[Security] [LoginLink] Set custom lifetime for login link

mbrodala · mbrodala · commit a99fd449da88 · 2022-06-03T10:38:19.000+02:00
diff --git a/UPGRADE-6.2.md b/UPGRADE-6.2.md
@@ -1,6 +1,11 @@
 UPGRADE FROM 6.1 to 6.2
 =======================
 
+Security
+--------
+
+ * Add `$lifetime` parameter to `LoginLinkHandlerInterface::createLoginLink()`
+
 Validator
 ---------
 
diff --git a/src/Symfony/Bundle/SecurityBundle/LoginLink/FirewallAwareLoginLinkHandler.php b/src/Symfony/Bundle/SecurityBundle/LoginLink/FirewallAwareLoginLinkHandler.php
@@ -38,9 +38,9 @@ public function __construct(FirewallMap $firewallMap, ContainerInterface $loginL
         $this->requestStack = $requestStack;
     }
 
-    public function createLoginLink(UserInterface $user, Request $request = null): LoginLinkDetails
+    public function createLoginLink(UserInterface $user, Request $request = null, int $lifetime = null): LoginLinkDetails
     {
-        return $this->getForFirewall()->createLoginLink($user, $request);
+        return $this->getForFirewall()->createLoginLink($user, $request, $lifetime);
     }
 
     public function consumeLoginLink(Request $request): UserInterface
diff --git a/src/Symfony/Component/Security/Http/CHANGELOG.md b/src/Symfony/Component/Security/Http/CHANGELOG.md
@@ -1,6 +1,12 @@
 CHANGELOG
 =========
 
+6.2
+---
+
+ * Set custom lifetime for login link
+ * Add `$lifetime` parameter to `LoginLinkHandlerInterface::createLoginLink()`
+
 6.0
 ---
 
diff --git a/src/Symfony/Component/Security/Http/LoginLink/LoginLinkHandler.php b/src/Symfony/Component/Security/Http/LoginLink/LoginLinkHandler.php
@@ -44,9 +44,9 @@ public function __construct(UrlGeneratorInterface $urlGenerator, UserProviderInt
         ], $options);
     }
 
-    public function createLoginLink(UserInterface $user, Request $request = null): LoginLinkDetails
+    public function createLoginLink(UserInterface $user, Request $request = null, int $lifetime = null): LoginLinkDetails
     {
-        $expires = time() + $this->options['lifetime'];
+        $expires = time() + ($lifetime ?: $this->options['lifetime']);
         $expiresAt = new \DateTimeImmutable('@'.$expires);
 
         $parameters = [
diff --git a/src/Symfony/Component/Security/Http/LoginLink/LoginLinkHandlerInterface.php b/src/Symfony/Component/Security/Http/LoginLink/LoginLinkHandlerInterface.php
@@ -24,7 +24,7 @@ interface LoginLinkHandlerInterface
     /**
      * Generate a link that can be used to authenticate as the given user.
      */
-    public function createLoginLink(UserInterface $user, Request $request = null): LoginLinkDetails;
+    public function createLoginLink(UserInterface $user, Request $request = null /*, int $lifetime = null */): LoginLinkDetails;
 
     /**
      * Validates if this request contains a login link and returns the associated User.
diff --git a/src/Symfony/Component/Security/Http/Tests/LoginLink/LoginLinkHandlerTest.php b/src/Symfony/Component/Security/Http/Tests/LoginLink/LoginLinkHandlerTest.php
@@ -112,6 +112,38 @@ public function provideCreateLoginLinkData()
         ];
     }
 
+    public function testCreateLoginLinkWithLifetime()
+    {
+        $extraProperties = ['emailProperty' => 'ryan@symfonycasts.com', 'passwordProperty' => 'pwhash'];
+
+        $this->router->expects($this->once())
+            ->method('generate')
+            ->with(
+                'app_check_login_link_route',
+                $this->callback(function ($parameters) use ($extraProperties) {
+                    return 'weaverryan' == $parameters['user']
+                        && isset($parameters['expires'])
+                         // allow a small expiration offset to avoid time-sensitivity
+                        && abs(time() + 1000 - $parameters['expires']) <= 1
+                        && isset($parameters['hash'])
+                        // make sure hash is what we expect
+                        && $parameters['hash'] === $this->createSignatureHash('weaverryan', $parameters['expires'], array_values($extraProperties));
+                }),
+                UrlGeneratorInterface::ABSOLUTE_URL
+            )
+            ->willReturn('https://example.com/login/verify?user=weaverryan&hash=abchash&expires=1654244256');
+
+        $user = new TestLoginLinkHandlerUser('weaverryan', 'ryan@symfonycasts.com', 'pwhash');
+        $lifetime = 1000;
+
+        $loginLink = $this->createLinker([], array_keys($extraProperties))->createLoginLink(
+            user: $user,
+            lifetime: $lifetime,
+        );
+
+        $this->assertSame('https://example.com/login/verify?user=weaverryan&hash=abchash&expires=1654244256', $loginLink->getUrl());
+    }
+
     public function testConsumeLoginLink()
     {
         $expires = time() + 500;

Original file line number	Diff line number	Diff line change
`@@ -38,9 +38,9 @@ public function __construct(FirewallMap $firewallMap, ContainerInterface $loginL`
`38`	`38`	`$this->requestStack = $requestStack;`
`39`	`39`	`}`
`40`	`40`
`41`		`- public function createLoginLink(UserInterface $user, Request $request = null): LoginLinkDetails`
	`41`	`+ public function createLoginLink(UserInterface $user, Request $request = null, int $lifetime = null): LoginLinkDetails`
`42`	`42`	`{`
`43`		`- return $this->getForFirewall()->createLoginLink($user, $request);`
	`43`	`+ return $this->getForFirewall()->createLoginLink($user, $request, $lifetime);`
`44`	`44`	`}`
`45`	`45`
`46`	`46`	`public function consumeLoginLink(Request $request): UserInterface`
Original file line number	Diff line number	Diff line change
`@@ -44,9 +44,9 @@ public function __construct(UrlGeneratorInterface $urlGenerator, UserProviderInt`
`44`	`44`	`], $options);`
`45`	`45`	`}`
`46`	`46`
`47`		`- public function createLoginLink(UserInterface $user, Request $request = null): LoginLinkDetails`
	`47`	`+ public function createLoginLink(UserInterface $user, Request $request = null, int $lifetime = null): LoginLinkDetails`
`48`	`48`	`{`
`49`		`- $expires = time() + $this->options['lifetime'];`
	`49`	`+ $expires = time() + ($lifetime ?: $this->options['lifetime']);`
`50`	`50`	`$expiresAt = new \DateTimeImmutable('@'.$expires);`
`51`	`51`
`52`	`52`	`$parameters = [`