applicationpassword.php

См. документацию.

<?php

 
namespace Bitrix\Main\Authentication;
 
use Bitrix\Main;
use Bitrix\Main\ORM;
use Bitrix\Main\ORM\Data;
use Bitrix\Main\ORM\Fields;

class ApplicationPasswordTable extends Data\DataManager
{
    use Data\Internal\DeleteByFilterTrait;
 
    protected const PASSWORD_ALPHABET = "qwertyuiopasdfghjklzxcvbnm";
    protected const PASSWORD_LENGTH = 16;
 
    public static function getTableName()
    {
        return "b_app_password";
    }
 
    public static function getMap()
    {
        return [
            new Fields\IntegerField('ID', [
                'primary' => true,
                'autocomplete' => true,
            ]),
            new Fields\IntegerField('USER_ID', [
                'required' => true,
                'validation' => '\Bitrix\Main\Authentication\ApplicationPasswordTable::getUserValidators',
            ]),
            new Fields\StringField('APPLICATION_ID', [
                'required' => true,
            ]),
            new Fields\StringField('PASSWORD', [
                'required' => true,
            ]),
            new Fields\StringField('DIGEST_PASSWORD'),
            new Fields\DatetimeField('DATE_CREATE'),
            new Fields\DatetimeField('DATE_LOGIN'),
            new Fields\StringField('LAST_IP'),
            new Fields\StringField('COMMENT'),
            new Fields\StringField('SYSCOMMENT'),
            new Fields\StringField('CODE'),
            new Fields\Relations\Reference(
                'USER',
                'Bitrix\Main\User',
                ['=this.USER_ID' => 'ref.ID'],
                ['join_type' => 'INNER']
            ),
        ];
    }
 
    public static function getUserValidators()
    {
        return [
            new Fields\Validators\ForeignValidator(Main\UserTable::getEntity()->getField('ID')),
        ];
    }
 
    public static function onBeforeAdd(ORM\Event $event)
    {
        $result = new ORM\EventResult;
        $data = $event->getParameter("fields");
 
        if (isset($data["USER_ID"]) && isset($data['PASSWORD']))
        {
            $modified = [
                'PASSWORD' => Main\Security\Password::hash($data['PASSWORD']),
            ];
 
            $user = Main\UserTable::getRowById($data["USER_ID"], ['select' => ['LOGIN']]);
 
            if ($user !== null)
            {
                $realm = (defined('BX_HTTP_AUTH_REALM') ? BX_HTTP_AUTH_REALM : "Bitrix Site Manager");
                $digest = md5($user["LOGIN"] . ':' . $realm . ':' . $data['PASSWORD']);
                $modified['DIGEST_PASSWORD'] = $digest;
            }
 
            $result->modifyFields($modified);
        }
        return $result;
    }
 
    public static function onDelete(ORM\Event $event)
    {
        $id = $event->getParameter("id");
 
        $row = static::getRowById($id);
        if ($row)
        {
            Main\UserAuthActionTable::addLogoutAction($row["USER_ID"], $row["APPLICATION_ID"]);
        }
    }

    public static function generatePassword()
    {
        return Main\Security\Random::getStringByCharsets(static::PASSWORD_LENGTH, static::PASSWORD_ALPHABET);
    }

    public static function isPassword($password)
    {
        if (is_string($password))
        {
            $password = str_replace(' ', '', $password);
 
            if (strlen($password) === static::PASSWORD_LENGTH)
            {
                return (!preg_match("/[^" . static::PASSWORD_ALPHABET . "]/", $password));
            }
        }
        return false;
    }

    public static function findPassword($userId, $password, $passwordOriginal = true)
    {
        if ($passwordOriginal)
        {
            $password = str_replace(' ', '', $password);
        }
 
        $appPasswords = static::getList([
            'select' => [
                'ID',
                'PASSWORD',
                'APPLICATION_ID',
            ],
            'filter' => [
                '=USER_ID' => $userId,
            ],
            'order' => [
                'ID' => 'desc',
            ],
        ]);
        while (($appPassword = $appPasswords->fetch()))
        {
            if (Main\Security\Password::equals($appPassword["PASSWORD"], $password, $passwordOriginal))
            {
                //bingo, application password
                return $appPassword;
            }
        }
        return false;
    }

    public static function findDigestPassword($userId, array $digest)
    {
        $appPasswords = static::getList([
            'select' => ['PASSWORD', 'DIGEST_PASSWORD', 'APPLICATION_ID'],
            'filter' => ['=USER_ID' => $userId],
        ]);
 
        $server = Main\Context::getCurrent()->getServer();
        $method = ($server['REDIRECT_REQUEST_METHOD'] !== null ? $server['REDIRECT_REQUEST_METHOD'] : $server['REQUEST_METHOD']);
        $HA2 = md5($method . ':' . $digest['uri']);
 
        while (($appPassword = $appPasswords->fetch()))
        {
            $HA1 = $appPassword["DIGEST_PASSWORD"];
            $valid_response = md5($HA1 . ':' . $digest['nonce'] . ':' . $HA2);
 
            if ($digest["response"] === $valid_response)
            {
                //application password
                return $appPassword;
            }
        }
        return false;
    }
}