vendor/shopware/core/Checkout/Payment/Cart/Token/JWTFactoryV2.php line 70

  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Checkout\Payment\Cart\Token;
  5. use Doctrine\DBAL\Connection;
  6. use Lcobucci\JWT\Configuration;
  7. use Lcobucci\JWT\UnencryptedToken;
  8. use Shopware\Core\Checkout\Payment\Exception\InvalidTokenException;
  9. use Shopware\Core\Checkout\Payment\Exception\TokenInvalidatedException;
  10. use Shopware\Core\Defaults;
  11. use Shopware\Core\Framework\Log\Package;
  12. use Shopware\Core\Framework\Uuid\Uuid;
  14. #[Package('checkout')]
  15. class JWTFactoryV2 implements TokenFactoryInterfaceV2
  16. {
  17.     /**
  18.      * @var Configuration
  19.      */
  20.     protected $configuration;
  22.     /**
  23.      * @internal
  24.      */
  25.     public function __construct(Configuration $configuration, private readonly Connection $connection)
  26.     {
  27.         $this->configuration = $configuration;
  28.     }
  30.     public function generateToken(TokenStruct $tokenStruct): string
  31.     {
  32.         $expires = new \DateTimeImmutable('@' . time());
  34.         // @see https://github.com/php/php-src/issues/9950
  35.         if ($tokenStruct->getExpires() > 0) {
  36.             $expires = $expires->modify(
  37.                 sprintf('+%d seconds', $tokenStruct->getExpires())
  38.             );
  39.         } else {
  40.             $expires = $expires->modify(
  41.                 sprintf('-%d seconds', abs($tokenStruct->getExpires()))
  42.             );
  43.         }
  45.         $jwtToken = $this->configuration->builder()
  46.             ->identifiedBy(Uuid::randomHex())
  47.             ->issuedAt(new \DateTimeImmutable('@' . time()))
  48.             ->canOnlyBeUsedAfter(new \DateTimeImmutable('@' . time()))
  49.             ->expiresAt($expires)
  50.             ->relatedTo($tokenStruct->getTransactionId() ?? '')
  51.             ->withClaim('pmi', $tokenStruct->getPaymentMethodId())
  52.             ->withClaim('ful', $tokenStruct->getFinishUrl())
  53.             ->withClaim('eul', $tokenStruct->getErrorUrl())
  54.             ->getToken($this->configuration->signer(), $this->configuration->signingKey());
  56.         $this->write($jwtToken->toString(), $expires);
  58.         return $jwtToken->toString();
  59.     }
  61.     /**
  62.      * @throws InvalidTokenException
  63.      */
  64.     public function parseToken(string $token): TokenStruct
  65.     {
  66.         try {
  67.             /** @var UnencryptedToken $jwtToken */
  68.             $jwtToken = $this->configuration->parser()->parse($token);
  69.         } catch (\Throwable) {
  70.             throw new InvalidTokenException($token);
  71.         }
  73.         if (!$this->configuration->validator()->validate($jwtToken, ...$this->configuration->validationConstraints())) {
  74.             throw new InvalidTokenException($token);
  75.         }
  77.         if (!$this->has($token)) {
  78.             throw new TokenInvalidatedException($token);
  79.         }
  81.         $errorUrl = $jwtToken->claims()->get('eul');
  83.         /** @var \DateTimeImmutable $expires */
  84.         $expires = $jwtToken->claims()->get('exp');
  86.         return new TokenStruct(
  87.             $jwtToken->claims()->get('jti'),
  88.             $token,
  89.             $jwtToken->claims()->get('pmi'),
  90.             $jwtToken->claims()->get('sub'),
  91.             $jwtToken->claims()->get('ful'),
  92.             $expires->getTimestamp(),
  93.             $errorUrl
  94.         );
  95.     }
  97.     public function invalidateToken(string $token): bool
  98.     {
  99.         $this->delete($token);
  101.         return false;
  102.     }
  104.     private function write(string $token, \DateTimeImmutable $expires): void
  105.     {
  106.         $this->connection->insert('payment_token', [
  107.             'token' => self::normalize($token),
  108.             'expires' => $expires->format(Defaults::STORAGE_DATE_TIME_FORMAT),
  109.         ]);
  110.     }
  112.     private function delete(string $token): void
  113.     {
  114.         $this->connection->executeStatement(
  115.             'DELETE FROM payment_token WHERE token = :token',
  116.             ['token' => self::normalize($token)]
  117.         );
  118.     }
  120.     private function has(string $token): bool
  121.     {
  122.         $valid = $this->connection->fetchOne('SELECT token FROM payment_token WHERE token = :token', ['token' => self::normalize($token)]);
  124.         return $valid !== false;
  125.     }
  127.     private static function normalize(string $token): string
  128.     {
  129.         return substr(hash('sha256', $token), 0, 32);
  130.     }
  131. }