IBX-8804: Moved PASSWORD_HASH_OAUTH2 from ibexa/oauth2-client

Author: konradoboza

src/contracts/Repository/Values/User/User.php

@@ -8,6 +8,7 @@
 
 namespace Ibexa\Contracts\Core\Repository\Values\User;
 
+use DateTimeInterface;
 use Ibexa\Contracts\Core\Repository\Values\Content\Content;
 
 /**
@@ -24,63 +25,36 @@ abstract class User extends Content implements UserReference
     /**
      * @var int[] List of supported (by default) hash types.
      */
-    public const SUPPORTED_PASSWORD_HASHES = [
+    public const array SUPPORTED_PASSWORD_HASHES = [
         self::PASSWORD_HASH_BCRYPT,
         self::PASSWORD_HASH_PHP_DEFAULT,
+        self::PASSWORD_HASH_OAUTH2,
     ];
 
-    /** @var int Passwords in bcrypt */
-    public const PASSWORD_HASH_BCRYPT = 6;
+    public const int PASSWORD_HASH_BCRYPT = 6;
 
-    /** @var int Passwords hashed by PHPs default algorithm, which may change over time */
-    public const PASSWORD_HASH_PHP_DEFAULT = 7;
+    public const int PASSWORD_HASH_PHP_DEFAULT = 7;
 
-    /** @var int Default password hash, used when none is specified, may change over time */
-    public const DEFAULT_PASSWORD_HASH = self::PASSWORD_HASH_PHP_DEFAULT;
+    public const int PASSWORD_HASH_OAUTH2 = 256;
 
-    /**
-     * User login.
-     *
-     * @var string
-     */
-    protected $login;
+    public const int DEFAULT_PASSWORD_HASH = self::PASSWORD_HASH_PHP_DEFAULT;
 
-    /**
-     * User E-Mail address.
-     *
-     * @var string
-     */
-    protected $email;
+    protected string $login;
 
-    /**
-     * User password hash.
-     *
-     * @var string
-     */
-    protected $passwordHash;
+    protected string $email;
 
-    /**
-     * Datetime of last password update.
-     *
-     * @var \DateTimeInterface|null
-     */
-    protected $passwordUpdatedAt;
+    protected string $passwordHash;
 
-    /**
-     * Hash algorithm used to hash the password.
-     *
-     * @var int
-     */
-    protected $hashAlgorithm;
+    protected ?DateTimeInterface $passwordUpdatedAt;
+
+    protected int $hashAlgorithm;
 
     /**
      * Flag to signal if user is enabled or not.
      *
-     * User can not login if false
-     *
-     * @var bool
+     * User cannot login if false
      */
-    protected $enabled = false;
+    protected bool $enabled = false;
 
     /**
      * Max number of time user is allowed to login.
@@ -90,7 +64,7 @@ abstract class User extends Content implements UserReference
      *
      * @var int
      */
-    protected $maxLogin;
+    protected int $maxLogin;
 
     public function getUserId(): int
     {

src/lib/Repository/User/Exception/UnsupportedPasswordHashType.php

@@ -10,7 +10,7 @@
 
 use Ibexa\Core\Base\Exceptions\InvalidArgumentException;
 
-class UnsupportedPasswordHashType extends InvalidArgumentException
+final class UnsupportedPasswordHashType extends InvalidArgumentException
 {
     public function __construct(int $hashType)
     {

src/lib/Repository/User/PasswordHashService.php

@@ -8,16 +8,16 @@
 
 namespace Ibexa\Core\Repository\User;
 
+use Ibexa\Contracts\Core\Repository\PasswordHashService as APIPasswordHashService;
 use Ibexa\Contracts\Core\Repository\Values\User\User;
 use Ibexa\Core\Repository\User\Exception\UnsupportedPasswordHashType;
 
 /**
  * @internal
  */
-final class PasswordHashService implements PasswordHashServiceInterface
+final class PasswordHashService implements APIPasswordHashService
 {
-    /** @var int */
-    private $defaultHashType;
+    private int $defaultHashType;
 
     public function __construct(int $hashType = User::DEFAULT_PASSWORD_HASH)
     {
@@ -56,6 +56,9 @@ public function createPasswordHash(
             case User::PASSWORD_HASH_PHP_DEFAULT:
                 return password_hash($password, PASSWORD_DEFAULT);
 
+            case User::PASSWORD_HASH_OAUTH2:
+                return '';
+
             default:
                 throw new UnsupportedPasswordHashType($hashType);
         }
@@ -68,7 +71,11 @@ public function isValidPassword(
         string $passwordHash,
         ?int $hashType = null
     ): bool {
-        if ($hashType === User::PASSWORD_HASH_BCRYPT || $hashType === User::PASSWORD_HASH_PHP_DEFAULT) {
+        if (
+            $hashType === User::PASSWORD_HASH_BCRYPT
+            || $hashType === User::PASSWORD_HASH_PHP_DEFAULT
+            || $hashType === User::PASSWORD_HASH_OAUTH2
+        ) {
             // In case of bcrypt let PHP's password functionality do its magic
             return password_verify($plainPassword, $passwordHash);
         }

src/lib/Repository/User/PasswordHashServiceInterface.php

@@ -15,10 +15,9 @@
 
 final class PasswordHashServiceTest extends TestCase
 {
-    private const NON_EXISTING_PASSWORD_HASH = PHP_INT_MAX;
+    private const int NON_EXISTING_PASSWORD_HASH = PHP_INT_MAX;
 
-    /** @var \Ibexa\Core\Repository\User\PasswordHashService */
-    private $passwordHashService;
+    private PasswordHashService $passwordHashService;
 
     protected function setUp(): void
     {
@@ -31,6 +30,7 @@ public function testGetSupportedHashTypes(): void
             [
                 User::PASSWORD_HASH_BCRYPT,
                 User::PASSWORD_HASH_PHP_DEFAULT,
+                User::PASSWORD_HASH_OAUTH2,
             ],
             $this->passwordHashService->getSupportedHashTypes()
         );