generated from jric11/baseProject
34 lines
2.8 KiB
PHP
34 lines
2.8 KiB
PHP
|
<?php
|
||
|
|
if(PHP_SAPI!=='cli')exit;
|
||
|
|
require __DIR__.'/../classes/Base.php';
|
||
|
|
class FileKeyMfa extends MfaService {
|
||
|
|
public string $environment='Development';
|
||
|
|
public string $file='';
|
||
|
|
public function getSettings(){
|
||
|
|
$settings=new SimpleXMLElement('<Settings/>');$settings->Environment=$this->environment;$settings->MfaKeyFile=$this->file;return $settings;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
$old=getenv('HCR_MFA_KEY');$oldFile=getenv('HCR_MFA_KEY_FILE');putenv('HCR_MFA_KEY');putenv('HCR_MFA_KEY_FILE');$checks=0;$file=tempnam(sys_get_temp_dir(),'hcr-mfa-key-');$inside=__DIR__.'/.local/key-path-test-'.bin2hex(random_bytes(6));
|
||
|
|
function keyCheck(bool $ok,string $message):void{global $checks;if(!$ok)throw new RuntimeException($message);$checks++;echo "PASS: $message\n";}
|
||
|
|
function keyDenied(callable $work,string $message):void{try{$work();}catch(RuntimeException $e){keyCheck(true,$message);return;}throw new LogicException($message.' was allowed');}
|
||
|
|
try{
|
||
|
|
$service=new FileKeyMfa();$service->file=$file;file_put_contents($file,base64_encode(random_bytes(32)));
|
||
|
|
keyCheck($service->sealSecret('test',1)!=='','Development loads a persistent key outside the application');
|
||
|
|
$service->file=$file.'.missing';putenv('HCR_MFA_KEY_FILE='.$file);
|
||
|
|
keyCheck($service->sealSecret('test',1)!=='','Server key-file configuration overrides workstation settings');
|
||
|
|
$service->environment='Production';keyDenied(fn()=>$service->sealSecret('test',1),'Production cannot use the development key-file fallback');
|
||
|
|
putenv('HCR_MFA_KEY_FILE');$service->file=$file;
|
||
|
|
putenv('HCR_MFA_KEY='.base64_encode(random_bytes(32)));keyCheck($service->sealSecret('test',1)!=='','Explicit production environment key remains supported');
|
||
|
|
putenv('HCR_MFA_KEY=invalid');$service->environment='Development';keyDenied(fn()=>$service->sealSecret('test',1),'Invalid explicit key is not silently replaced by a file');putenv('HCR_MFA_KEY');
|
||
|
|
if(!is_dir(dirname($inside)))mkdir(dirname($inside),0700,true);file_put_contents($inside,base64_encode(random_bytes(32)));$service->file=$inside;
|
||
|
|
keyDenied(fn()=>$service->sealSecret('test',1),'Development key inside the application tree is rejected');
|
||
|
|
$service->file=$file;file_put_contents($file,str_repeat('A',129));keyDenied(fn()=>$service->sealSecret('test',1),'Oversized key file is rejected');
|
||
|
|
file_put_contents($file,'invalid');keyDenied(fn()=>$service->sealSecret('test',1),'Malformed file key is rejected');
|
||
|
|
$service->file=$file.'.missing';keyDenied(fn()=>$service->sealSecret('test',1),'Missing development key file is rejected');
|
||
|
|
echo "$checks MFA key configuration checks passed.\n";
|
||
|
|
}finally{
|
||
|
|
if(is_file($file))unlink($file);if(is_file($inside))unlink($inside);
|
||
|
|
if($old===false)putenv('HCR_MFA_KEY');else putenv('HCR_MFA_KEY='.$old);
|
||
|
|
if($oldFile===false)putenv('HCR_MFA_KEY_FILE');else putenv('HCR_MFA_KEY_FILE='.$oldFile);
|
||
|
|
}
|