implement the other side of auth (hopefully?)

also mostly untested for the same reason as last time

7 files changed, 92 insertions, 2 deletions

diff --git a/Digitigrade/HttpResponseStatus/Forbidden.php b/Digitigrade/HttpResponseStatus/Forbidden.php
new file mode 100644
index 0000000..4c3588f
--- /dev/null
+++ b/Digitigrade/HttpResponseStatus/Forbidden.php
@@ -0,0 +1,21 @@
+<?php
+namespace Digitigrade\HttpResponseStatus;
+
+use Digitigrade\HttpResponseStatus;
+
+class Forbidden extends \Exception implements HttpResponseStatus {
+    public function __construct(?string $reason) {
+        $this->message = $reason ?? 'The provided authorization is invalid for this request';
+    }
+
+    public function httpCode(): int {
+        return 403;
+    }
+
+    public function httpReason(): string {
+        return "Forbidden";
+    }
+
+    public function httpHeaders() {
+    }
+}
\ No newline at end of file
diff --git a/Digitigrade/HttpResponseStatus/Unauthorized.php b/Digitigrade/HttpResponseStatus/Unauthorized.php
new file mode 100644
index 0000000..ab8b080
--- /dev/null
+++ b/Digitigrade/HttpResponseStatus/Unauthorized.php
@@ -0,0 +1,21 @@
+<?php
+namespace Digitigrade\HttpResponseStatus;
+
+use Digitigrade\HttpResponseStatus;
+
+class Unauthorized extends \Exception implements HttpResponseStatus {
+    public function __construct(?string $reason) {
+        $this->message = $reason ?? 'This request requires authorization';
+    }
+
+    public function httpCode(): int {
+        return 401;
+    }
+
+    public function httpReason(): string {
+        return "Unauthorized";
+    }
+
+    public function httpHeaders() {
+    }
+}
\ No newline at end of file
diff --git a/Digitigrade/Job/ExpireInboundAuthToken.php b/Digitigrade/Job/ExpireInboundAuthToken.php
new file mode 100644
index 0000000..dfb5ae6
--- /dev/null
+++ b/Digitigrade/Job/ExpireInboundAuthToken.php
@@ -0,0 +1,34 @@
+<?php
+namespace Digitigrade\Job;
+
+use Digitigrade\Job;
+use Digitigrade\JobQueue;
+use Digitigrade\Logger;
+use Digitigrade\Model\Instance;
+
+class ExpireInboundAuthToken extends Job {
+    public string $domain;
+    public string $token;
+    public \DateTimeInterface $when;
+
+    public function __construct(string $domain, string $token, \DateTimeInterface $when) {
+        $this->domain = $domain;
+        $this->token = $token;
+        $this->when = $when;
+        $this->remainingTries = 5;
+    }
+
+    public function run() {
+        Logger::getInstance()->info("expiring token for $this->domain");
+        $instance = Instance::findByDomain($this->domain);
+        if ($instance->auth->inboundToken != $this->token) {
+            Logger::getInstance()->info("actually not expiring the token because it's been refreshed");
+            return;
+        }
+        $instance->auth->inboundToken = null;
+    }
+
+    public function submit() {
+        JobQueue::getInstance()->submitDelayedUntil($this, $this->when);
+    }
+}
\ No newline at end of file
diff --git a/Digitigrade/Job/RefreshOutboundAuthToken.php b/Digitigrade/Job/RefreshOutboundAuthToken.php
index 588617f..72dd466 100644
--- a/Digitigrade/Job/RefreshOutboundAuthToken.php
+++ b/Digitigrade/Job/RefreshOutboundAuthToken.php
@@ -8,7 +8,6 @@ use Digitigrade\Model\Instance;
 
 class RefreshOutboundAuthToken extends Job {
     public string $domain;
-    public string $token;
     public \DateTimeInterface $when;
 
     public function __construct(string $domain, \DateTimeInterface $when) {
diff --git a/Digitigrade/Job/RequestOutboundAuthToken.php b/Digitigrade/Job/RequestOutboundAuthToken.php
index 69430c8..1786e32 100644
--- a/Digitigrade/Job/RequestOutboundAuthToken.php
+++ b/Digitigrade/Job/RequestOutboundAuthToken.php
@@ -17,7 +17,7 @@ class RequestOutboundAuthToken extends Job {
     }
 
     public function run() {
-        Logger::getInstance()->info("responding to $this->domain's dialback challenge");
+        Logger::getInstance()->info("requesting token from $this->domain in response to their dialback challenge");
         $instance = Instance::findByDomain($this->domain);
         $instance->requestOutboundAuthToken($this->secret);
     }
diff --git a/Digitigrade/Model/Instance.php b/Digitigrade/Model/Instance.php
index 5f33e6d..e4b1ef1 100644
--- a/Digitigrade/Model/Instance.php
+++ b/Digitigrade/Model/Instance.php
@@ -58,6 +58,20 @@ class Instance extends FetchableModel {
         return self::fetchFromRemote($uri, $autoSave);
     }
 
+    public static function findByInboundAuthToken(string $token): ?self {
+        $authRecord = InstanceAuth::findWhere('inbound_token = ?', [$token]);
+        if ($authRecord == null)
+            return null;
+        return self::find($authRecord->instanceId);
+    }
+
+    public static function findByDialbackSecret(string $secret): ?self {
+        $authRecord = InstanceAuth::findWhere('secret = ?', [$secret]);
+        if ($authRecord == null)
+            return null;
+        return self::find($authRecord->instanceId);
+    }
+
     public function beginOutboundAuth() {
         $authEndpoint = $this->endpoints->auth;
         if (!isset($authEndpoint)) {
diff --git a/Digitigrade/Model/InstanceAuth.php b/Digitigrade/Model/InstanceAuth.php
index 616d4c5..6f58298 100644
--- a/Digitigrade/Model/InstanceAuth.php
+++ b/Digitigrade/Model/InstanceAuth.php
@@ -7,6 +7,7 @@ class InstanceAuth extends Model {
     public ?int $instanceId;
     public ?string $outboundToken;
     public ?string $inboundToken;
+    public ?string $secret;
 
     protected function setOwnerId(int $id) {
         $this->instanceId = $id;