ElyBy-Mirror/accounts
1
0
Fork 0
mirror of https://github.com/elyby/accounts.git synced 2025-05-31 14:11:46 +05:30
Code Issues Packages Projects Releases Wiki Activity

Implemented account deletion. Not all cases covered with tests [skip ci]

Browse Source
This commit is contained in:
ErickSkrauch
2020-06-12 00:27:02 +03:00
parent c86817a93d
commit 0183e54442
56 changed files with 1041 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
api/modules/authserver/models/AuthenticationForm.php
View File

@ -52,10 +52,14 @@ class AuthenticationForm extends ApiForm {
Authserver::info("Trying to authenticate user by login = '{$this->username}'.");
// The previous authorization server implementation used the nickname field instead of username,
// so we keep such behavior
$attribute = strpos($this->username, '@') === false ? 'nickname' : 'email';
$loginForm = new LoginForm();
$loginForm->login = $this->username;
$loginForm->password = $this->password;
if (!$loginForm->validate()) {
if (!$loginForm->validate() || $loginForm->getAccount()->status === Account::STATUS_DELETED) {
$errors = $loginForm->getFirstErrors();
if (isset($errors['totp'])) {
Authserver::error("User with login = '{$this->username}' protected by two factor auth.");
@ -73,10 +77,6 @@ class AuthenticationForm extends ApiForm {
Authserver::error("User with login = '{$this->username}' passed wrong password.");
}
// The previous authorization server implementation used the nickname field instead of username,
// so we keep such behavior
$attribute = strpos($this->username, '@') === false ? 'nickname' : 'email';
// TODO: эта логика дублируется с логикой в SignoutForm
throw new ForbiddenOperationException("Invalid credentials. Invalid {$attribute} or password.");

2
api/modules/authserver/models/RefreshTokenForm.php
View File

@ -62,7 +62,7 @@ class RefreshTokenForm extends ApiForm {
$account = Account::findOne(['id' => $tokenReader->getAccountId()]);
}
if ($account === null) {
if ($account === null || $account->status === Account::STATUS_DELETED) {
throw new ForbiddenOperationException('Invalid token.');
}

5
api/modules/authserver/validators/AccessTokenValidator.php
View File

@ -13,10 +13,7 @@ use yii\validators\Validator;
class AccessTokenValidator extends Validator {
/**
* @var bool
*/
public $verifyExpiration = true;
public bool $verifyExpiration = true;
/**
* @param string $value