        return View::make("oauth2.profile.admin.server-private-keys",
            [
                'private_keys' => $this->private_keys_repository->getAllByPage(new PagingInfo(1, PHP_INT_MAX)),
            ]
        );
    }

    public function listUsers(){
        // init database
        $isoCodes = new IsoCodesFactory();

        // get languages database
        $languages = $isoCodes->getLanguages()->toArray();
        $lang2Code = [];
        foreach ($languages as $lang){
            if(!empty($lang->getAlpha2()))
                $lang2Code[] = $lang;
        }

        // get countries database
        $countries = $isoCodes->getCountries()->toArray();
        return View::make("admin.users",
            [
                'page'      => $this->user_repository->getAllByPage(new PagingInfo(1, 10)),
                'countries' => CountryList::getCountries(),
            ]
        );
    }

    public function listGroups(){
        return View::make("admin.groups",
            [
                'groups' => $this->group_repository->getAllByPage(new PagingInfo(1, 10)),

            ]
        );
    }

    /**
     * @param $user_id
     * @return \Illuminate\Contracts\View\View
     */
    public function editUser($user_id){

        $user = $this->user_repository->getById($user_id);
        if (is_null($user)) {
            Log::warning(sprintf("invalid user id %s", $user_id));
            return View::make("errors.404");
        }

        // init database
        $isoCodes = new IsoCodesFactory();

        // get languages database
        $languages = $isoCodes->getLanguages()->toArray();
        $lang2Code = [];
        foreach ($languages as $lang){
            if(!empty($lang->getAlpha2()))
                $lang2Code[] = $lang;
        }


        return View::make("admin.edit-user",
            [
                'user'      => $user,
                'countries' => CountryList::getCountries(),
                'languages' => $lang2Code,
            ]
        );
    }

    /**
     * @param $group_id
     * @return \Illuminate\Contracts\View\View
     */
    public function editGroup($group_id){

        $group = $this->group_repository->getById($group_id);

        if (is_null($group)) {
            Log::warning(sprintf("invalid group id %s", $group_id));
            return View::make("errors.404");
        }

        return View::make("admin.edit-group",
            [
                'group' => $group,
            ]
        );
    }
}