maj: sémantique, révision vérification ppassword

src/Security/Hasher/PasswordEncoder.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Security\Hasher;
+
+use App\SQLLogin\Exception\InvalidSQLPasswordException;
+use Symfony\Component\PasswordHasher\Exception\InvalidPasswordException;
+use Symfony\Component\PasswordHasher\Hasher\CheckPasswordLengthTrait;
+use Symfony\Component\PasswordHasher\LegacyPasswordHasherInterface;
+
+class PasswordEncoder implements LegacyPasswordHasherInterface
+{
+    use CheckPasswordLengthTrait;
+    protected ?string $pepper;
+    protected string $hashAlgo;
+
+    public function __construct(?string $pepper, string $hashAlgo)
+    {
+        $this->pepper = $pepper;
+        $this->hashAlgo = $hashAlgo;
+    }
+
+    public function hash(string $plainPassword, string $salt = null): string
+    {
+        if ($this->isPasswordTooLong($plainPassword)) {
+            throw new InvalidPasswordException();
+        }
+        $hash = hash($this->hashAlgo, $plainPassword.$salt.$this->pepper);
+
+        return $hash;
+    }
+
+    public function verify(string $hashedPassword, string $plainPassword, string $salt = null): bool
+    {
+        if ('' === $plainPassword || $this->isPasswordTooLong($plainPassword)) {
+            return false;
+        }
+
+        if ($this->hash($plainPassword, $salt) === $hashedPassword) {
+            return true;
+        } else {
+            throw new InvalidSQLPasswordException();
+        }
+    }
+
+    public function needsRehash(string $hashedPassword): bool
+    {
+        return false;
+    }
+}

src/Security/SQLLoginUserAuthenticator.php

@@ -3,8 +3,9 @@
 namespace App\Security;
 
 use App\Entity\User;
-use App\Pdo\Exception\InvalidPasswordException;
-use App\Services\PdoService;
+use App\Security\Hasher\PasswordEncoder;
+use App\Service\SQLLoginService;
+use App\SQLLogin\Exception\InvalidSQLPasswordException;
 use PDOException;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
@@ -19,7 +20,7 @@ use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
 use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
 use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
 
-class PdoUserAuthenticator extends AbstractAuthenticator
+class SQLLoginUserAuthenticator extends AbstractAuthenticator
 {
     public const LOGIN_ROUTE = 'app_login';
     public const ERROR_LOGIN = 'error_login';
@@ -27,14 +28,16 @@ class PdoUserAuthenticator extends AbstractAuthenticator
     public const ERROR_PDO = 'error_pdo';
 
     protected string $baseUrl;
-    private PdoService $pdoService;
+    private SQLLoginService $pdoService;
     private UrlGeneratorInterface $router;
+    private PasswordEncoder $passwordHasher;
 
-    public function __construct(string $baseUrl, PdoService $pdoService, UrlGeneratorInterface $router)
+    public function __construct(string $baseUrl, SQLLoginService $pdoService, UrlGeneratorInterface $router, PasswordEncoder $passwordHasher)
     {
         $this->baseUrl = $baseUrl;
         $this->pdoService = $pdoService;
         $this->router = $router;
+        $this->passwordHasher = $passwordHasher;
     }
 
     /**
@@ -65,20 +68,22 @@ class PdoUserAuthenticator extends AbstractAuthenticator
     {
         $form = $request->request->get('login');
         $login = $form['login'];
-        $password = $form['password'];
+        $plaintextPassword = $form['password'];
         $rememberMe = isset($form['_remember_me']) ? true : false;
         try {
             // requête préparée
-            $remoteHashedPassword = $this->pdoService->fetchPassword($login);
+            list($remoteHashedPassword, $remoteSalt) = $this->pdoService->fetchPassword($login);
         } catch (PDOException $e) {
             $request->getSession()->set(self::ERROR_PDO, true);
             throw new AuthenticationException();
         }
         if ($remoteHashedPassword) {
             try {
-                $this->pdoService->verifyPassword($password, $remoteHashedPassword);
+                // Comparaison remote hash et hash du input password + salt
+                $this->passwordHasher->verify($remoteHashedPassword, $plaintextPassword, $remoteSalt);
                 $attributes = $this->pdoService->fetchDatas($login);
-                $user = new User($login, $password, $attributes, $rememberMe);
+                $user = new User($login, $remoteHashedPassword, $attributes, $rememberMe);
+
                 $loader = function (string $userIdentifier) use ($user) {
                     return $user->getLogin() == $userIdentifier ? $user : null;
                 };
@@ -89,7 +94,7 @@ class PdoUserAuthenticator extends AbstractAuthenticator
                 $passport->setAttribute('attributes', $user->getAttributes());
 
                 return $passport;
-            } catch (InvalidPasswordException $e) {
+            } catch (InvalidSQLPasswordException $e) {
                 $request->getSession()->set(self::ERROR_PASSWORD, true);
                 throw new AuthenticationException();
             } catch (PDOException $e) {

src/Security/SQLLoginUserProvider.php

@@ -9,7 +9,7 @@ use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 
-class PdoUserProvider implements UserProviderInterface
+class SQLLoginUserProvider implements UserProviderInterface
 {
     protected RequestStack $requestStack;