WE2-729 Updated readme

WE2-729 Added copyright information to some functions
Code unification

Author: Guido Gröön

README.md

@@ -4,6 +4,8 @@
 
 web-eid-authtoken-validation-php is a PHP library for issuing challenge nonces and validating Web eID authentication tokens during secure authentication with electronic ID (eID) smart cards in web applications.
 
+The logic of this repository is based on the [Java library](https://github.com/web-eid/web-eid-authtoken-validation-java). We also draw inspiration from the [PHP library](https://github.com/Muzosh/web-eid-authtoken-validation-php) created by Petr Muzikant and used some of his code.
+
 More information about the Web eID project is available on the project [website](https://web-eid.eu/).
 
 # Quickstart

src/certificate/CertificateValidator.php

@@ -42,6 +42,9 @@ public function __construct()
         throw new BadFunctionCallException("Utility class");
     }
 
+    /**
+     * @copyright 2022 Petr Muzikant [email protected]
+     */
     public static function certificateIsValidOnDate(X509 $subjectCertificate, DateTime $date, string $subject): void
     {
         if (!$subjectCertificate->validateDate($date)) {
@@ -63,6 +66,9 @@ public static function trustedCACertificatesAreValidOnDate(TrustedCertificates $
         }
     }
 
+    /**
+     * @copyright 2022 Petr Muzikant [email protected]
+     */
     public static function validateIsSignedByTrustedCA(X509 $certificate, TrustedCertificates $trustedCertificates): X509
     {
         foreach ($trustedCertificates->getCertificates() as $trustedCertificate) {

src/challenge/ChallengeNonceGeneratorBuilder.php

@@ -44,6 +44,9 @@ class ChallengeNonceGeneratorBuilder
      */
     private $secureRandom;
 
+    /**
+     * @copyright 2022 Petr Muzikant [email protected]
+     */
     public function __construct()
     {
         // 5 minutes
@@ -57,6 +60,8 @@ public function __construct()
      * Override default nonce time-to-live duration.
      * <p>
      * When the time-to-live passes, the nonce is considered to be expired.
+     * 
+     * @copyright 2022 Petr Muzikant [email protected]
      *
      * @param int $seconds - challenge nonce time-to-live duration in seconds
      * @return ChallengeNonceGeneratorBuilder builder instance
@@ -92,6 +97,11 @@ public function withSecureRandom(callable $secureRandom): ChallengeNonceGenerato
         return $this;
     }
 
+    /**
+     * Validates the configuration and builds the {@link ChallengeNonceGenerator} instance.
+     *
+     * @return new challenge nonce generator instance
+     */
     public function build(): ChallengeNonceGenerator
     {
         // Force to use PHP session based nounce store when store is not set
@@ -102,7 +112,7 @@ public function build(): ChallengeNonceGenerator
         return new ChallengeNonceGeneratorImpl($this->challengeNonceStore, $this->secureRandom, $this->ttl);
     }
 
-    private function  validateParameters(): void
+    private function validateParameters(): void
     {
         if (is_null($this->challengeNonceStore)) {
             throw new InvalidArgumentException("Challenge nonce store must not be null");

src/challenge/ChallengeNonceGeneratorImpl.php

@@ -30,19 +30,19 @@ final class ChallengeNonceGeneratorImpl implements ChallengeNonceGenerator
 {
     private ChallengeNonceStore $challengeNonceStore;
     private $secureRandom;
-    private int $ttlSeconds;
+    private int $ttl;
 
-    public function __construct(ChallengeNonceStore $challengeNonceStore, callable $secureRandom, int $ttlSeconds)
+    public function __construct(ChallengeNonceStore $challengeNonceStore, callable $secureRandom, int $ttl)
     {
         $this->challengeNonceStore = $challengeNonceStore;
         $this->secureRandom = $secureRandom;
-        $this->ttlSeconds = $ttlSeconds;
+        $this->ttl = $ttl;
     }
 
     public function generateAndStoreNonce(): ChallengeNonce
     {
         $nonceString = call_user_func($this->secureRandom, self::NONCE_LENGTH);
-        $expirationTime = DateAndTime::utcNow()->modify("+{$this->ttlSeconds} seconds");
+        $expirationTime = DateAndTime::utcNow()->modify("+{$this->ttl} seconds");
         $base64Nonce = base64_encode($nonceString);
         $challengeNonce = new ChallengeNonce($base64Nonce, $expirationTime);
         $this->challengeNonceStore->put($challengeNonce);

src/util/CollectionsUtil.php

@@ -12,6 +12,9 @@
 use TypeError;
 use web_eid\web_eid_authtoken_validation_php\validator\certvalidators\SubjectCertificateValidator;
 
+/**
+ * @copyright 2022 Petr Muzikant [email protected]
+ */
 abstract class Collection implements Countable, IteratorAggregate, ArrayAccess
 {
     protected array $array;

src/util/DateAndTime.php

@@ -67,6 +67,9 @@ public static function requirePositiveDuration(int $duration, string $fieldName)
         }
     }
 
+    /**
+     * @copyright 2022 Petr Muzikant [email protected]
+     */
     public static function toUtcString(?DateTime $date): string
     {
         if (is_null($date)) {
@@ -76,9 +79,13 @@ public static function toUtcString(?DateTime $date): string
     }
 }
 
+/**
+ * @copyright 2022 Petr Muzikant [email protected]
+ */
 final class DefaultClock
 {
     private static DefaultClock $instance;
+    private DateTime $mockedClock;
 
     public static function getInstance()
     {

src/validator/AuthTokenValidationConfiguration.php

@@ -45,6 +45,9 @@ final class AuthTokenValidationConfiguration
     private UriCollection $nonceDisabledOcspUrls;
     private ?DesignatedOcspServiceConfiguration $designatedOcspServiceConfiguration = null;
 
+    /**
+     * @copyright 2022 Petr Muzikant [email protected]
+     */
     public function __construct()
     {
         // Don't allow Estonian Mobile-ID policy by default.
@@ -120,13 +123,13 @@ public function getNonceDisabledOcspUrls(): UriCollection
     public function validate(): void
     {
         if (is_null($this->siteOrigin)) {
-            throw new InvalidArgumentException('Origin URI must not be null');
+            throw new InvalidArgumentException("Origin URI must not be null");
         }
 
         self::validateIsOriginURL($this->siteOrigin);
 
         if (count($this->trustedCACertificates) == 0) {
-            throw new InvalidArgumentException('At least one trusted certificate authority must be provided');
+            throw new InvalidArgumentException("At least one trusted certificate authority must be provided");
         }
 
         DateAndTime::requirePositiveDuration($this->ocspRequestTimeout, "OCSP request timeout");
@@ -143,7 +146,7 @@ public function validateIsOriginURL(Uri $uri): void
     {
         // 1. Verify that the URI can be converted to absolute URL.
         if (!$uri->isAbsolute()) {
-            throw new InvalidArgumentException('Provided URI is not a valid URL');
+            throw new InvalidArgumentException("Provided URI is not a valid URL");
         }
 
         $reference = $uri->createFromArray([
@@ -154,7 +157,7 @@ public function validateIsOriginURL(Uri $uri): void
 
         // 2. Verify that the URI contains only HTTPS scheme, host and optional port components.
         if ($uri->getUrl() !== $reference->getUrl()) {
-            throw new InvalidArgumentException('Origin URI must only contain the HTTPS scheme, host and optional port component');
+            throw new InvalidArgumentException("Origin URI must only contain the HTTPS scheme, host and optional port component");
         }
     }
 }

src/validator/AuthTokenValidatorBuilder.php

@@ -67,6 +67,8 @@ public function withSiteOrigin(Uri $origin): AuthTokenValidatorBuilder
      * <p>
      * At least one trusted intermediate Certificate Authority must be provided as a mandatory configuration parameter.
      *
+     * @copyright 2022 Petr Muzikant [email protected]
+     * 
      * @param X509 $certificates trusted intermediate Certificate Authority certificates
      * @return the builder instance for method chaining
      */
@@ -83,6 +85,8 @@ public function withTrustedCertificateAuthorities(X509 ...$certificates): AuthTo
      * Adds the given policies to the list of disallowed user certificate policies.
      * In order for the user certificate to be considered valid, it must not contain any policies
      * present in this list.
+     * 
+     * @copyright 2022 Petr Muzikant [email protected]
      *
      * @param string $policies disallowed user certificate policies as string array
      * @return the builder instance for method chaining
@@ -133,6 +137,8 @@ public function withOcspRequestTimeout(int $ocspRequestTimeout): AuthTokenValida
      * Adds the given URLs to the list of OCSP URLs for which the nonce protocol extension will be disabled.
      * The OCSP URL is extracted from the user certificate and some OCSP services don't support the nonce extension.
      *
+     * @copyright 2022 Petr Muzikant [email protected]
+     * 
      * @param URI $urls OCSP URLs for which the nonce protocol extension will be disabled
      * @return the builder instance for method chaining
      */

src/validator/AuthTokenValidatorImpl.php

@@ -44,6 +44,7 @@
 use web_eid\web_eid_authtoken_validation_php\validator\ocsp\OcspClientImpl;
 use web_eid\web_eid_authtoken_validation_php\validator\ocsp\OcspServiceProvider;
 use web_eid\web_eid_authtoken_validation_php\validator\ocsp\service\AiaOcspServiceConfiguration;
+use web_eid\web_eid_authtoken_validation_php\util\TrustedCertificates;
 
 final class AuthTokenValidatorImpl implements AuthTokenValidator
 {
@@ -54,11 +55,15 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator
     private AuthTokenValidationConfiguration $configuration;
     private SubjectCertificateValidatorBatch $simpleSubjectCertificateValidators;
     private AuthTokenSignatureValidator $authTokenSignatureValidator;
+    private TrustedCertificates $trustedCACertificates;
     private Log $logger;
 
     private OcspClient $ocspClient;
     private OcspServiceProvider $ocspServiceProvider;
 
+    /**
+     * @copyright 2022 Petr Muzikant [email protected]
+     */
     public function __construct(AuthTokenValidationConfiguration $configuration)
     {
         $this->logger = Log::getLogger(self::class);
@@ -67,9 +72,10 @@ public function __construct(AuthTokenValidationConfiguration $configuration)
         $this->configuration = clone $configuration;
 
         // Create and cache trusted CA certificate JCA objects for SubjectCertificateTrustedValidator and AiaOcspService.
-        $this->trustedCertificates = CertificateValidator::buildTrustFromCertificates($configuration->getTrustedCACertificates());
+        $this->trustedCACertificates = CertificateValidator::buildTrustFromCertificates($configuration->getTrustedCACertificates());
+
         $this->simpleSubjectCertificateValidators = new SubjectCertificateValidatorBatch(
-            new SubjectCertificateExpiryValidator($this->trustedCertificates),
+            new SubjectCertificateExpiryValidator($this->trustedCACertificates),
             new SubjectCertificatePurposeValidator(),
             new SubjectCertificatePolicyValidator($configuration->getDisallowedSubjectCertificatePolicies())
         );
@@ -80,7 +86,7 @@ public function __construct(AuthTokenValidationConfiguration $configuration)
                 $configuration->getDesignatedOcspServiceConfiguration(),
                 new AiaOcspServiceConfiguration(
                     $configuration->getNonceDisabledOcspUrls(),
-                    $this->trustedCertificates
+                    $this->trustedCACertificates
                 )
             );
         }
@@ -91,10 +97,10 @@ public function __construct(AuthTokenValidationConfiguration $configuration)
     private function validateTokenLength(string $authToken): void
     {
         if (is_null($authToken) || strlen($authToken) < self::TOKEN_MIN_LENGTH) {
-            throw new AuthTokenParseException('Auth token is null or too short');
+            throw new AuthTokenParseException("Auth token is null or too short");
         }
         if (strlen($authToken) > self::TOKEN_MAX_LENGTH) {
-            throw new AuthTokenParseException('Auth token is too long');
+            throw new AuthTokenParseException("Auth token is too long");
         }
     }
 
@@ -136,16 +142,16 @@ public function validate(WebEidAuthToken $authToken, string $currentChallengeNon
         }
     }
 
-    private function validateToken(WebEidAuthToken $authToken, string $currentChallengeNonce): X509
+    private function validateToken(WebEidAuthToken $token, string $currentChallengeNonce): X509
     {
-        if (is_null($authToken->getFormat()) || substr($authToken->getFormat(), 0, strlen(self::CURRENT_TOKEN_FORMAT_VERSION)) != self::CURRENT_TOKEN_FORMAT_VERSION) {
+        if (is_null($token->getFormat()) || substr($token->getFormat(), 0, strlen(self::CURRENT_TOKEN_FORMAT_VERSION)) != self::CURRENT_TOKEN_FORMAT_VERSION) {
             throw new AuthTokenParseException("Only token format version '" . self::CURRENT_TOKEN_FORMAT_VERSION . "' is currently supported");
         }
-        if (is_null($authToken->getUnverifiedCertificate()) || empty($authToken->getUnverifiedCertificate())) {
+        if (is_null($token->getUnverifiedCertificate()) || empty($token->getUnverifiedCertificate())) {
             throw new AuthTokenParseException("'unverifiedCertificate' field is missing, null or empty");
         }
         $subjectCertificate = new X509();
-        if (!$subjectCertificate->loadX509($authToken->getUnverifiedCertificate())) {
+        if (!$subjectCertificate->loadX509($token->getUnverifiedCertificate())) {
             throw new CertificateDecodingException("'unverifiedCertificate' decode failed");
         }
 
@@ -156,8 +162,8 @@ private function validateToken(WebEidAuthToken $authToken, string $currentChalle
         // have been implicitly and correctly verified without the need to implement any additional checks.
 
         $this->authTokenSignatureValidator->validate(
-            $authToken->getAlgorithm(),
-            $authToken->getSignature(),
+            $token->getAlgorithm(),
+            $token->getSignature(),
             $subjectCertificate->getPublicKey(),
             $currentChallengeNonce
         );
@@ -168,7 +174,7 @@ private function validateToken(WebEidAuthToken $authToken, string $currentChalle
     private function getCertTrustValidators(): SubjectCertificateValidatorBatch
     {
 
-        $certTrustedValidator = new SubjectCertificateTrustedValidator($this->trustedCertificates);
+        $certTrustedValidator = new SubjectCertificateTrustedValidator($this->trustedCACertificates);
 
         $validatorBatch = new SubjectCertificateValidatorBatch(
             $certTrustedValidator

src/validator/certvalidators/SubjectCertificatePurposeValidator.php

@@ -44,6 +44,8 @@ public function __construct()
     /**
      * Validates that the purpose of the user certificate from the authentication token contains client authentication.
      *
+     * @copyright 2022 Petr Muzikant [email protected]
+     * 
      * @param subjectCertificate user certificate to be validated
      * @throws UserCertificateMissingPurposeException
      */