SpomkyLabsClient.php

<?php
 
namespace ceLTIc\LTI\Jwt;
 
use Jose;
use Jose\Object\JWK;
use Jose\Object\JWE;
use Jose\Object\JWS;
use Jose\Factory\JWKFactory;
use Jose\KeyConverter\RSAKey;
use Jose\Algorithm\Signature;
use Jose\Checker\CheckerManager;
use Jose\Checker\ExpirationTimeChecker;
use Jose\Checker\IssuedAtChecker;
use Jose\Checker\NotBeforeChecker;
use Base64Url\Base64Url;
use ceLTIc\LTI\Util;
 
class SpomkyLabsClient implements ClientInterface
{
 
    const SUPPORTED_ALGORITHMS = array('RS256', 'RS384', 'RS512');
 
    private $jwe = null;
 
    private $jwt = null;
 
    private $payload = null;
 
    private static $lastHeaders = null;
 
    private static $lastPayload = null;
 
    public function __construct()
    {
        Util::logDebug('Class ceLTIc\LTI\Jwt\SpomkyLabsClient has been deprecated; please try using ceLTIc\LTI\Jwt\WebTokenClient instead.',
            true);
    }
 
    public static function getSupportedAlgorithms()
    {
        return self::SUPPORTED_ALGORITHMS;
    }
 
    public function hasJwt()
    {
        return !empty($this->jwt);
    }
 
    public function isEncrypted()
    {
        return !empty($this->jwe);
    }
 
    public function load($jwtString, $privateKey = null)
    {
        $ok = true;
        $this->jwe = null;
        $this->jwt = null;
        try {
            $loader = new Jose\Loader();
            $this->jwt = $loader->load($jwtString);
            $parts = explode('.', $jwtString);
            if (count($parts) >= 2) {
                $this->payload = Util::jsonDecode(Base64Url::decode($parts[1]));
            }
            $this->decrypt($privateKey);
        } catch (\Exception $e) {
            $ok = false;
        }
 
        return $ok;
    }
 
    public function getJweHeaders()
    {
        if ($this->isEncrypted()) {
            $headers = $this->jwe->getSharedProtectedHeaders();
        } else {
            $headers = array();
        }
 
        return $headers;
    }
 
    public function hasHeader($name)
    {
        if ($this->jwt instanceof JWS) {
            $ok = $this->jwt->getSignature(0)->hasProtectedHeader($name);
        } else {
            $ok = false;
        }
 
        return $ok;
    }
 
    public function getHeader($name, $defaultValue = null)
    {
        try {
            $value = $this->jwt->getSignature(0)->getProtectedHeader($name);
        } catch (\Exception $e) {
            $value = $defaultValue;
        }
 
        return $value;
    }
 
    public function getHeaders()
    {
        $headers = null;
        if ($this->jwt instanceof JWS) {
            $headers = $this->jwt->getSignature(0)->getProtectedHeaders();
        }
 
        return $headers;
    }
 
    public static function getLastHeaders()
    {
        return self::$lastHeaders;
    }
 
    public function hasClaim($name)
    {
        return isset($this->payload->{$name});
    }
 
    public function getClaim($name, $defaultValue = null)
    {
        if ($this->hasClaim($name)) {
            $value = $this->payload->{$name};
        } else {
            $value = defaultValue;
        }
 
        return $value;
    }
 
    public function getPayload()
    {
        return $this->payload;
    }
 
    public static function getLastPayload()
    {
        return self::$lastPayload;
    }
 
    public function verify($publicKey, $jku = null)
    {
        $ok = false;
        $hasPublicKey = !empty($publicKey);
        $retry = false;
        $leeway = Jwt::$leeway;
        do {
            try {
                $checkerManager = new CheckerManager();
                $checkerManager->addClaimChecker(new ExpirationTimeChecker($leeway));
                $checkerManager->addClaimChecker(new IssuedAtChecker($leeway));
                $checkerManager->addClaimChecker(new NotBeforeChecker($leeway));
                $checkerManager->checkJWS($this->jwt, 0);
                $verifier = new Jose\Verifier(['RS256', 'RS384', 'RS512']);
                switch ($this->getHeader('alg')) {
                    case 'RS256':
                    case 'RS384':
                    case 'RS512':
                        if ((Jwt::$allowJkuHeader && $this->hasHeader('jku')) || (!empty($jku) && empty($publicKey))) {
                            if (Jwt::$allowJkuHeader && $this->hasHeader('jku')) {
                                $jwks = JWKFactory::createFromJKU($this->getHeader('jku'), true, null, 86400, true);
                            } else {
                                $jwks = JWKFactory::createFromJKU($jku, true, null, 86400, true);
                            }
                            $verifier->verifyWithKeySet($this->jwt, $jwks);
                            $jwk = $jwks->selectKey('sig', $this->getHeader('alg'), ['kid' => $this->getHeader('kid')]);
                        } else {
                            $jwk = self::getJwk($publicKey, ['alg' => $this->getHeader('alg'), 'use' => 'sig']);
                            $verifier->verifyWithKey($this->jwt, $jwk);
                        }
                        break;
                }
                $ok = true;
            } catch (\Exception $e) {
                Util::logError($e->getMessage());
                if ($retry) {
                    $retry = false;
                } elseif ($hasPublicKey && !empty($jku)) {
                    $retry = true;
                    $publicKey = null;
                    $hasPublicKey = false;
                }
            }
        } while (!$ok && $retry);
 
        return $ok;
    }
 
    public static function sign($payload, $signatureMethod, $privateKey, $kid = null, $jku = null, $encryptionMethod = null,
        $publicKey = null)
    {
        switch ($signatureMethod) {
            case 'RS512':
                $signature = new Signature\RS512();
                break;
            case 'RS384':
                $signature = new Signature\RS384();
                break;
            default:
                $signatureMethod = 'RS256';
                $signature = new Signature\RS256();
                break;
        }
        $jwk = self::getJwk($privateKey, ['alg' => $signatureMethod, 'use' => 'sig']);
        $signer = new Jose\Signer([$signature]);
        $jwtCreator = new Jose\JWTCreator($signer);
        $headers = ['typ' => 'JWT', 'alg' => $signatureMethod];
        if (!empty($kid)) {
            $headers['kid'] = $kid;
            if (!empty($jku)) {
                $headers['jku'] = $jku;
            }
        }
        if (empty($encryptionMethod)) {
            $jws = $jwtCreator->sign($payload, $headers, $jwk);
        } elseif (!empty($publicKey)) {
            $keyEnc = 'RSA-OAEP-256';
            $encHeaders = ['use' => 'enc', 'alg' => $keyEnc, 'enc' => $encryptionMethod, 'zip' => 'DEF'];
            $encJwk = self::getJwk($publicKey, $encHeaders);
            $encrypter = Jose\Encrypter::createEncrypter([$keyEnc], [$encryptionMethod], ['DEF']);
            $jwtCreator->enableEncryptionSupport($encrypter);
            $jws = $jwtCreator->signAndEncrypt($payload, $headers, $jwk, $encHeaders, $encJwk);
        } else {
            $errorMessage = 'No public key provided for encrypting JWT content';
            Util::logError($errorMessage);
            throw new \Exception($errorMessage);
        }
        self::$lastHeaders = $headers;
        self::$lastPayload = $payload;
 
        return $jws;
    }
 
    public static function generateKey($signatureMethod = 'RS256')
    {
        switch ($signatureMethod) {
            case 'RS512':
                $size = 4096;
                break;
            case 'RS384':
                $size = 3072;
                break;
            case 'RS256':
            default:
                $size = 2048;
                $signatureMethod = 'RS256';
                break;
        }
        $jwk = JWKFactory::createKey([
                'kty' => 'RSA',
                'size' => $size,
                'alg' => $signatureMethod,
                'use' => 'sig',
        ]);
        $rsa = new RSAKey($jwk);
        $privateKey = $rsa->toPEM();
 
        return $privateKey;
    }
 
    public static function getPublicKey($privateKey)
    {
        $publicKey = null;
        try {
            $jwk = self::getJwk($privateKey, ['use' => 'sig']);
            $jwk = $jwk->toPublic();
            $rsa = new RSAKey($jwk);
            $publicKey = $rsa->toPEM();
        } catch (\Exception $e) {
 
        }
 
        return $publicKey;
    }
 
    public static function getJWKS($key, $signatureMethod, $kid)
    {
        $keys['keys'] = array();
        $additionalValues = ['alg' => $signatureMethod, 'use' => 'sig'];
        if (!empty($kid)) {
            $additionalValues['kid'] = $kid;
        }
        try {
            $jwk = self::getJwk($key, $additionalValues);
            $jwk = $jwk->toPublic();
            $rsa = new RSAKey($jwk);
            $rsa = $rsa::toPublic($rsa);
            $keys['keys'][] = $rsa->toArray();
        } catch (\Exception $e) {
 
        }
 
        return $keys;
    }
 
###
###    PRIVATE METHODS
###
 
    private function decrypt($privateKey)
    {
        if ($this->jwt instanceof JWE) {
            $this->jwe = clone $this->jwt;
            $keyEnc = $this->jwe->getSharedProtectedHeader('alg');
            $encryptionMethod = $this->jwe->getSharedProtectedHeader('enc');
            $jwk = self::getJwk($privateKey, ['alg' => $keyEnc, 'use' => 'enc']);
            $decrypter = Jose\Decrypter::createDecrypter([$keyEnc], [$encryptionMethod], ['DEF', 'GZ', 'ZLIB']);
            $decrypter->decryptUsingKey($this->jwt, $jwk);
            $jwtString = $this->jwt->getPayload();
            $loader = new Jose\Loader();
            $this->jwt = $loader->load($jwtString);
            $parts = explode('.', $jwtString);
            if (count($parts) >= 2) {
                $this->payload = Util::jsonDecode(Base64Url::decode($parts[1]));
            }
            $ok = $this->jwt instanceof JWS;
        }
    }
 
    private static function getJwk($key, $additionalValues)
    {
        $keyValues = Util::jsonDecode($key, true);
        if (!is_array($keyValues)) {
            $jwk = JWKFactory::createFromKey($key, null, $additionalValues);
        } else {
            $keyValues = array_merge($keyValues, $additionalValues);
            $jwk = new JWK($keyValues);
        }
 
        return $jwk;
    }
 
}