ClaimTranslatorExtractorFactory.php

<?php

declare(strict_types=1);

/*
 * This file is part of the simplesamlphp-module-oidc.
 *
 * Copyright (C) 2018 by the Spanish Research and Academic Network.
 *
 * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
 * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace SimpleSAML\Module\oidc\Factories;

use SimpleSAML\Module\oidc\Factories\Entities\ClaimSetEntityFactory;
use SimpleSAML\Module\oidc\ModuleConfig;
use SimpleSAML\Module\oidc\Utils\ClaimTranslatorExtractor;

class ClaimTranslatorExtractorFactory
{
    protected const string CONFIG_KEY_CLAIM_NAME_PREFIX = 'claim_name_prefix';

    protected const string CONFIG_KEY_MULTIPLE_CLAIM_VALUES_ALLOWED = 'are_multiple_claim_values_allowed';


    public function __construct(
        private readonly ModuleConfig $moduleConfig,
        private readonly ClaimSetEntityFactory $claimSetEntityFactory,
    ) {
    }

    /**
     * @throws \Exception
     */
    public function build(): ClaimTranslatorExtractor
    {
        $translatorTable = $this->moduleConfig->config()
            ->getOptionalArray(ModuleConfig::OPTION_AUTH_SAML_TO_OIDC_TRANSLATE_TABLE, []);

        $privateScopes = $this->moduleConfig->getPrivateScopes();

        $claimSet = [];
        $allowedMultipleValueClaims = [];

        /**
         * @var string $scopeName
         * @var array $scopeConfig
         */
        foreach ($privateScopes as $scopeName => $scopeConfig) {
            $claims = is_array($scopeConfig['claims']) ? $scopeConfig['claims'] : [];

            if ($this->isScopeClaimNamePrefixSet($scopeConfig)) {
                $prefix = (string)($scopeConfig[self::CONFIG_KEY_CLAIM_NAME_PREFIX] ?? '');

                $translatorTable = $this->applyPrefixToTranslatorTableKeys($translatorTable, $claims, $prefix);
                $claims = $this->applyPrefixToClaimNames($claims, $prefix);
            }

            $claimSet[] = $this->claimSetEntityFactory->build($scopeName, $claims);

            if ($this->doesScopeAllowMultipleClaimValues($scopeConfig)) {
                $allowedMultipleValueClaims = array_merge($allowedMultipleValueClaims, $claims);
            }
        }

        $userIdAttr = $this->moduleConfig->getUserIdentifierAttribute();

        return new ClaimTranslatorExtractor(
            $userIdAttr,
            $this->claimSetEntityFactory,
            $claimSet,
            $translatorTable,
            $allowedMultipleValueClaims,
        );
    }

    /**
     * Apply a prefix to translator table keys (which serve as claim names).
     *
     * @param array $translatorTable Translation table array from config
     * @param array $claims Claim names for which to apply prefix
     * @param string $prefix Prefix to apply to claim names
     * @return array Translator table with prefixed claim names
     */
    protected function applyPrefixToTranslatorTableKeys(array $translatorTable, array $claims, string $prefix): array
    {
        /**
         * @var string $claimKey
         * @var array $mapping
         */
        foreach ($translatorTable as $claimKey => $mapping) {
            if (in_array($claimKey, $claims, true)) {
                $prefixedClaimKey = $prefix . $claimKey;
                $translatorTable[$prefixedClaimKey] = $mapping;
                unset($translatorTable[$claimKey]);
            }
        }

        return $translatorTable;
    }

    /**
     * @param array $claims Claim names for which to apply prefix
     * @param string $prefix Prefix to apply to claim names.
     * @return array
     */
    protected function applyPrefixToClaimNames(array $claims, string $prefix): array
    {
        array_walk($claims, function (string &$value, mixed $key, string $prefix) {
            $value = $prefix . $value;
        }, $prefix);

        return $claims;
    }

    /**
     * Check if the scope has a claim name prefix set
     */
    protected function isScopeClaimNamePrefixSet(array $scopeConfig): bool
    {
        return isset($scopeConfig[self::CONFIG_KEY_CLAIM_NAME_PREFIX]) &&
        is_string($scopeConfig[self::CONFIG_KEY_CLAIM_NAME_PREFIX]) &&
        !empty($scopeConfig[self::CONFIG_KEY_CLAIM_NAME_PREFIX]);
    }

    /**
     * Check if the scope allows claims to have multiple values.
     */
    protected function doesScopeAllowMultipleClaimValues(array $scopeConfig): bool
    {
        return isset($scopeConfig[self::CONFIG_KEY_MULTIPLE_CLAIM_VALUES_ALLOWED]) &&
        $scopeConfig[self::CONFIG_KEY_MULTIPLE_CLAIM_VALUES_ALLOWED];
    }
}