EmailChallenge.php

<?php

namespace Kirby\Auth\Challenge;

use Kirby\Auth\Challenge;
use Kirby\Auth\Pending;
use Kirby\Cms\User;
use Kirby\Panel\Ui\Button;
use Kirby\Panel\Ui\Component;
use Kirby\Toolkit\I18n;
use Kirby\Toolkit\Str;
use SensitiveParameter;

/**
 * Creates and verifies one-time auth codes
 * that are sent via email
 *
 * @copyright Bastian Allgeier
 * @license   https://getkirby.com/license
 * @since     6.0.0
 */
class EmailChallenge extends Challenge
{
	/**
	 * Generates a random one-time auth code and
	 * returns that code for later verification
	 */
	public function create(): Pending
	{
		$code = Str::random(6, 'num');

		$this->send(
			// insert a space in the middle for easier readability
			code: substr($code, 0, 3) . ' ' . substr($code, 3, 3)
		);

		return new Pending(
			secret: User::hashPassword($code)
		);
	}

	public function form(Pending $pending): Component
	{
		return new Component(
			component: 'k-login-email-challenge-form',
			submit:    $this->submit(),
			user:      $this->user->email(),
		);
	}

	public static function icon(): string
	{
		return 'email-unread';
	}

	/**
	 * As a second factor, the email challenge is opt-in per user,
	 * so that users are not forced into it just by having an email
	 * address. For every other purpose it stays always available.
	 */
	public static function isAvailable(User $user, string $mode): bool
	{
		if ($mode !== '2fa') {
			return true;
		}

		if ($user->secret('email') === true) {
			return true;
		}

		// enforced 2FA needs a factor for every user, so email stays
		// the baseline for those who have not set up anything else
		return $user->kirby()->auth()->methods()->hasAnyRequiring2FA();
	}

	/**
	 * Sends the email with the code to the user
	 */
	protected function send(string $code): void
	{
		// use the login templates for 2FA
		$mode = match ($this->mode) {
			'2fa'   => 'login',
			default => $this->mode
		};

		$this->kirby->email([
			'from'     => $this->senderFrom(),
			'fromName' => $this->senderFromName(),
			'to'       => $this->user,
			'subject'  => $this->subject($mode),
			'template' => 'auth/' . $mode,
			'data' => [
				'user'    => $this->user,
				'site'    => $this->kirby->system()->title(),
				'code'    => $code,
				'timeout' => round($this->timeout / 60)
			]
		]);
	}

	/**
	 * Returns sender email address for the email
	 */
	protected function senderFrom(): string
	{
		return $this->kirby->option(
			'auth.challenge.email.from',
			'noreply@' . $this->kirby->url('index', true)->host()
		);
	}

	/**
	 * Returns sender name for the email
	 */
	protected function senderFromName(): string
	{
		return $this->kirby->option(
			'auth.challenge.email.fromName',
			$this->kirby->site()->title()
		);
	}

	public static function settings(User $user): array
	{
		return [
			new Button(
				icon:   static::icon(),
				text:   static::i18n('login.challenge.email.label'),
				drawer: $user->panel()->url(true) . '/security/challenge/email'
			)
		];
	}

	/**
	 * Returns subject for the email
	 */
	protected function subject(string $mode): string
	{
		return $this->kirby->option(
			'auth.challenge.email.subject',
			I18n::translate(
				key: 'login.email.' . $mode . '.subject',
				locale: $this->user->language()
			)
		);
	}

	/**
	 * Verifies the provided input against the code
	 * that was returned from the `create()` method
	 */
	public function verify(
		#[SensitiveParameter]
		mixed $input,
		Pending $data
	): bool {
		// normalize the formatting in the user-provided code
		$input = str_replace(' ', '', $input);
		$hash  = $data->secret();

		if (is_string($hash) !== true) {
			return false;
		}

		return password_verify($input, $hash);
	}
}