/**
* Creates a signed JWT.
* @param array $payload
* @return string The signed JWT.
*/
private function makeSignedJwt($payload)
{
$header = array('typ' => 'JWT', 'alg' => 'RS256');
$segments = array(Yoast_Google_Utils::urlSafeB64Encode(json_encode($header)), Yoast_Google_Utils::urlSafeB64Encode(json_encode($payload)));
$signingInput = implode('.', $segments);
$signer = new Yoast_Google_P12Signer($this->privateKey, $this->privateKeyPassword);
$signature = $signer->sign($signingInput);
$segments[] = Yoast_Google_Utils::urlSafeB64Encode($signature);
return implode(".", $segments);
}
function verifySignedJwtWithCerts($jwt, $certs, $required_audience)
{
$segments = explode(".", $jwt);
if (count($segments) != 3) {
throw new Yoast_Google_AuthException("Wrong number of segments in token: {$jwt}");
}
$signed = $segments[0] . "." . $segments[1];
$signature = Yoast_Google_Utils::urlSafeB64Decode($segments[2]);
// Parse envelope.
$envelope = json_decode(Yoast_Google_Utils::urlSafeB64Decode($segments[0]), true);
if (!$envelope) {
throw new Yoast_Google_AuthException("Can't parse token envelope: " . $segments[0]);
}
// Parse token
$json_body = Yoast_Google_Utils::urlSafeB64Decode($segments[1]);
$payload = json_decode($json_body, true);
if (!$payload) {
throw new Yoast_Google_AuthException("Can't parse token payload: " . $segments[1]);
}
// Check signature
$verified = false;
foreach ($certs as $keyName => $pem) {
$public_key = new Yoast_Google_PemVerifier($pem);
if ($public_key->verify($signed, $signature)) {
$verified = true;
break;
}
}
if (!$verified) {
throw new Yoast_Google_AuthException("Invalid token signature: {$jwt}");
}
// Check issued-at timestamp
$iat = 0;
if (array_key_exists("iat", $payload)) {
$iat = $payload["iat"];
}
if (!$iat) {
throw new Yoast_Google_AuthException("No issue time in token: {$json_body}");
}
$earliest = $iat - self::CLOCK_SKEW_SECS;
// Check expiration timestamp
$now = time();
$exp = 0;
if (array_key_exists("exp", $payload)) {
$exp = $payload["exp"];
}
if (!$exp) {
throw new Yoast_Google_AuthException("No expiration time in token: {$json_body}");
}
if ($exp >= $now + self::MAX_TOKEN_LIFETIME_SECS) {
throw new Yoast_Google_AuthException("Expiration time too far in future: {$json_body}");
}
$latest = $exp + self::CLOCK_SKEW_SECS;
if ($now < $earliest) {
throw new Yoast_Google_AuthException("Token used too early, {$now} < {$earliest}: {$json_body}");
}
if ($now > $latest) {
throw new Yoast_Google_AuthException("Token used too late, {$now} > {$latest}: {$json_body}");
}
// TODO(beaton): check issuer field?
// Check audience
$aud = $payload["aud"];
if ($aud != $required_audience) {
throw new Yoast_Google_AuthException("Wrong recipient, {$aud} != {$required_audience}: {$json_body}");
}
// All good.
return new Yoast_Google_LoginTicket($envelope, $payload);
}
private function getResumeUri(Yoast_Google_HttpRequest $httpRequest)
{
$result = null;
$body = $httpRequest->getPostBody();
if ($body) {
$httpRequest->setRequestHeaders(array('content-type' => 'application/json; charset=UTF-8', 'content-length' => Yoast_Google_Utils::getStrLen($body), 'x-upload-content-type' => $this->mimeType, 'x-upload-content-length' => $this->size, 'expect' => ''));
}
$response = Yoast_Google_Client::$io->makeRequest($httpRequest);
$location = $response->getResponseHeader('location');
$code = $response->getResponseHttpCode();
if (200 == $code && true == $location) {
return $location;
}
throw new Yoast_Google_Exception("Failed to start the resumable upload");
}
/**
* @param array $headers The HTTP request headers
* to be set and normalized.
*/
public function setRequestHeaders($headers)
{
$headers = Yoast_Google_Utils::normalize($headers);
if ($this->requestHeaders) {
$headers = array_merge($this->requestHeaders, $headers);
}
$this->requestHeaders = $headers;
}
/**
* @param $name
* @param $arguments
* @return Yoast_Google_HttpRequest|array
* @throws Yoast_Google_Exception
*/
public function __call($name, $arguments)
{
if (!isset($this->methods[$name])) {
throw new Yoast_Google_Exception("Unknown function: {$this->serviceName}->{$this->resourceName}->{$name}()");
}
$method = $this->methods[$name];
$parameters = $arguments[0];
// postBody is a special case since it's not defined in the discovery document as parameter, but we abuse the param entry for storing it
$postBody = null;
if (isset($parameters['postBody'])) {
if (is_object($parameters['postBody'])) {
$this->stripNull($parameters['postBody']);
}
// Some APIs require the postBody to be set under the data key.
if (is_array($parameters['postBody']) && 'latitude' == $this->serviceName) {
if (!isset($parameters['postBody']['data'])) {
$rawBody = $parameters['postBody'];
unset($parameters['postBody']);
$parameters['postBody']['data'] = $rawBody;
}
}
$postBody = is_array($parameters['postBody']) || is_object($parameters['postBody']) ? json_encode($parameters['postBody']) : $parameters['postBody'];
unset($parameters['postBody']);
if (isset($parameters['optParams'])) {
$optParams = $parameters['optParams'];
unset($parameters['optParams']);
$parameters = array_merge($parameters, $optParams);
}
}
if (!isset($method['parameters'])) {
$method['parameters'] = array();
}
$method['parameters'] = array_merge($method['parameters'], $this->stackParameters);
foreach ($parameters as $key => $val) {
if ($key != 'postBody' && !isset($method['parameters'][$key])) {
throw new Yoast_Google_Exception("({$name}) unknown parameter: '{$key}'");
}
}
if (isset($method['parameters'])) {
foreach ($method['parameters'] as $paramName => $paramSpec) {
if (isset($paramSpec['required']) && $paramSpec['required'] && !isset($parameters[$paramName])) {
throw new Yoast_Google_Exception("({$name}) missing required param: '{$paramName}'");
}
if (isset($parameters[$paramName])) {
$value = $parameters[$paramName];
$parameters[$paramName] = $paramSpec;
$parameters[$paramName]['value'] = $value;
unset($parameters[$paramName]['required']);
} else {
unset($parameters[$paramName]);
}
}
}
// Discovery v1.0 puts the canonical method id under the 'id' field.
if (!isset($method['id'])) {
$method['id'] = $method['rpcMethod'];
}
// Discovery v1.0 puts the canonical path under the 'path' field.
if (!isset($method['path'])) {
$method['path'] = $method['restPath'];
}
$servicePath = $this->service->servicePath;
// Process Media Request
$contentType = false;
if (isset($method['mediaUpload'])) {
$media = Yoast_Google_MediaFileUpload::process($postBody, $parameters);
if ($media) {
$contentType = isset($media['content-type']) ? $media['content-type'] : null;
$postBody = isset($media['postBody']) ? $media['postBody'] : null;
$servicePath = $method['mediaUpload']['protocols']['simple']['path'];
$method['path'] = '';
}
}
$url = Yoast_Google_REST::createRequestUri($servicePath, $method['path'], $parameters);
$httpRequest = new Yoast_Google_HttpRequest($url, $method['httpMethod'], null, $postBody);
if ($postBody) {
$contentTypeHeader = array();
if (isset($contentType) && $contentType) {
$contentTypeHeader['content-type'] = $contentType;
} else {
$contentTypeHeader['content-type'] = 'application/json; charset=UTF-8';
$contentTypeHeader['content-length'] = Yoast_Google_Utils::getStrLen($postBody);
}
$httpRequest->setRequestHeaders($contentTypeHeader);
}
$httpRequest = Yoast_Google_Client::$auth->sign($httpRequest);
if (Yoast_Google_Client::$useBatch) {
return $httpRequest;
}
// Terminate immediately if this is a resumable request.
if (isset($parameters['uploadType']['value']) && Yoast_Google_MediaFileUpload::UPLOAD_RESUMABLE_TYPE == $parameters['uploadType']['value']) {
$contentTypeHeader = array();
if (isset($contentType) && $contentType) {
$contentTypeHeader['content-type'] = $contentType;
}
$httpRequest->setRequestHeaders($contentTypeHeader);
if ($postBody) {
$httpRequest->setPostBody($postBody);
}
return $httpRequest;
}
return Yoast_Google_REST::execute($httpRequest);
}
