turnstile

PaivanaController.php (5717B)

---

 <?php
 
 /**
  * @file
  * Location: src/Controller/PaivanaController.php
  *
  * Confirms a paid Paivana-style purchase, validates the contract
  * matches a known fulfillment URL and price category, and on success
  * mints the access cookie and redirects.
  */
 
 namespace Drupal\taler_turnstile\Controller;
 
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\Url;
 use Drupal\node\NodeInterface;
 use Drupal\path_alias\AliasManagerInterface;
 use Drupal\taler_turnstile\Entity\TurnstilePriceCategory;
 use Drupal\taler_turnstile\PaivanaCookie;
 use Drupal\taler_turnstile\TalerMerchantApiService;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 
 /**
  * Controller backing /taler-turnstile/paivana.
  */
 class PaivanaController extends ControllerBase {
 
   /**
    * @var \Drupal\taler_turnstile\TalerMerchantApiService
    */
   protected $apiService;
 
   /**
    * @var \Drupal\taler_turnstile\PaivanaCookie
    */
   protected $cookies;
 
   /**
    * @var \Drupal\path_alias\AliasManagerInterface
    */
   protected $aliasManager;
 
   public function __construct(TalerMerchantApiService $api_service,
                               PaivanaCookie $cookies,
                               AliasManagerInterface $alias_manager) {
     $this->apiService = $api_service;
     $this->cookies = $cookies;
     $this->aliasManager = $alias_manager;
   }
 
   public static function create(ContainerInterface $container) {
     return new static(
       $container->get('taler_turnstile.api_service'),
       $container->get('taler_turnstile.cookie'),
       $container->get('path_alias.manager')
     );
   }
 
 
   /**
    * Reverse $url to the node it canonically points at, so we can
    * load its price category. Returns NULL if no node could be
    * resolved.
    */
   protected function nodeFromUrl(string $url): ?NodeInterface {
     $base = $this->getRequest()->getSchemeAndHttpHost();
     if (strpos($url, $base) !== 0) {
       // The fulfillment URL must live on this site, otherwise we
       // have nothing meaningful to validate against.
       return NULL;
     }
     $path = parse_url($url, PHP_URL_PATH) ?: '/';
     // Resolve any path alias (e.g. "/articles/foo") down to "/node/123".
     $internal = $this->aliasManager->getPathByAlias($path);
     if (! preg_match('#^/node/(\d+)$#', $internal, $m)) {
       return NULL;
     }
     $node = $this->entityTypeManager()->getStorage('node')->load($m[1]);
     return $node instanceof NodeInterface ? $node : NULL;
   }
 
 
   /**
    * POST handler. Body: {order_id, nonce, cur_time, website}.
    * On success, returns 303 + Set-Cookie + Location: $website.
    */
   public function confirm(Request $request) {
     $payload = json_decode((string) $request->getContent(), TRUE);
     if (! is_array($payload)) {
       return new JsonResponse(['error' => 'malformed_json'], 400);
     }
     $order_id = $payload['order_id'] ?? NULL;
     $nonce = $payload['nonce'] ?? NULL;
     $cur_time = $payload['cur_time'] ?? NULL;
     $website = $payload['website'] ?? NULL;
     if (! is_string($order_id) || ! is_string($nonce) ||
         ! is_int($cur_time) || ! is_string($website)) {
       return new JsonResponse(['error' => 'missing_or_malformed_fields'], 400);
     }
     if ($cur_time <= time()) {
       return new JsonResponse(['error' => 'expired'], 410);
     }
 
     // Reconstruct the paivana ID exactly the same way the JS did.
     $hash = hash('sha256', $nonce . $website . (string) $cur_time, TRUE);
     $paivana_id = $cur_time . '-' . rtrim(strtr(base64_encode($hash), '+/', '-_'), '=');
 
     // Resolve the website to a Drupal node so we can determine the
     // price category and thus the set of acceptable amounts.
     $node = $this->nodeFromUrl($website);
     if (! $node) {
       \Drupal::logger('taler_turnstile')->warning('Confirm: cannot resolve fulfillment URL @url to a node', ['@url' => $website]);
       return new JsonResponse(['error' => 'unknown_fulfillment_url'], 404);
     }
     if (! $node->hasField('field_taler_turnstile_prcat') ||
         $node->get('field_taler_turnstile_prcat')->isEmpty()) {
       return new JsonResponse(['error' => 'no_price_category'], 404);
     }
     /** @var TurnstilePriceCategory $price_category */
     $price_category = $node->get('field_taler_turnstile_prcat')->entity;
     if (! $price_category) {
       return new JsonResponse(['error' => 'no_price_category'], 404);
     }
     $expected_amounts = $price_category->getAcceptableAmounts(
       $this->apiService->getSubscriptions()
     );
     if (empty($expected_amounts)) {
       return new JsonResponse(['error' => 'no_choices_configured'], 500);
     }
 
     $verified = $this->apiService->verifyPaidOrder(
       $order_id,
       $paivana_id,
       $website,
       $expected_amounts
     );
     if (! $verified) {
       return new JsonResponse(['error' => 'order_not_validated'], 402);
     }
 
     // If the contract bought a subscription, persist that in the
     // session so subsequent visits can short-circuit even when
     // the per-URL cookie expires.
     if (! empty($verified['subscription_slug'])) {
       _taler_turnstile_grant_subscriber_access(
         $verified['subscription_slug'],
         (int) $verified['subscription_expiration']
       );
     }
 
     $cookie = $this->cookies->mint(
       $request,
       $website,
       TalerMerchantApiService::ORDER_VALIDITY_SECONDS
     );
     $response = new RedirectResponse($website, 303);
     $response->headers->setCookie($cookie);
     // The result is per-cookie and short-lived; do not cache.
     $response->headers->set('Cache-Control', 'no-store');
     return $response;
   }
 
 }