|
| 1 | +<?php |
| 2 | + |
| 3 | +declare(strict_types=1); |
| 4 | + |
| 5 | +namespace League\Bundle\OAuth2ServerBundle\Command; |
| 6 | + |
| 7 | +use Symfony\Component\Console\Attribute\AsCommand; |
| 8 | +use Symfony\Component\Console\Command\Command; |
| 9 | +use Symfony\Component\Console\Input\InputInterface; |
| 10 | +use Symfony\Component\Console\Input\InputOption; |
| 11 | +use Symfony\Component\Console\Output\OutputInterface; |
| 12 | +use Symfony\Component\Console\Style\SymfonyStyle; |
| 13 | +use Symfony\Component\Filesystem\Filesystem; |
| 14 | + |
| 15 | +/** |
| 16 | + * @author Beno!t POLASZEK <bpolaszek@gmail.com> |
| 17 | + */ |
| 18 | +#[AsCommand(name: 'league:oauth2-server:generate-keypair', description: 'Generate public/private keys for use in your application.')] |
| 19 | +final class GenerateKeyPairCommand extends Command |
| 20 | +{ |
| 21 | + private const ACCEPTED_ALGORITHMS = [ |
| 22 | + 'RS256', |
| 23 | + 'RS384', |
| 24 | + 'RS512', |
| 25 | + 'HS256', |
| 26 | + 'HS384', |
| 27 | + 'HS512', |
| 28 | + 'ES256', |
| 29 | + 'ES384', |
| 30 | + 'ES512', |
| 31 | + ]; |
| 32 | + |
| 33 | + /** |
| 34 | + * @deprecated |
| 35 | + */ |
| 36 | + protected static $defaultName = 'league:oauth2-server:generate-keypair'; |
| 37 | + |
| 38 | + private Filesystem $filesystem; |
| 39 | + |
| 40 | + private string $secretKey; |
| 41 | + |
| 42 | + private string $publicKey; |
| 43 | + |
| 44 | + private ?string $passphrase; |
| 45 | + |
| 46 | + private string $algorithm; |
| 47 | + |
| 48 | + public function __construct(Filesystem $filesystem, string $secretKey, string $publicKey, ?string $passphrase, string $algorithm) |
| 49 | + { |
| 50 | + parent::__construct(); |
| 51 | + $this->filesystem = $filesystem; |
| 52 | + $this->secretKey = $secretKey; |
| 53 | + $this->publicKey = $publicKey; |
| 54 | + $this->passphrase = $passphrase; |
| 55 | + $this->algorithm = $algorithm; |
| 56 | + } |
| 57 | + |
| 58 | + protected function configure(): void |
| 59 | + { |
| 60 | + $this->setDescription('Generate public/private keys for use in your application.'); |
| 61 | + $this->addOption('dry-run', null, InputOption::VALUE_NONE, 'Do not update key files.'); |
| 62 | + $this->addOption('skip-if-exists', null, InputOption::VALUE_NONE, 'Do not update key files if they already exist.'); |
| 63 | + $this->addOption('overwrite', null, InputOption::VALUE_NONE, 'Overwrite key files if they already exist.'); |
| 64 | + } |
| 65 | + |
| 66 | + protected function execute(InputInterface $input, OutputInterface $output): int |
| 67 | + { |
| 68 | + $io = new SymfonyStyle($input, $output); |
| 69 | + |
| 70 | + if (!\in_array($this->algorithm, self::ACCEPTED_ALGORITHMS, true)) { |
| 71 | + $io->error(sprintf('Cannot generate key pair with the provided algorithm `%s`.', $this->algorithm)); |
| 72 | + |
| 73 | + return Command::FAILURE; |
| 74 | + } |
| 75 | + |
| 76 | + [$secretKey, $publicKey] = $this->generateKeyPair($this->passphrase); |
| 77 | + |
| 78 | + if ($input->getOption('dry-run')) { |
| 79 | + $io->success('Your keys have been generated!'); |
| 80 | + $io->newLine(); |
| 81 | + $io->writeln(sprintf('Update your private key in <info>%s</info>:', $this->secretKey)); |
| 82 | + $io->writeln($secretKey); |
| 83 | + $io->newLine(); |
| 84 | + $io->writeln(sprintf('Update your public key in <info>%s</info>:', $this->publicKey)); |
| 85 | + $io->writeln($publicKey); |
| 86 | + |
| 87 | + return Command::SUCCESS; |
| 88 | + } |
| 89 | + |
| 90 | + $alreadyExists = $this->filesystem->exists($this->secretKey) || $this->filesystem->exists($this->publicKey); |
| 91 | + |
| 92 | + if ($alreadyExists) { |
| 93 | + try { |
| 94 | + $this->handleExistingKeys($input); |
| 95 | + } catch (\RuntimeException $e) { |
| 96 | + if (0 === $e->getCode()) { |
| 97 | + $io->comment($e->getMessage()); |
| 98 | + |
| 99 | + return Command::SUCCESS; |
| 100 | + } |
| 101 | + |
| 102 | + $io->error($e->getMessage()); |
| 103 | + |
| 104 | + return Command::FAILURE; |
| 105 | + } |
| 106 | + |
| 107 | + if (!$io->confirm('You are about to replace your existing keys. Are you sure you wish to continue?')) { |
| 108 | + $io->comment('Your action was canceled.'); |
| 109 | + |
| 110 | + return Command::SUCCESS; |
| 111 | + } |
| 112 | + } |
| 113 | + |
| 114 | + $this->filesystem->dumpFile($this->secretKey, $secretKey); |
| 115 | + $this->filesystem->dumpFile($this->publicKey, $publicKey); |
| 116 | + |
| 117 | + $io->success('Done!'); |
| 118 | + |
| 119 | + return Command::SUCCESS; |
| 120 | + } |
| 121 | + |
| 122 | + private function handleExistingKeys(InputInterface $input): void |
| 123 | + { |
| 124 | + if ($input->getOption('skip-if-exists') && $input->getOption('overwrite')) { |
| 125 | + throw new \RuntimeException('Both options `--skip-if-exists` and `--overwrite` cannot be combined.', 1); |
| 126 | + } |
| 127 | + |
| 128 | + if ($input->getOption('skip-if-exists')) { |
| 129 | + throw new \RuntimeException('Your key files already exist, they won\'t be overridden.', 0); |
| 130 | + } |
| 131 | + |
| 132 | + if (!$input->getOption('overwrite')) { |
| 133 | + throw new \RuntimeException('Your keys already exist. Use the `--overwrite` option to force regeneration.', 1); |
| 134 | + } |
| 135 | + } |
| 136 | + |
| 137 | + /** |
| 138 | + * @return array{0: string, 1: string} |
| 139 | + */ |
| 140 | + private function generateKeyPair(?string $passphrase): array |
| 141 | + { |
| 142 | + $config = $this->buildOpenSSLConfiguration(); |
| 143 | + |
| 144 | + $resource = openssl_pkey_new($config); |
| 145 | + if (false === $resource) { |
| 146 | + throw new \RuntimeException(openssl_error_string()); |
| 147 | + } |
| 148 | + |
| 149 | + $success = openssl_pkey_export($resource, $privateKey, $passphrase); |
| 150 | + |
| 151 | + if (false === $success) { |
| 152 | + throw new \RuntimeException(openssl_error_string()); |
| 153 | + } |
| 154 | + |
| 155 | + $publicKeyData = openssl_pkey_get_details($resource); |
| 156 | + |
| 157 | + if (!\is_array($publicKeyData)) { |
| 158 | + throw new \RuntimeException(openssl_error_string()); |
| 159 | + } |
| 160 | + |
| 161 | + if (!\array_key_exists('key', $publicKeyData) || !\is_string($publicKeyData['key'])) { |
| 162 | + throw new \RuntimeException('Invalid public key type.'); |
| 163 | + } |
| 164 | + |
| 165 | + return [$privateKey, $publicKeyData['key']]; |
| 166 | + } |
| 167 | + |
| 168 | + private function buildOpenSSLConfiguration(): array |
| 169 | + { |
| 170 | + $digestAlgorithms = [ |
| 171 | + 'RS256' => 'sha256', |
| 172 | + 'RS384' => 'sha384', |
| 173 | + 'RS512' => 'sha512', |
| 174 | + 'HS256' => 'sha256', |
| 175 | + 'HS384' => 'sha384', |
| 176 | + 'HS512' => 'sha512', |
| 177 | + 'ES256' => 'sha256', |
| 178 | + 'ES384' => 'sha384', |
| 179 | + 'ES512' => 'sha512', |
| 180 | + ]; |
| 181 | + $privateKeyBits = [ |
| 182 | + 'RS256' => 2048, |
| 183 | + 'RS384' => 2048, |
| 184 | + 'RS512' => 4096, |
| 185 | + 'HS256' => 512, |
| 186 | + 'HS384' => 512, |
| 187 | + 'HS512' => 512, |
| 188 | + 'ES256' => 384, |
| 189 | + 'ES384' => 512, |
| 190 | + 'ES512' => 1024, |
| 191 | + ]; |
| 192 | + $privateKeyTypes = [ |
| 193 | + 'RS256' => \OPENSSL_KEYTYPE_RSA, |
| 194 | + 'RS384' => \OPENSSL_KEYTYPE_RSA, |
| 195 | + 'RS512' => \OPENSSL_KEYTYPE_RSA, |
| 196 | + 'HS256' => \OPENSSL_KEYTYPE_DH, |
| 197 | + 'HS384' => \OPENSSL_KEYTYPE_DH, |
| 198 | + 'HS512' => \OPENSSL_KEYTYPE_DH, |
| 199 | + 'ES256' => \OPENSSL_KEYTYPE_EC, |
| 200 | + 'ES384' => \OPENSSL_KEYTYPE_EC, |
| 201 | + 'ES512' => \OPENSSL_KEYTYPE_EC, |
| 202 | + ]; |
| 203 | + |
| 204 | + $curves = [ |
| 205 | + 'ES256' => 'secp256k1', |
| 206 | + 'ES384' => 'secp384r1', |
| 207 | + 'ES512' => 'secp521r1', |
| 208 | + ]; |
| 209 | + |
| 210 | + $config = [ |
| 211 | + 'digest_alg' => $digestAlgorithms[$this->algorithm], |
| 212 | + 'private_key_type' => $privateKeyTypes[$this->algorithm], |
| 213 | + 'private_key_bits' => $privateKeyBits[$this->algorithm], |
| 214 | + ]; |
| 215 | + |
| 216 | + if (isset($curves[$this->algorithm])) { |
| 217 | + $config['curve_name'] = $curves[$this->algorithm]; |
| 218 | + } |
| 219 | + |
| 220 | + return $config; |
| 221 | + } |
| 222 | +} |
0 commit comments