Claim email da Spie e CNS disattivabile per utente

App/Config/site.php.example

@@ -2,4 +2,5 @@
 
 return [
     'key' => 'CHANGE_ME',
+    'url' => 'https://autenticazione.lavoripubblici.sicilia.it/',
 ];

App/Core/Controller.php

@@ -4,7 +4,6 @@ namespace MwgAuth\Core;
 
 class Controller
 {
-
     private static $charset = 'UTF-8';
     private static $contentType = 'application/json';
     private static $responseCode = 200;

App/Core/Model.php

@@ -78,7 +78,11 @@ class Model
         foreach ($conditions as $field => $value) {
             $where[] = "(`$field`=:$field)";
         }
-        return "SELECT `" . implode('`,`', $fields) . "` FROM `$table` WHERE " . implode(' AND ', $where);
+        $sql = "SELECT `" . implode('`,`', $fields) . "` FROM `$table`";
+        if (count($where)) {
+            $sql .= ' WHERE ' . implode(' AND ', $where);
+        }
+        return $sql;
     }
 
     protected static function insert(string $table, array $fields): bool

App/Models/Cns.php

@@ -23,7 +23,11 @@ class Cns extends Model
             $this->verificaCertificato();
             // https://www.agid.gov.it/sites/default/files/repository_files/documentazione_trasparenza/strutturacertificatoautenticazionecns_v1.1_.pdf
             if (isset($this->certificato['subject']['serialNumber'])) {
-                $this->codiceFiscale = preg_replace('/^[A-Za-z]{2}:/', '', $this->certificato['subject']['serialNumber']);
+                $this->codiceFiscale = preg_replace(
+                    '/^[A-Za-z]{2}:/',
+                    '',
+                    $this->certificato['subject']['serialNumber']
+                );
             } else {
                 $this->codiceFiscale = explode('/', $this->certificato['subject']['commonName'])[0];
             }
@@ -78,13 +82,15 @@ class Cns extends Model
 
     private function verificaCertificato()
     {
-        // if (!isset($this->certificato['subject']['commonName']) ||
+        if (
-        //     !isset($this->certificato['subject']['surname']) ||
+            !isset($this->certificato['subject']['commonName'])
-        //     !isset($this->certificato['subject']['givenName']) ||
+            || !isset($this->certificato['subject']['surname'])
-        //     isset($this->certificato['subject']['serialNumber']) ||
+            || !isset($this->certificato['subject']['givenName'])
-        //     !isset($this->certificato['extensions']['certificatePolicies'])) {
+            || isset($this->certificato['subject']['serialNumber'])
+            || !isset($this->certificato['extensions']['certificatePolicies'])
+        ) {
             $this->salvaCertificato();
-        // }
+        }
     }
 
     private function salvaCertificato()

App/Models/Token.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace MwgAuth\Models;
+
+use MwgAuth\Core\Model;
+
+class Token extends Model
+{
+    public static function useCns(string $token): bool
+    {
+        $token = self::selectOne('tokens', ['auth'], ['token' => $token]);
+        if (null === $token) {
+            return true;
+        }
+        $user_id = self::selectOne('sessions', ['user_id'], ['auth' => $token['auth']]);
+        if (null === $user_id) {
+            return true;
+        }
+        $useCns = self::selectOne('users', ['use_cns'], ['id' => $user_id['user_id']]);
+        return $useCns['use_cns'] == 1;
+    }
+}

App/Models/User.php

@@ -62,7 +62,7 @@ class User extends Model
 
     public function getLoginData(string $token): ?array
     {
-        $ret = $this->select('logins', ['codice_fiscale', 'nome', 'cognome'], ['token' => $token]);
+        $ret = $this->select('logins', ['codice_fiscale', 'nome', 'cognome', 'email'], ['token' => $token]);
         return empty($ret) ? null : $ret[0];
     }
 
@@ -90,13 +90,19 @@ class User extends Model
         return $this->userName;
     }
 
-    public static function setLoginData(string $token, string $codiceFiscale, string $nome, string $cognome): bool
+    public static function setLoginData(
-    {
+        string $token,
+        string $codiceFiscale,
+        string $nome,
+        string $cognome,
+        ?string $email = null
+    ): bool {
         return self::insert('logins', [
             'token' => $token,
             'codice_fiscale' => $codiceFiscale,
             'nome' => $nome,
             'cognome' => $cognome,
+            'email' => $email,
         ]);
     }
 
@@ -121,7 +127,7 @@ class User extends Model
         return Config::getValue('site', 'key');
     }
 
-    private static function hashPassword(string $password): string
+    protected static function hashPassword(string $password): string
     {
         $siteKey = self::getSiteKey();
         return hash('sha256', $siteKey . $password);

App/Models/UserTool.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace MwgAuth\Models;
+
+use MwgAuth\Core\Model;
+
+class UserTool extends User
+{
+    public static function add(string $username, string $password, string $remote, bool $useCns): bool
+    {
+        return self::insert('users', [
+            'username' => $username,
+            'password' => self::hashPassword($password),
+            'remote' => $remote,
+            'use_cns' => $useCns,
+        ]);
+    }
+
+    public static function list(): array
+    {
+        return self::select('users', ['id', 'username', 'remote', 'use_cns'], []);
+    }
+
+    public static function token(string $username): ?string
+    {
+        $rows = self::select('users', ['id'], ['username' => $username]);
+        if (empty($rows)) {
+            return null;
+        }
+        $user = new User($rows[0]['id'], $username);
+        return $user->getToken('http://localhost/callback');
+    }
+}

App/bootstrap.php

@@ -2,5 +2,5 @@
 
 namespace MwgAuth\Core;
 
-require_once(__DIR__.'/Core/AutoLoader.php');
+require_once(__DIR__ . '/Core/AutoLoader.php');
 AutoLoader::register();

html/index.php

@@ -1,4 +1,12 @@
-<!doctype html>
+<?php
+
+use MwgAuth\Models\Token;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+$useCns = Token::useCns($_GET['t'] ?? '');
+
+?><!doctype html>
 <html lang="it">
 <head>
     <meta charset="utf-8">
@@ -16,6 +24,7 @@
             </div>
         </div>
         <div class="row">
+            <?php if ($useCns) : ?>
                 <div class="col-md-6 col-xs-12">
                     <h2>Accedi con CNS</h2>
                     <hr class="solid">
@@ -33,6 +42,7 @@
                         </button>
                     </form>
                 </div>
+            <?php endif ?>
             <div class="col-md-6 col-xs-12">
                 <h2>Accedi con SPID o CieID</h2>
                 <hr class="solid">

html/spid/index.php

@@ -8,11 +8,13 @@ $token = $_GET['t'] ?? null;
 if ('' === ($token ?? '')) {
     include($_SERVER['DOCUMENT_ROOT'] . '/errors/generic.php');
 } else {
+    @file_put_contents("/var/www/html/cns/policy/claims-$token.txt", print_r($_SERVER, true));
     User::setLoginData(
         $token,
         $_SERVER['SPID_claim_fiscalNumber'],
         $_SERVER['SPID_claim_given_name'],
-        $_SERVER['SPID_claim_family_name']
+        $_SERVER['SPID_claim_family_name'],
+        $_SERVER['SPID_claim_email'],
     );
     $callback = User::getCallback($token);
     if (null === $callback) {

setup/file/autenticazione.sql

@@ -15,6 +15,7 @@ CREATE TABLE `logins` (
   `codice_fiscale` varchar(255) DEFAULT NULL,
   `nome` varchar(255) DEFAULT NULL,
   `cognome` varchar(255) DEFAULT NULL,
+  `email` varchar(255) NULL DEFAULT NULL,
   `created_at` timestamp NULL DEFAULT NULL,
   `modified_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`token`)
@@ -46,17 +47,14 @@ CREATE TABLE `users` (
   `username` varchar(255) NOT NULL,
   `password` char(64) NOT NULL,
   `remote` varchar(45) DEFAULT NULL,
+  `use_cns` BOOLEAN NOT NULL DEFAULT TRUE,
   `created_at` timestamp NULL DEFAULT NULL,
-  `updated_at` timestamp NULL DEFAULT NULL,
+  `modified_at` timestamp NULL DEFAULT NULL,
   `deleted_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `users_username_remote_unique` (`username`,`remote`)
 ) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;
 
-INSERT INTO `users`(`id`,`username`,`password`,`remote`,`created_at`,`updated_at`,`deleted_at`) VALUES
-(1,'sismica','268633d46fdf00502dba60facce2ba5eec6a5d86c843c19f3f3b1ef8c0342ada','192.168.15.*',CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL),
-(2,'sismica','268633d46fdf00502dba60facce2ba5eec6a5d86c843c19f3f3b1ef8c0342ada','79.8.172.13',CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL);
-
 /*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
 /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
 /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;

setup/file/update_001.sql

@@ -0,0 +1,2 @@
+ALTER TANLE `logins` ADD COLUMN `email` VARCHAR(255) NULL DEFAULT NULL AFTER `cognome`;
+ALTER TANLE `users` ADD COLUMN `use_cns` BOOLEAN NOT NULL DEFAULT TRUE AFTER `remote`;

tools/get_token

@@ -0,0 +1,14 @@
+#!/usr/bin/env php
+<?php
+
+use MwgAuth\Core\Config;
+use MwgAuth\Models\UserTool;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+if ($argc < 2) {
+    echo "Usage: $argv[0] <username>\n";
+    exit(1);
+}
+$token = UserTool::token($argv[1]);
+echo Config::getValue('site', 'url') . "?t=$token\n";

tools/user_add

@@ -0,0 +1,27 @@
+#!/usr/bin/env php
+<?php
+
+namespace Tools;
+
+use MwgAuth\Models\UserTool;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+$username = readline("Nome utente: ");
+$password = readline("Password: ");
+$remote = readline("Indirizzo remoto (default: *): ");
+if (empty($remote)) {
+    $remote = '*';
+}
+$cns = readline("Usa CNS? (Y/n): ");
+if (empty($cns)) {
+    $cns = 'y';
+}
+$cns = strtolower($cns) === 'y';
+echo "Aggiungo utente...\n";
+$result = UserTool::add($username, $password, $remote, $cns);
+if ($result) {
+    echo "Utente aggiunto con successo.\n";
+} else {
+    echo "Errore durante l'aggiunta dell'utente.\n";
+}

tools/user_list

@@ -0,0 +1,11 @@
+#!/usr/bin/env php
+<?php
+
+use MwgAuth\Models\UserTool;
+
+require_once(dirname(__DIR__) . '/App/bootstrap.php');
+
+$users = UserTool::list();
+foreach ($users as $user) {
+    echo "ID: {$user['id']}, Username: {$user['username']}, Remote: {$user['remote']}, Use CNS: {$user['use_cns']}\n";
+}