autenticazione/App/Models/Cns.php

<?php

namespace MwgAuth\Models;

use MwgAuth\Core\Model;

class Cns extends Model
{
    private static $policyValide = [
        '1.3.76.16.2.1',            // CNS
        '1.3.76.47.4',              // CIE
        '1.3.6.1.4.1.29741.1.1.10', // CNS-Like
        '1.3.159.1.10.1',           // Actalis
        '1.3.76.36.1.1.3',          // CNS-Like Infocert
    ];
    private $certificato;
    private $codiceFiscale;

    public function __construct(string $certificato)
    {
        if (null !== $certificato) {
            $this->certificato = openssl_x509_parse($certificato, false);
            $this->verificaCertificato();
            // https://www.agid.gov.it/sites/default/files/repository_files/documentazione_trasparenza/strutturacertificatoautenticazionecns_v1.1_.pdf
            if (isset($this->certificato['subject']['serialNumber'])) {
                $this->codiceFiscale = preg_replace('/^[A-Za-z]{2}:/', '', $this->certificato['subject']['serialNumber']);
            } else {
                $this->codiceFiscale = explode('/', $this->certificato['subject']['commonName'])[0];
            }
        }
    }

    public function getCertificato(): array
    {
        return $this->certificato;
    }

    public function getCodiceFiscale(): ?string
    {
        return $this->codiceFiscale;
    }

    public function getCognome(): ?string
    {
        if (isset($this->certificato['subject']['surname'])) {
            $ret = $this->certificato['subject']['surname'];
        } elseif (isset($this->certificato['subject']['organizationalUnitName'])) {
            $ret = $this->certificato['subject']['organizationalUnitName'];
            if (is_array($ret)) {
                $ret = implode('/', $ret);
            }
        } else {
            $ret = $this->codiceFiscale;
        }
        return $ret;
    }

    public function getNome(): ?string
    {
        return $this->certificato['subject']['givenName'] ?? $this->codiceFiscale;
    }

    public function verificaPolicyCertificato(): bool
    {
        preg_match_all(
            '/Policy: ([0-9\.]+)/',
            $this->certificato['extensions']['certificatePolicies'],
            $policies
        );
        foreach ($policies[1] as $policy) {
            if (in_array($policy, self::$policyValide)) {
                return true;
            }
        }
        $this->salvaCertificato();
        return false;
    }

    private function verificaCertificato()
    {
        // if (!isset($this->certificato['subject']['commonName']) ||
        //     !isset($this->certificato['subject']['surname']) ||
        //     !isset($this->certificato['subject']['givenName']) ||
        //     isset($this->certificato['subject']['serialNumber']) ||
        //     !isset($this->certificato['extensions']['certificatePolicies'])) {
        $this->salvaCertificato();
        // }
    }

    private function salvaCertificato()
    {
        $file = '/var/www/html/cns/policy/cert-' . sha1($this->certificato['subject']['commonName']);
        @file_put_contents($file . '.txt', print_r($this->certificato, true));
        @file_put_contents($file . '.cer', $_SERVER['SSL_CLIENT_CERT']);
    }
}