Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
80.95%
17 / 21
50.00%
1 / 2
 CRAP
0.00%
0 / 1
StatusGet
80.95%
17 / 21
50.00%
1 / 2
 6.25
0.00%
0 / 1
 readResponse
73.33%
11 / 15
0.00%
0 / 1
 2.08
 assertStatusAccess
100.00%
6 / 6
100.00%
1 / 1
 4
1<?php
2
3/**
4 * @package ZMS API
5 * @copyright BerlinOnline Stadtportal GmbH & Co. KG
6 **/
7
8namespace BO\Zmsbackend\Status\Api;
9
10use BO\Slim\Render;
11use BO\Zmsbackend\Status\Exception\StatusAuthenticationFailed;
12use BO\Zmsbackend\Status\Service\Status;
13use BO\Zmsentities\Exception\UserAccountMissingLogin;
14use BO\Zmsentities\Exception\UserAccountMissingRights;
15
16class StatusGet extends \BO\Zmsbackend\Api\BaseController
17{
18    /**
19     * @SuppressWarnings(Param)
20     * @return \Psr\Http\Message\ResponseInterface
21     */
22    #[\Override]
23    public function readResponse(
24        \Psr\Http\Message\RequestInterface $request,
25        \Psr\Http\Message\ResponseInterface $response,
26        array $args
27    ) {
28        $this->assertStatusAccess($request);
29
30        $validator = $request->getAttribute('validator');
31        $includeProcessStats = $validator->getParameter('includeProcessStats')->isNumber()->setDefault(1)->getValue();
32        $status = (new \BO\Zmsbackend\Status\Service\Status())->readEntity(\App::$now, $includeProcessStats);
33        $status['version'] = \BO\Zmsbackend\Helper\Version::getArray();
34        if (\App::DEBUG) {
35            $status['opcache'] = [
36                'config' => opcache_get_configuration(),
37                'status' => opcache_get_status(false)
38            ];
39        }
40
41        $message = \BO\Zmsbackend\Api\Response\Message::create($request);
42        $message->data = $status;
43
44        $response = Render::withLastModified($response, time(), '0');
45        $response = Render::withJson($response, $message->setUpdatedMetaData(), $message->getStatuscode());
46        return $response;
47    }
48
49    /**
50     * Allow access with a logged-in workstation (admin UI) or X-Token matching
51     * ZMS_CONFIG_SECURE_TOKEN (Grafana / status-logger). Same idea as ConfigGet,
52     * with strict token comparison and a narrow auth-exception catch.
53     */
54    private function assertStatusAccess(\Psr\Http\Message\RequestInterface $request): void
55    {
56        try {
57            (new \BO\Zmsbackend\Helper\User($request))->checkPermissions();
58            return;
59        } catch (UserAccountMissingLogin | UserAccountMissingRights $exception) {
60            // Fall through to X-Token for scrapers / unauthenticated callers.
61        }
62
63        $token = $request->getHeaderLine('X-Token');
64        if ($token === '' || !hash_equals((string) \App::SECURE_TOKEN, $token)) {
65            throw new StatusAuthenticationFailed();
66        }
67    }
68}