Skip to content

Commit 7f78ee5

Browse files
johanibjohanib
committed
Rework SRAMTestFilter
1 parent c32a809 commit 7f78ee5

File tree

17 files changed

+607
-232
lines changed

17 files changed

+607
-232
lines changed

‎app/config/parameters.yml.dist‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,7 @@ parameters:
230230
feature_enable_consent: true
231231
feature_stepup_sfo_override_engine_entityid: false
232232
feature_enable_idp_initiated_flow: true
233-
feature_enable_sram_interrupt: true
233+
feature_enable_sram_interrupt: false
234234

235235
##########################################################################################
236236
## PROFILE SETTINGS

‎library/EngineBlock/Application/DiContainer.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
use OpenConext\EngineBlock\Stepup\StepupEntityFactory;
2727
use OpenConext\EngineBlock\Stepup\StepupGatewayCallOutHelper;
2828
use OpenConext\EngineBlock\Validator\AllowedSchemeValidator;
29+
use OpenConext\EngineBlockBundle\Sbs\SbsClient;
2930
use Symfony\Component\DependencyInjection\ContainerInterface as SymfonyContainerInterface;
3031

3132
class EngineBlock_Application_DiContainer extends Pimple
@@ -306,6 +307,11 @@ protected function getSymfonyContainer()
306307
return $this->container;
307308
}
308309

310+
public function getSbsClient(): \OpenConext\EngineBlockBundle\Sbs\SbsClientInterface
311+
{
312+
return $this->container->get('engineblock.sbs.sbs_client');
313+
}
314+
309315
public function getPdpClient()
310316
{
311317
return $this->container->get('engineblock.pdp.pdp_client');
@@ -530,12 +536,6 @@ protected function getStepupEndpoint()
530536
return $this->container->get('engineblock.configuration.stepup.endpoint');
531537
}
532538

533-
/** @return \OpenConext\EngineBlock\SRAM\SRAMEndpoint $sramEndpoint */
534-
public function getSRAMEndpoint()
535-
{
536-
return $this->container->get('engineblock.configuration.sram.endpoint');
537-
}
538-
539539
/** @return string */
540540
public function getStepupEntityIdOverrideValue()
541541
{

‎library/EngineBlock/Application/TestDiContainer.php‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@
1717
*/
1818

1919
use OpenConext\EngineBlock\Stepup\StepupEndpoint;
20+
use OpenConext\EngineBlockBundle\Configuration\FeatureConfigurationInterface;
2021
use OpenConext\EngineBlockBundle\Pdp\PdpClientInterface;
22+
use OpenConext\EngineBlockBundle\Sbs\SbsClientInterface;
2123

2224
/**
2325
* Creates mocked versions of dependencies for unit testing
@@ -29,6 +31,16 @@ class EngineBlock_Application_TestDiContainer extends EngineBlock_Application_Di
2931
*/
3032
private $pdpClient;
3133

34+
/**
35+
* @var SbsClientInterface|null
36+
*/
37+
private $sbsClient;
38+
39+
/**
40+
* @var FeatureConfigurationInterface|null
41+
*/
42+
private $featureConfiguration;
43+
3244
public function getXmlConverter()
3345
{
3446
return Phake::mock('EngineBlock_Corto_XmlToArray');
@@ -49,11 +61,31 @@ public function getPdpClient()
4961
return $this->pdpClient ?? parent::getPdpClient();
5062
}
5163

52-
public function setPdpClient(PdpClientInterface $pdpClient)
64+
public function setPdpClient(?PdpClientInterface $pdpClient)
5365
{
5466
$this->pdpClient = $pdpClient;
5567
}
5668

69+
public function setSbsClient(?SbsClientInterface $sbsClient)
70+
{
71+
$this->sbsClient = $sbsClient;
72+
}
73+
74+
public function getSbsClient(): SbsClientInterface
75+
{
76+
return $this->sbsClient ?? parent::getSbsClient();
77+
}
78+
79+
public function setFeatureConfiguration(?FeatureConfigurationInterface $featureConfiguration)
80+
{
81+
$this->featureConfiguration = $featureConfiguration;
82+
}
83+
84+
public function getFeatureConfiguration(): FeatureConfigurationInterface
85+
{
86+
return $this->featureConfiguration ?? parent::getFeatureConfiguration();
87+
}
88+
5789
public function getConsentFactory()
5890
{
5991
$consentFactoryMock = Phake::mock('EngineBlock_Corto_Model_Consent_Factory');

‎library/EngineBlock/Corto/Filter/Command/SRAMTestFilter.php‎

Lines changed: 54 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
<?php
22

3+
use OpenConext\EngineBlockBundle\Configuration\FeatureConfigurationInterface;
4+
use OpenConext\EngineBlockBundle\Sbs\Dto\Request;
5+
36
/**
47
* Copyright 2021 Stichting Kennisnet
58
*
@@ -27,70 +30,70 @@ public function getResponseAttributes()
2730
return $this->_responseAttributes;
2831
}
2932

33+
public function getResponse()
34+
{
35+
return $this->_response;
36+
}
37+
3038
public function execute(): void
3139
{
32-
$application = EngineBlock_ApplicationSingleton::getInstance();
40+
if (!$this->getFeatureConfiguration()->isEnabled('eb.feature_enable_sram_interrupt')) {
41+
return;
42+
}
3343

34-
$sramEndpoint = $application->getDiContainer()->getSRAMEndpoint();
35-
$sramApiToken = $sramEndpoint->getApiToken();
36-
$sramAuthzLocation = $sramEndpoint->getAuthzLocation();
37-
// $sramAuthzLocation = 'http://192.168.0.1:12345/api';
44+
if ($this->_serviceProvider->getCoins()->collabEnabled() === false) {
45+
return;
46+
}
3847

39-
error_log("SRAMTestFilter execute");
48+
try {
49+
$request = $this->buildRequest();
50+
$interruptResponse = $this->getSbsClient()->requestInterruptDecisionFor($request);
51+
52+
if ($interruptResponse->msg === 'interrupt') {
53+
// @TODO Consider if this should be an attribute?
54+
$this->_response->setSRAMInterruptNonce($interruptResponse->nonce);
55+
} elseif (!empty($interruptResponse->attributes)) {
56+
// @TODO make sure this has test coverage
57+
$this->_responseAttributes = array_merge_recursive(
58+
$this->_responseAttributes,
59+
$interruptResponse->attributes
60+
);
61+
}
62+
}catch (Throwable $e){
63+
throw new EngineBlock_Exception_SbsCheckFailed('The SBS server could not be queried: ' . $e->getMessage());
64+
}
65+
}
4066

41-
$attributes = $this->getResponseAttributes();
67+
private function getSbsClient()
68+
{
69+
return EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getSbsClient();
70+
}
4271

72+
private function getFeatureConfiguration(): FeatureConfigurationInterface
73+
{
74+
return EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getFeatureConfiguration();
75+
}
76+
77+
/**
78+
* @return Request
79+
* @throws EngineBlock_Corto_ProxyServer_Exception
80+
*/
81+
private function buildRequest(): Request
82+
{
83+
$attributes = $this->getResponseAttributes();
4384
$id = $this->_request->getId();
4485

86+
// @TODO Check: can it occur this is not set?
4587
$user_id = $attributes['urn:mace:dir:attribute-def:uid'][0];
4688
$continue_url = $this->_server->getUrl('SRAMInterruptService', '') . "?ID=$id";
4789
$service_id = $this->_serviceProvider->entityId;
48-
// @TODO at the very start of this function, check if the SP has `coin:collab_enabled`, skip otherwise?
4990
$issuer_id = $this->_identityProvider->entityId;
5091

51-
/***
52-
* @TODO Move all curl related things to new HttpClient. See PDPClient as an example.
53-
* @TODO Make sure it has tests
54-
* @TODO add tests for this Input Filter
55-
*/
56-
57-
$headers = array(
58-
"Authorization: $sramApiToken"
92+
return Request::create(
93+
$user_id,
94+
$continue_url,
95+
$service_id,
96+
$issuer_id
5997
);
60-
61-
$post = array(
62-
'user_id' => $user_id,
63-
'continue_url' => $continue_url,
64-
'service_id' => $service_id,
65-
'issuer_id' => $issuer_id
66-
);
67-
68-
$options = [
69-
CURLOPT_HEADER => false,
70-
CURLOPT_RETURNTRANSFER => true,
71-
CURLOPT_HTTPHEADER => $headers,
72-
CURLOPT_POST => true,
73-
CURLOPT_POSTFIELDS => $post,
74-
];
75-
76-
77-
$ch = curl_init($sramAuthzLocation);
78-
curl_setopt_array($ch, $options);
79-
80-
$data = curl_exec($ch);
81-
curl_close($ch);
82-
83-
$body = json_decode($data, false);
84-
// error_log("SRAMTestFilter " . var_export($body, true));
85-
86-
// @TODO Add integration test: Assert the redirect url on the saml response is SRAM
87-
88-
$msg = $body->msg;
89-
if ($msg === 'interrupt') {
90-
$this->_response->setSRAMInterruptNonce($body->nonce);
91-
} elseif ($body->attributes) {
92-
$this->_responseAttributes = array_merge_recursive($this->_responseAttributes, (array) $body->attributes);
93-
}
94-
9598
}
9699
}

‎library/EngineBlock/Corto/Filter/Input.php‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -96,16 +96,9 @@ public function getCommands()
9696
// Apply the Attribute Release Policy before we do consent.
9797
new EngineBlock_Corto_Filter_Command_AttributeReleasePolicy(),
9898

99+
new EngineBlock_Corto_Filter_Command_SRAMTestFilter(),
99100
);
100101

101-
// SRAM Test filter
102-
// When feature_enable_sram_interrupt enabled
103-
// @TODO Should this check be here, or in the filter itself like \EngineBlock_Corto_Filter_Command_SsoNotificationCookieFilter
104-
// @TODO if it stays here, add test to make sure it's in the command[] or not
105-
if ($featureConfiguration->isEnabled('eb.feature_enable_sram_interrupt')) {
106-
$commands[] = new EngineBlock_Corto_Filter_Command_SRAMTestFilter();
107-
}
108-
109102
if (!$featureConfiguration->isEnabled('eb.run_all_manipulations_prior_to_consent')) {
110103
return $commands;
111104
}

‎library/EngineBlock/Exception/SbsCheckFailed.php‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
3+
/**
4+
* Copyright 2025 SURFnet B.V.
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
class EngineBlock_Exception_SbsCheckFailed extends EngineBlock_Exception
20+
{
21+
}

‎src/OpenConext/EngineBlock/SRAM/SRAMEndpoint.php‎

Lines changed: 0 additions & 87 deletions
This file was deleted.

‎src/OpenConext/EngineBlockBundle/Exception/InvalidSbsResponseException.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
3+
/**
4+
* Copyright 2025 SURFnet B.V.
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
namespace OpenConext\EngineBlockBundle\Exception;
20+
21+
class InvalidSbsResponseException extends RuntimeException
22+
{
23+
}

0 commit comments

Comments
 (0)