<?php

/**

 * Zend Framework

 *

 * LICENSE

 *

 * This source file is subject to the new BSD license that is bundled

 * with this package in the file LICENSE.txt.

 * It is also available through the world-wide-web at this URL:

 * http://framework.zend.com/license/new-bsd

 * If you did not receive a copy of the license and are unable to

 * obtain it through the world-wide-web, please send an email

 * to license@zend.com so we can send you a copy immediately.

 *

 * @category   Zend

 * @package    Zend_OpenId

 * @subpackage Zend_OpenId_Consumer

 * @copyright  Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)

 * @license    http://framework.zend.com/license/new-bsd     New BSD License

 * @version    $Id: Consumer.php 20096 2010-01-06 02:05:09Z bkarwin $

 */

/**

 * @see Zend_OpenId

 */

require_once "Zend/OpenId.php";

/**

 * @see Zend_OpenId_Extension

 */

require_once "Zend/OpenId/Extension.php";

/**

 * @see Zend_OpenId_Consumer_Storage

 */

require_once "Zend/OpenId/Consumer/Storage.php";

/**

 * @see Zend_Http_Client

 */

require_once 'Zend/Http/Client.php';

/**

 * OpenID consumer implementation

 *

 * @category   Zend

 * @package    Zend_OpenId

 * @subpackage Zend_OpenId_Consumer

 * @copyright  Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)

 * @license    http://framework.zend.com/license/new-bsd     New BSD License

 */

class Zend_OpenId_Consumer

{

    /**

     * Reference to an implementation of storage object

     *

     * @var Zend_OpenId_Consumer_Storage $_storage

     */

    protected $_storage = null;

    /**

     * Enables or disables consumer to use association with server based on

     * Diffie-Hellman key agreement

     *

     * @var Zend_OpenId_Consumer_Storage $_dumbMode

     */

    protected $_dumbMode = false;

    /**

     * Internal cache to prevent unnecessary access to storage

     *

     * @var array $_cache

     */

    protected $_cache = array();

    /**

     * HTTP client to make HTTP requests

     *

     * @var Zend_Http_Client $_httpClient

     */

    private $_httpClient = null;

    /**

     * HTTP session to store climed_id between requests

     *

     * @var Zend_Session_Namespace $_session

     */

    private $_session = null;

    /**

     * Last error message for logi, check or verify failure

     *

     * @var string $_error

     */

    private $_error = '';

    /**

     * Constructs a Zend_OpenId_Consumer object with given $storage.

     * Enables or disables future association with server based on

     * Diffie-Hellman key agreement.

     *

     * @param Zend_OpenId_Consumer_Storage $storage implementation of custom

     *  storage object

     * @param bool $dumbMode Enables or disables consumer to use association

     *  with server based on Diffie-Hellman key agreement

     */

    public function __construct(Zend_OpenId_Consumer_Storage $storage = null,

                                $dumbMode = false)

    {

        if ($storage === null) {

            require_once "Zend/OpenId/Consumer/Storage/File.php";

            $this->_storage = new Zend_OpenId_Consumer_Storage_File();

        } else {

            $this->_storage = $storage;

        }

        $this->_dumbMode = $dumbMode;

    }

    /**

     * Performs check (with possible user interaction) of OpenID identity.

     *

     * This is the first step of OpenID authentication process.

     * On success the function does not return (it does HTTP redirection to

     * server and exits). On failure it returns false.

     *

     * @param string $id OpenID identity

     * @param string $returnTo URL to redirect response from server to

     * @param string $root HTTP URL to identify consumer on server

     * @param mixed $extensions extension object or array of extensions objects

     * @param Zend_Controller_Response_Abstract $response an optional response

     *  object to perform HTTP or HTML form redirection

     * @return bool

     */

    public function login($id, $returnTo = null, $root = null, $extensions = null,

                          Zend_Controller_Response_Abstract $response = null)

    {

        return $this->_checkId(

            false,

            $id,

            $returnTo,

            $root,

            $extensions,

            $response);

    }

    /**

     * Performs immediate check (without user interaction) of OpenID identity.

     *

     * This is the first step of OpenID authentication process.

     * On success the function does not return (it does HTTP redirection to

     * server and exits). On failure it returns false.

     *

     * @param string $id OpenID identity

     * @param string $returnTo HTTP URL to redirect response from server to

     * @param string $root HTTP URL to identify consumer on server

     * @param mixed $extensions extension object or array of extensions objects

     * @param Zend_Controller_Response_Abstract $response an optional response

     *  object to perform HTTP or HTML form redirection

     * @return bool

     */

    public function check($id, $returnTo=null, $root=null, $extensions = null,

                          Zend_Controller_Response_Abstract $response = null)

    {

        return $this->_checkId(

            true,

            $id,

            $returnTo,

            $root,

            $extensions,

            $response);

    }

    /**

     * Verifies authentication response from OpenID server.

     *

     * This is the second step of OpenID authentication process.

     * The function returns true on successful authentication and false on

     * failure.

     *

     * @param array $params HTTP query data from OpenID server

     * @param string &$identity this argument is set to end-user's claimed

     *  identifier or OpenID provider local identifier.

     * @param mixed $extensions extension object or array of extensions objects

     * @return bool

     */

    public function verify($params, &$identity = "", $extensions = null)

    {

        $this->_setError('');

        $version = 1.1;

        if (isset($params['openid_ns']) &&

            $params['openid_ns'] == Zend_OpenId::NS_2_0) {

            $version = 2.0;

        }

        if (isset($params["openid_claimed_id"])) {

            $identity = $params["openid_claimed_id"];

        } else if (isset($params["openid_identity"])){

            $identity = $params["openid_identity"];

        } else {

            $identity = "";

        }

        if ($version < 2.0 && !isset($params["openid_claimed_id"])) {

            if ($this->_session !== null) {

                if ($this->_session->identity === $identity) {

                    $identity = $this->_session->claimed_id;

                }

            } else if (defined('SID')) {

                if (isset($_SESSION["zend_openid"]["identity"]) &&

                    isset($_SESSION["zend_openid"]["claimed_id"]) &&

                    $_SESSION["zend_openid"]["identity"] === $identity) {

                    $identity = $_SESSION["zend_openid"]["claimed_id"];

                }

            } else {

                require_once "Zend/Session/Namespace.php";

                $this->_session = new Zend_Session_Namespace("zend_openid");

                if ($this->_session->identity === $identity) {

                    $identity = $this->_session->claimed_id;

                }

            }

        }

        if (empty($params['openid_mode'])) {

            $this->_setError("Missing openid.mode");

            return false;

        }

        if (empty($params['openid_return_to'])) {

            $this->_setError("Missing openid.return_to");

            return false;

        }

        if (empty($params['openid_signed'])) {

            $this->_setError("Missing openid.signed");

            return false;

        }

        if (empty($params['openid_sig'])) {

            $this->_setError("Missing openid.sig");

            return false;

        }

        if ($params['openid_mode'] != 'id_res') {

            $this->_setError("Wrong openid.mode '".$params['openid_mode']."' != 'id_res'");

            return false;

        }

        if (empty($params['openid_assoc_handle'])) {

            $this->_setError("Missing openid.assoc_handle");

            return false;

        }

        if ($params['openid_return_to'] != Zend_OpenId::selfUrl()) {

            /* Ignore query part in openid.return_to */

            $pos = strpos($params['openid_return_to'], '?');

            if ($pos === false ||

                SUBSTR($params['openid_return_to'], 0 , $pos) != Zend_OpenId::selfUrl()) {

                $this->_setError("Wrong openid.return_to '".

                    $params['openid_return_to']."' != '" . Zend_OpenId::selfUrl() ."'");

                return false;

            }

        }

        if ($version >= 2.0) {

            if (empty($params['openid_response_nonce'])) {

                $this->_setError("Missing openid.response_nonce");

                return false;

            }

            if (empty($params['openid_op_endpoint'])) {

                $this->_setError("Missing openid.op_endpoint");

                return false;

            /* OpenID 2.0 (11.3) Checking the Nonce */

            } else if (!$this->_storage->isUniqueNonce($params['openid_op_endpoint'], $params['openid_response_nonce'])) {

                $this->_setError("Duplicate openid.response_nonce");

                return false;

            }

        }

        if (!empty($params['openid_invalidate_handle'])) {

            if ($this->_storage->getAssociationByHandle(

                $params['openid_invalidate_handle'],

                $url,

                $macFunc,

                $secret,

                $expires)) {

                $this->_storage->delAssociation($url);

            }

        }

        if ($this->_storage->getAssociationByHandle(

                $params['openid_assoc_handle'],

                $url,

                $macFunc,

                $secret,

                $expires)) {

            $signed = explode(',', $params['openid_signed']);

            $data = '';

            foreach ($signed as $key) {

                $data .= $key . ':' . $params['openid_' . strtr($key,'.','_')] . "\n";

            }

            if (base64_decode($params['openid_sig']) ==

                Zend_OpenId::hashHmac($macFunc, $data, $secret)) {

                if (!Zend_OpenId_Extension::forAll($extensions, 'parseResponse', $params)) {

                    $this->_setError("Extension::parseResponse failure");

                    return false;

                }

                /* OpenID 2.0 (11.2) Verifying Discovered Information */

                if (isset($params['openid_claimed_id'])) {

                    $id = $params['openid_claimed_id'];

                    if (!Zend_OpenId::normalize($id)) {

                        $this->_setError("Normalization failed");

                        return false;

                    } else if (!$this->_discovery($id, $discovered_server, $discovered_version)) {

                        $this->_setError("Discovery failed: " . $this->getError());

                        return false;

                    } else if ((!empty($params['openid_identity']) &&

                                $params["openid_identity"] != $id) ||

                               (!empty($params['openid_op_endpoint']) &&

                                $params['openid_op_endpoint'] != $discovered_server) ||

                               $discovered_version != $version) {

                        $this->_setError("Discovery information verification failed");

                        return false;

                    }

                }

                return true;

            }

            $this->_storage->delAssociation($url);

            $this->_setError("Signature check failed");

            return false;

        }

        else

        {

            /* Use dumb mode */

            if (isset($params['openid_claimed_id'])) {

                $id = $params['openid_claimed_id'];

            } else if (isset($params['openid_identity'])) {

                $id = $params['openid_identity'];

            } else {

                $this->_setError("Missing openid.claimed_id and openid.identity");

                return false;

            }

            if (!Zend_OpenId::normalize($id)) {

                $this->_setError("Normalization failed");

                return false;

            } else if (!$this->_discovery($id, $server, $discovered_version)) {

                $this->_setError("Discovery failed: " . $this->getError());

                return false;

            }

            /* OpenID 2.0 (11.2) Verifying Discovered Information */

            if ((isset($params['openid_identity']) &&

                 $params["openid_identity"] != $id) ||

                (isset($params['openid_op_endpoint']) &&

                 $params['openid_op_endpoint'] != $server) ||

                $discovered_version != $version) {

                $this->_setError("Discovery information verification failed");

                return false;

            }

            $params2 = array();

            foreach ($params as $key => $val) {

                if (strpos($key, 'openid_ns_') === 0) {

                    $key = 'openid.ns.' . substr($key, strlen('openid_ns_'));

                } else if (strpos($key, 'openid_sreg_') === 0) {

                    $key = 'openid.sreg.' . substr($key, strlen('openid_sreg_'));

                } else if (strpos($key, 'openid_') === 0) {

                    $key = 'openid.' . substr($key, strlen('openid_'));

                }

                $params2[$key] = $val;

            }

            $params2['openid.mode'] = 'check_authentication';

            $ret = $this->_httpRequest($server, 'POST', $params2, $status);

            if ($status != 200) {

                $this->_setError("'Dumb' signature verification HTTP request failed");

                return false;

            }

            $r = array();

            if (is_string($ret)) {

                foreach(explode("\n", $ret) as $line) {

                    $line = trim($line);

                    if (!empty($line)) {

                        $x = explode(':', $line, 2);

                        if (is_array($x) && count($x) == 2) {

                            list($key, $value) = $x;

                            $r[trim($key)] = trim($value);

                        }

                    }

                }

            }

            $ret = $r;

            if (!empty($ret['invalidate_handle'])) {

                if ($this->_storage->getAssociationByHandle(

                    $ret['invalidate_handle'],

                    $url,

                    $macFunc,

                    $secret,

                    $expires)) {

                    $this->_storage->delAssociation($url);

                }

            }

            if (isset($ret['is_valid']) && $ret['is_valid'] == 'true') {

                if (!Zend_OpenId_Extension::forAll($extensions, 'parseResponse', $params)) {

                    $this->_setError("Extension::parseResponse failure");

                    return false;

                }

                return true;

            }

            $this->_setError("'Dumb' signature verification failed");

            return false;

        }

    }

    /**

     * Store assiciation in internal chace and external storage

     *

     * @param string $url OpenID server url

     * @param string $handle association handle

     * @param string $macFunc HMAC function (sha1 or sha256)

     * @param string $secret shared secret

     * @param integer $expires expiration UNIX time

     * @return void

     */

    protected function _addAssociation($url, $handle, $macFunc, $secret, $expires)