FirebaseClient.php

<?php
 
namespace ceLTIc\LTI\Jwt;
 
use Firebase\JWT\JWT;
use Firebase\JWT\JWK;
use Firebase\JWT\Key;
use ceLTIc\LTI\Http\HttpMessage;
use ceLTIc\LTI\Util;
 
class FirebaseClient implements ClientInterface
{
 
    const SUPPORTED_ALGORITHMS = array('RS256', 'RS384', 'RS512');
 
    private $jwtString = null;
 
    private $jwtHeaders = null;
 
    private $jwtPayload = null;
 
    private static $lastHeaders = null;
 
    private static $lastPayload = null;
 
    public static function getSupportedAlgorithms()
    {
        return self::SUPPORTED_ALGORITHMS;
    }
 
    public function hasJwt()
    {
        return !empty($this->jwtString);
    }
 
    public function isEncrypted()
    {
        return false;  // Not supported by this client
    }
 
    public function load($jwtString, $privateKey = null)
    {
        $sections = explode('.', $jwtString);
        $ok = count($sections) === 3;
        if ($ok) {
            $headers = Util::jsonDecode(JWT::urlsafeB64Decode($sections[0]));
            $payload = Util::jsonDecode(JWT::urlsafeB64Decode($sections[1]));
            $ok = !is_null($headers) && !is_null($payload);
        }
        if ($ok) {
            $this->jwtString = $jwtString;
            $this->jwtHeaders = $headers;
            $this->jwtPayload = $payload;
        } else {
            $this->jwtString = null;
            $this->jwtHeaders = null;
            $this->jwtPayload = null;
        }
 
        return $ok;
    }
 
    public function getJweHeaders()
    {
        return array();  // Encryption not supported by this client
    }
 
    public function hasHeader($name)
    {
        return !empty($this->jwtHeaders) && isset($this->jwtHeaders->{$name});
    }
 
    public function getHeader($name, $defaultValue = null)
    {
        if ($this->hasHeader($name)) {
            $value = $this->jwtHeaders->{$name};
        } else {
            $value = $defaultValue;
        }
 
        return $value;
    }
 
    public function getHeaders()
    {
        return $this->jwtHeaders;
    }
 
    public static function getLastHeaders()
    {
        return self::$lastHeaders;
    }
 
    public function hasClaim($name)
    {
        return !empty($this->jwtPayload) && isset($this->jwtPayload->{$name});
    }
 
    public function getClaim($name, $defaultValue = null)
    {
        if ($this->hasClaim($name)) {
            $value = $this->jwtPayload->{$name};
        } else {
            $value = $defaultValue;
        }
 
        return $value;
    }
 
    public function getPayload()
    {
        return $this->jwtPayload;
    }
 
    public static function getLastPayload()
    {
        return self::$lastPayload;
    }
 
    public function verify($publicKey, $jku = null)
    {
        $ok = false;
        $hasPublicKey = !empty($publicKey);
        if ($hasPublicKey) {
            if (is_string($publicKey)) {
                $json = Util::jsonDecode($publicKey, true);
                if (!is_null($json)) {
                    try {
                        $jwks = array('keys' => array($json));
                        $publicKey = static::parseKeySet($jwks);
                    } catch (\Exception $e) {
 
                    }
                } else {
                    $publicKey = new Key($publicKey, $this->getHeader('alg'));
                }
            }
        } elseif (!empty($jku)) {
            $publicKey = $this->fetchPublicKey($jku);
        }
        JWT::$leeway = Jwt::$leeway;
        $retry = false;
        do {
            try {
                JWT::decode($this->jwtString, $publicKey);
                $ok = true;
            } catch (\Exception $e) {
                Util::logError($e->getMessage());
                if ($retry) {
                    $retry = false;
                } elseif ($hasPublicKey && !empty($jku)) {
                    try {
                        $publicKey = $this->fetchPublicKey($jku);
                        $retry = true;
                    } catch (\Exception $e) {
 
                    }
                }
            }
        } while (!$ok && $retry);
 
        return $ok;
    }
 
    public static function sign($payload, $signatureMethod, $privateKey, $kid = null, $jku = null, $encryptionMethod = null,
        $publicKey = null)
    {
        if (!empty($encryptionMethod)) {
            $errorMessage = 'Encrypted tokens not supported by the Firebase JWT client';
            Util::logError($errorMessage);
            throw new \Exception($errorMessage);
        }
        $jwtString = JWT::encode($payload, $privateKey, $signatureMethod, $kid);
        $sections = explode('.', $jwtString);
        self::$lastHeaders = Util::jsonDecode(JWT::urlsafeB64Decode($sections[0]));
        self::$lastPayload = Util::jsonDecode(JWT::urlsafeB64Decode($sections[1]));
 
        return $jwtString;
    }
 
    public static function generateKey($signatureMethod = 'RS256')
    {
        $privateKey = null;
        switch ($signatureMethod) {
            case 'RS512':
                $size = 4096;
                break;
            case 'RS384':
                $size = 3072;
                break;
            default:
                $size = 2048;
                break;
        }
        $config = array(
            "private_key_bits" => $size,
            "private_key_type" => OPENSSL_KEYTYPE_RSA
        );
        $res = openssl_pkey_new($config);
        if ($res !== false) {
            if (openssl_pkey_export($res, $privateKey)) {
                $privateKey = str_replace('-----BEGIN PRIVATE KEY-----', '-----BEGIN RSA PRIVATE KEY-----', $privateKey);
                $privateKey = str_replace('-----END PRIVATE KEY-----', '-----END RSA PRIVATE KEY-----', $privateKey);
            }
        }
 
        return $privateKey;
    }
 
    public static function getPublicKey($privateKey)
    {
        $publicKey = null;
        $res = openssl_pkey_get_private($privateKey);
        if ($res !== false) {
            $details = openssl_pkey_get_details($res);
            $publicKey = $details['key'];
        }
 
        return $publicKey;
    }
 
    public static function getJWKS($pemKey, $signatureMethod, $kid = null)
    {
        $keys['keys'] = array();
        $res = openssl_pkey_get_private($pemKey);
        if ($res === false) {
            $res = openssl_pkey_get_public($pemKey);
        }
        if ($res !== false) {
            $details = openssl_pkey_get_details($res);
            $key = [
                'kty' => 'RSA',
                'n' => JWT::urlsafeB64Encode($details['rsa']['n']),
                'e' => JWT::urlsafeB64Encode($details['rsa']['e']),
                'alg' => $signatureMethod,
                'use' => 'sig'
            ];
            if (!empty($kid)) {
                $key['kid'] = $kid;
            }
            $keys['keys'][] = $key;
        }
 
        return $keys;
    }
 
###
###  PRIVATE METHODS
###
 
    private function fetchPublicKey($jku)
    {
        $publicKey = array();
        $http = new HttpMessage($jku);
        if ($http->send()) {
            $keys = Util::jsonDecode($http->response, true);
            if (is_array($keys)) {
                try {
                    $publicKey = static::parseKeySet($keys);
                } catch (\Exception $e) {
 
                }
            }
        }
 
        return $publicKey;
    }
 
    private static function parseKeySet($jwks)
    {
        $keys = array();
 
        if (!isset($jwks['keys'])) {
            throw new \UnexpectedValueException('"keys" member must exist in the JWK Set');
        }
        if (empty($jwks['keys'])) {
            throw new \InvalidArgumentException('JWK Set did not contain any keys');
        }
 
        foreach ($jwks['keys'] as $k => $v) {
            if (!empty($v['alg'])) {
                $kid = isset($v['kid']) ? $v['kid'] : $k;
                if ($key = JWK::parseKey($v)) {
                    if (!$key instanceof Key) {
                        $key = new Key($key, $v['alg']);
                    }
                    $keys[$kid] = $key;
                }
            }
        }
 
        if (empty($keys)) {
            throw new \UnexpectedValueException('No supported algorithms found in JWK Set');
        }
 
        return $keys;
    }
 
}