├── composer.json
├── screenshots
    ├── widget.png
    ├── settings_auth.png
    └── settings_not_auth.png
├── .gitignore
├── vendor
    ├── firebase
    │   └── php-jwt
    │   │   ├── src
    │   │       ├── ExpiredException.php
    │   │       ├── BeforeValidException.php
    │   │       ├── SignatureInvalidException.php
    │   │       ├── Key.php
    │   │       ├── CachedKeySet.php
    │   │       ├── JWK.php
    │   │       └── JWT.php
    │   │   ├── composer.json
    │   │   ├── LICENSE
    │   │   ├── CHANGELOG.md
    │   │   └── README.md
    ├── composer
    │   ├── autoload_namespaces.php
    │   ├── autoload_psr4.php
    │   ├── autoload_classmap.php
    │   ├── platform_check.php
    │   ├── LICENSE
    │   ├── autoload_static.php
    │   ├── installed.php
    │   ├── autoload_real.php
    │   ├── installed.json
    │   ├── InstalledVersions.php
    │   └── ClassLoader.php
    └── autoload.php
├── phpunit.xml.dist
├── .github
    └── workflows
    │   └── label-ai-generated-prs.yml
├── test
    ├── ValidatorTest.php
    ├── UserTest.php
    ├── SnippetTest.php
    ├── SnippetSettingsTest.php
    ├── SecureModeCalculatorTest.php
    └── IntercomSettingsPageTest.php
├── .circleci
    └── config.yml
├── readme.md
├── composer.lock
├── readme.txt
└── bootstrap.php


/composer.json:
--------------------------------------------------------------------------------
1 | {
2 |     "require": {
3 |         "firebase/php-jwt": "6.4"
4 |     }
5 | }
6 | 


--------------------------------------------------------------------------------
/screenshots/widget.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/intercom/intercom-wordpress/HEAD/screenshots/widget.png


--------------------------------------------------------------------------------
/screenshots/settings_auth.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/intercom/intercom-wordpress/HEAD/screenshots/settings_auth.png


--------------------------------------------------------------------------------
/screenshots/settings_not_auth.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/intercom/intercom-wordpress/HEAD/screenshots/settings_not_auth.png


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | *.swo
2 | *.swp
3 | intercom-wordpress.zip
4 | .idea
5 | .vscode
6 | .DS_Store
7 | .phpunit.result.cache
8 | .phpunit.cache
9 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/ExpiredException.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | namespace Firebase\JWT;
4 | 
5 | class ExpiredException extends \UnexpectedValueException
6 | {
7 | }
8 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/BeforeValidException.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | namespace Firebase\JWT;
4 | 
5 | class BeforeValidException extends \UnexpectedValueException
6 | {
7 | }
8 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/SignatureInvalidException.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | namespace Firebase\JWT;
4 | 
5 | class SignatureInvalidException extends \UnexpectedValueException
6 | {
7 | }
8 | 


--------------------------------------------------------------------------------
/vendor/composer/autoload_namespaces.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // autoload_namespaces.php @generated by Composer
 4 | 
 5 | $vendorDir = dirname(__DIR__);
 6 | $baseDir = dirname($vendorDir);
 7 | 
 8 | return array(
 9 | );
10 | 


--------------------------------------------------------------------------------
/vendor/composer/autoload_psr4.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // autoload_psr4.php @generated by Composer
 4 | 
 5 | $vendorDir = dirname(__DIR__);
 6 | $baseDir = dirname($vendorDir);
 7 | 
 8 | return array(
 9 |     'Firebase\\JWT\\' => array($vendorDir . '/firebase/php-jwt/src'),
10 | );
11 | 


--------------------------------------------------------------------------------
/phpunit.xml.dist:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | 
 3 | <phpunit bootstrap="./bootstrap.php">
 4 |     <testsuites>
 5 |         <testsuite name="Intercom WordPress Testsuite">
 6 |             <directory>./test</directory>
 7 |         </testsuite>
 8 |     </testsuites>
 9 | </phpunit>
10 | 


--------------------------------------------------------------------------------
/vendor/composer/autoload_classmap.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // autoload_classmap.php @generated by Composer
 4 | 
 5 | $vendorDir = dirname(__DIR__);
 6 | $baseDir = dirname($vendorDir);
 7 | 
 8 | return array(
 9 |     'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
10 | );
11 | 


--------------------------------------------------------------------------------
/.github/workflows/label-ai-generated-prs.yml:
--------------------------------------------------------------------------------
 1 | # .github/workflows/label-ai-generated-prs.yml
 2 | name: Label AI-generated PRs
 3 | 
 4 | on:
 5 |   pull_request:
 6 |     types: [opened, edited, synchronize]   # run when the body changes too
 7 | 
 8 | jobs:
 9 |   call-label-ai-prs:
10 |     uses: intercom/github-action-workflows/.github/workflows/label-ai-prs.yml@main
11 |     secrets: inherit


--------------------------------------------------------------------------------
/test/ValidatorTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | use PHPUnit\Framework\TestCase;
 3 | 
 4 | class ValidatorTest extends TestCase
 5 | {
 6 |   public function testValidator()
 7 |   {
 8 |     // Emulate the WordPress wp_kses function
 9 |     $wp_kses = function($x) {
10 |       return str_replace("<script>", "", $x);
11 |     };
12 |     $validator = new Validator(array("app_id" => "foo<script>"), $wp_kses);
13 |     $this->assertEquals("foo", $validator->validAppId());
14 |   }
15 | }
16 | 


--------------------------------------------------------------------------------
/.circleci/config.yml:
--------------------------------------------------------------------------------
 1 | version: 2.1
 2 | 
 3 | jobs:
 4 |   build-and-test:
 5 |     docker:
 6 |       - image: cimg/php:7.2
 7 |     steps:
 8 |       - checkout
 9 |       - run:
10 |           name: Install PHPUnit
11 |           command: |
12 |             wget https://phar.phpunit.de/phpunit-8.5.33.phar
13 |       - run:
14 |           name: Make PHPUnit executable
15 |           command: |
16 |             chmod +x ./phpunit-8.5.33.phar
17 |       - run:
18 |           name: Run PHPUnit
19 |           command: |
20 |             INTERCOM_PLUGIN_TEST=1 php ./phpunit-8.5.33.phar
21 | 
22 | workflows:
23 |   sample:
24 |     jobs:
25 |       - build-and-test
26 | 


--------------------------------------------------------------------------------
/vendor/autoload.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // autoload.php @generated by Composer
 4 | 
 5 | if (PHP_VERSION_ID < 50600) {
 6 |     if (!headers_sent()) {
 7 |         header('HTTP/1.1 500 Internal Server Error');
 8 |     }
 9 |     $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
10 |     if (!ini_get('display_errors')) {
11 |         if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
12 |             fwrite(STDERR, $err);
13 |         } elseif (!headers_sent()) {
14 |             echo $err;
15 |         }
16 |     }
17 |     throw new RuntimeException($err);
18 | }
19 | 
20 | require_once __DIR__ . '/composer/autoload_real.php';
21 | 
22 | return ComposerAutoloaderInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8::getLoader();
23 | 


--------------------------------------------------------------------------------
/vendor/composer/platform_check.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // platform_check.php @generated by Composer
 4 | 
 5 | $issues = array();
 6 | 
 7 | if (!(PHP_VERSION_ID >= 70100)) {
 8 |     $issues[] = 'Your Composer dependencies require a PHP version ">= 7.1.0". You are running ' . PHP_VERSION . '.';
 9 | }
10 | 
11 | if ($issues) {
12 |     if (!headers_sent()) {
13 |         header('HTTP/1.1 500 Internal Server Error');
14 |     }
15 |     if (!ini_get('display_errors')) {
16 |         if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
17 |             fwrite(STDERR, 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . implode(PHP_EOL, $issues) . PHP_EOL.PHP_EOL);
18 |         } elseif (!headers_sent()) {
19 |             echo 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . str_replace('You are running '.PHP_VERSION.'.', '', implode(PHP_EOL, $issues)) . PHP_EOL.PHP_EOL;
20 |         }
21 |     }
22 |     trigger_error(
23 |         'Composer detected issues in your platform: ' . implode(' ', $issues),
24 |         E_USER_ERROR
25 |     );
26 | }
27 | 


--------------------------------------------------------------------------------
/test/UserTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | class FakeWordPressUser
 3 | {
 4 |   public $user_email = "foo@bar.com";
 5 | }
 6 | class FakeWordPressUserNoEmail
 7 | {
 8 |   public $user_email = NULL;
 9 | }
10 | 
11 | use PHPUnit\Framework\TestCase;
12 | 
13 | class UserTest extends TestCase
14 | {
15 |   public function testEmail()
16 |   {
17 |     $settings = array();
18 |     $user = new IntercomUser(new FakeWordPressUser(), $settings);
19 |     $built_settings = $user->buildSettings();
20 |     $this->assertEquals("foo@bar.com", $built_settings["email"]);
21 |   }
22 |   public function testNoUser()
23 |   {
24 |     $settings = array();
25 |     $user = new IntercomUser(NULL, $settings);
26 |     $built_settings = $user->buildSettings();
27 |     $this->assertEquals(false, array_key_exists('email', $built_settings));
28 |   }
29 |   public function testNoUserEmail()
30 |   {
31 |     $settings = array();
32 |     $user = new IntercomUser(new FakeWordPressUserNoEmail(), $settings);
33 |     $built_settings = $user->buildSettings();
34 |     $this->assertEquals(false, array_key_exists('email', $built_settings));
35 |   }
36 | }
37 | 


--------------------------------------------------------------------------------
/vendor/composer/LICENSE:
--------------------------------------------------------------------------------
 1 | 
 2 | Copyright (c) Nils Adermann, Jordi Boggiano
 3 | 
 4 | Permission is hereby granted, free of charge, to any person obtaining a copy
 5 | of this software and associated documentation files (the "Software"), to deal
 6 | in the Software without restriction, including without limitation the rights
 7 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 8 | copies of the Software, and to permit persons to whom the Software is furnished
 9 | to do so, subject to the following conditions:
10 | 
11 | The above copyright notice and this permission notice shall be included in all
12 | copies or substantial portions of the Software.
13 | 
14 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
19 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
20 | THE SOFTWARE.
21 | 
22 | 


--------------------------------------------------------------------------------
/vendor/composer/autoload_static.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // autoload_static.php @generated by Composer
 4 | 
 5 | namespace Composer\Autoload;
 6 | 
 7 | class ComposerStaticInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8
 8 | {
 9 |     public static $prefixLengthsPsr4 = array (
10 |         'F' => 
11 |         array (
12 |             'Firebase\\JWT\\' => 13,
13 |         ),
14 |     );
15 | 
16 |     public static $prefixDirsPsr4 = array (
17 |         'Firebase\\JWT\\' => 
18 |         array (
19 |             0 => __DIR__ . '/..' . '/firebase/php-jwt/src',
20 |         ),
21 |     );
22 | 
23 |     public static $classMap = array (
24 |         'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
25 |     );
26 | 
27 |     public static function getInitializer(ClassLoader $loader)
28 |     {
29 |         return \Closure::bind(function () use ($loader) {
30 |             $loader->prefixLengthsPsr4 = ComposerStaticInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8::$prefixLengthsPsr4;
31 |             $loader->prefixDirsPsr4 = ComposerStaticInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8::$prefixDirsPsr4;
32 |             $loader->classMap = ComposerStaticInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8::$classMap;
33 | 
34 |         }, null, ClassLoader::class);
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/vendor/composer/installed.php:
--------------------------------------------------------------------------------
 1 | <?php return array(
 2 |     'root' => array(
 3 |         'name' => '__root__',
 4 |         'pretty_version' => 'dev-master',
 5 |         'version' => 'dev-master',
 6 |         'reference' => '83546b6b163cdeb37542f3a5ad5e3a8042c4886f',
 7 |         'type' => 'library',
 8 |         'install_path' => __DIR__ . '/../../',
 9 |         'aliases' => array(),
10 |         'dev' => true,
11 |     ),
12 |     'versions' => array(
13 |         '__root__' => array(
14 |             'pretty_version' => 'dev-master',
15 |             'version' => 'dev-master',
16 |             'reference' => '83546b6b163cdeb37542f3a5ad5e3a8042c4886f',
17 |             'type' => 'library',
18 |             'install_path' => __DIR__ . '/../../',
19 |             'aliases' => array(),
20 |             'dev_requirement' => false,
21 |         ),
22 |         'firebase/php-jwt' => array(
23 |             'pretty_version' => 'v6.4.0',
24 |             'version' => '6.4.0.0',
25 |             'reference' => '4dd1e007f22a927ac77da5a3fbb067b42d3bc224',
26 |             'type' => 'library',
27 |             'install_path' => __DIR__ . '/../firebase/php-jwt',
28 |             'aliases' => array(),
29 |             'dev_requirement' => false,
30 |         ),
31 |     ),
32 | );
33 | 


--------------------------------------------------------------------------------
/vendor/composer/autoload_real.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | // autoload_real.php @generated by Composer
 4 | 
 5 | class ComposerAutoloaderInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8
 6 | {
 7 |     private static $loader;
 8 | 
 9 |     public static function loadClassLoader($class)
10 |     {
11 |         if ('Composer\Autoload\ClassLoader' === $class) {
12 |             require __DIR__ . '/ClassLoader.php';
13 |         }
14 |     }
15 | 
16 |     /**
17 |      * @return \Composer\Autoload\ClassLoader
18 |      */
19 |     public static function getLoader()
20 |     {
21 |         if (null !== self::$loader) {
22 |             return self::$loader;
23 |         }
24 | 
25 |         require __DIR__ . '/platform_check.php';
26 | 
27 |         spl_autoload_register(array('ComposerAutoloaderInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8', 'loadClassLoader'), true, true);
28 |         self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
29 |         spl_autoload_unregister(array('ComposerAutoloaderInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8', 'loadClassLoader'));
30 | 
31 |         require __DIR__ . '/autoload_static.php';
32 |         call_user_func(\Composer\Autoload\ComposerStaticInitf0ba7c25cd025ed8dd9b1c80e1eb2ef8::getInitializer($loader));
33 | 
34 |         $loader->register(true);
35 | 
36 |         return $loader;
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name": "firebase/php-jwt",
 3 |     "description": "A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.",
 4 |     "homepage": "https://github.com/firebase/php-jwt",
 5 |     "keywords": [
 6 |         "php",
 7 |         "jwt"
 8 |     ],
 9 |     "authors": [
10 |         {
11 |             "name": "Neuman Vong",
12 |             "email": "neuman+pear@twilio.com",
13 |             "role": "Developer"
14 |         },
15 |         {
16 |             "name": "Anant Narayanan",
17 |             "email": "anant@php.net",
18 |             "role": "Developer"
19 |         }
20 |     ],
21 |     "license": "BSD-3-Clause",
22 |     "require": {
23 |         "php": "^7.1||^8.0"
24 |     },
25 |     "suggest": {
26 |         "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present",
27 |         "ext-sodium": "Support EdDSA (Ed25519) signatures"
28 |     },
29 |     "autoload": {
30 |         "psr-4": {
31 |             "Firebase\\JWT\\": "src"
32 |         }
33 |     },
34 |     "require-dev": {
35 |         "guzzlehttp/guzzle": "^6.5||^7.4",
36 |         "phpspec/prophecy-phpunit": "^1.1",
37 |         "phpunit/phpunit": "^7.5||^9.5",
38 |         "psr/cache": "^1.0||^2.0",
39 |         "psr/http-client": "^1.0",
40 |         "psr/http-factory": "^1.0"
41 |     }
42 | }
43 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/LICENSE:
--------------------------------------------------------------------------------
 1 | Copyright (c) 2011, Neuman Vong
 2 | 
 3 | All rights reserved.
 4 | 
 5 | Redistribution and use in source and binary forms, with or without
 6 | modification, are permitted provided that the following conditions are met:
 7 | 
 8 |     * Redistributions of source code must retain the above copyright
 9 |       notice, this list of conditions and the following disclaimer.
10 | 
11 |     * Redistributions in binary form must reproduce the above
12 |       copyright notice, this list of conditions and the following
13 |       disclaimer in the documentation and/or other materials provided
14 |       with the distribution.
15 | 
16 |     * Neither the name of the copyright holder nor the names of other
17 |       contributors may be used to endorse or promote products derived
18 |       from this software without specific prior written permission.
19 | 
20 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 | "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23 | A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24 | OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25 | SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26 | LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 | DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 | THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 | 


--------------------------------------------------------------------------------
/test/SnippetTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | use PHPUnit\Framework\TestCase;
 3 | 
 4 | class IntercomSnippetTest extends TestCase
 5 | {
 6 |   public function testGeneratedHtml()
 7 |   {
 8 |     $settings = new IntercomSnippetSettings(array("app_id" => "foo", "name" => "Nikola Tesla"), NULL, NULL, array());
 9 |     $snippet = new IntercomSnippet($settings);
10 | 
11 |     $expectedHtml = <<<HTML
12 | <script data-cfasync="false">
13 |   document.onreadystatechange = function () {
14 |     if (document.readyState == "complete") {
15 |       var logout_link = document.querySelectorAll('a[href*="wp-login.php?action=logout"]');
16 |       if (logout_link) {
17 |         for(var i=0; i < logout_link.length; i++) {
18 |           logout_link[i].addEventListener( "click", function() {
19 |             Intercom('shutdown');
20 |           });
21 |         }
22 |       }
23 |     }
24 |   };
25 | </script>
26 | <script data-cfasync="false">
27 |   window.intercomSettings = {"app_id":"foo","name":"Nikola Tesla","installation_type":"wordpress","installation_version":"3.0.2"};
28 | </script>
29 | <script data-cfasync="false">(function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',w.intercomSettings);}else{var d=document;var i=function(){i.c(arguments);};i.q=[];i.c=function(args){i.q.push(args);};w.Intercom=i;var l=function(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='https://widget.intercom.io/widget/foo';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s, x);};if(document.readyState==='complete'){l();}else if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}}})()</script>
30 | HTML;
31 | 
32 |     $this->assertEquals($expectedHtml, $snippet->html());
33 |   }
34 | }
35 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/Key.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | namespace Firebase\JWT;
 4 | 
 5 | use InvalidArgumentException;
 6 | use OpenSSLAsymmetricKey;
 7 | use OpenSSLCertificate;
 8 | use TypeError;
 9 | 
10 | class Key
11 | {
12 |     /** @var string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate */
13 |     private $keyMaterial;
14 |     /** @var string */
15 |     private $algorithm;
16 | 
17 |     /**
18 |      * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate $keyMaterial
19 |      * @param string $algorithm
20 |      */
21 |     public function __construct(
22 |         $keyMaterial,
23 |         string $algorithm
24 |     ) {
25 |         if (
26 |             !\is_string($keyMaterial)
27 |             && !$keyMaterial instanceof OpenSSLAsymmetricKey
28 |             && !$keyMaterial instanceof OpenSSLCertificate
29 |             && !\is_resource($keyMaterial)
30 |         ) {
31 |             throw new TypeError('Key material must be a string, resource, or OpenSSLAsymmetricKey');
32 |         }
33 | 
34 |         if (empty($keyMaterial)) {
35 |             throw new InvalidArgumentException('Key material must not be empty');
36 |         }
37 | 
38 |         if (empty($algorithm)) {
39 |             throw new InvalidArgumentException('Algorithm must not be empty');
40 |         }
41 | 
42 |         // TODO: Remove in PHP 8.0 in favor of class constructor property promotion
43 |         $this->keyMaterial = $keyMaterial;
44 |         $this->algorithm = $algorithm;
45 |     }
46 | 
47 |     /**
48 |      * Return the algorithm valid for this key
49 |      *
50 |      * @return string
51 |      */
52 |     public function getAlgorithm(): string
53 |     {
54 |         return $this->algorithm;
55 |     }
56 | 
57 |     /**
58 |      * @return string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate
59 |      */
60 |     public function getKeyMaterial()
61 |     {
62 |         return $this->keyMaterial;
63 |     }
64 | }
65 | 


--------------------------------------------------------------------------------
/readme.md:
--------------------------------------------------------------------------------
 1 | # Intercom / WordPress
 2 | 
 3 | [![Build Status](https://travis-ci.org/intercom/intercom-wordpress.svg?branch=master)](https://travis-ci.org/intercom/intercom-wordpress)
 4 | 
 5 | # Compatibility
 6 | 
 7 | Requires PHP 7.2 or higher.
 8 | 
 9 | # Local Testing
10 | 
11 | Running tests requires [phpunit](https://phpunit.de/).
12 | 
13 | ```php
14 | INTERCOM_PLUGIN_TEST=1 phpunit
15 | ```
16 | 
17 | # Usage
18 | 
19 | Installing this plugin provides a new Intercom settings page.
20 | Authenticate with Intercom to retrieve your app_id and Identity Verification secret.
21 | <img src="https://raw.githubusercontent.com/intercom/intercom-wordpress/master/screenshots/settings_not_auth.png"/>
22 | 
23 | Once authenticated, the Intercom widget will automatically appear on your site.
24 | 
25 | <img src="https://raw.githubusercontent.com/intercom/intercom-wordpress/master/screenshots/settings_auth.png"/>
26 | 
27 | NB: This plugin injects a Javascript snippet on your website frontend containing dynamic user data. Some caching solutions will cache entire pages and should not be used with this plugin. Doing so may cause conversations to be delivered to the wrong user.
28 | 
29 | # Pass custom data attributes to the Intercom Messenger
30 | 
31 | Using the [add_filter](https://developer.wordpress.org/reference/functions/add_filter) method in your WordPress theme or custom plugin you can pass [custom data attributes](https://www.intercom.com/help/en/articles/179-create-and-track-custom-data-attributes-cdas) to the Intercom Messenger (see example below):
32 | 
33 | ```php
34 | add_filter( 'intercom_settings', function( $settings ) {
35 |   $settings['customer_type'] = $customer_type;
36 |   return $settings;
37 | } );
38 | ```
39 | 
40 | 
41 | # Users
42 | 
43 | If a `$current_user` is present, we use their email and ID as an identifier in the widget.
44 | We recommend enabling [Identity Verification](https://docs.intercom.com/configure-intercom-for-your-product-or-site/staying-secure/enable-identity-verification-on-your-web-product) in the settings page.
45 | 
46 | # Contributing
47 | 
48 | * Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet.
49 | * Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it.
50 | * Fork the project.
51 | * Start a feature/bugfix branch.
52 | * Commit and push until you are happy with your contribution.
53 | * Make sure to add tests for it. This is important so we don't break it in a future version unintentionally.
54 | 


--------------------------------------------------------------------------------
/vendor/composer/installed.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "packages": [
 3 |         {
 4 |             "name": "firebase/php-jwt",
 5 |             "version": "v6.4.0",
 6 |             "version_normalized": "6.4.0.0",
 7 |             "source": {
 8 |                 "type": "git",
 9 |                 "url": "https://github.com/firebase/php-jwt.git",
10 |                 "reference": "4dd1e007f22a927ac77da5a3fbb067b42d3bc224"
11 |             },
12 |             "dist": {
13 |                 "type": "zip",
14 |                 "url": "https://api.github.com/repos/firebase/php-jwt/zipball/4dd1e007f22a927ac77da5a3fbb067b42d3bc224",
15 |                 "reference": "4dd1e007f22a927ac77da5a3fbb067b42d3bc224",
16 |                 "shasum": ""
17 |             },
18 |             "require": {
19 |                 "php": "^7.1||^8.0"
20 |             },
21 |             "require-dev": {
22 |                 "guzzlehttp/guzzle": "^6.5||^7.4",
23 |                 "phpspec/prophecy-phpunit": "^1.1",
24 |                 "phpunit/phpunit": "^7.5||^9.5",
25 |                 "psr/cache": "^1.0||^2.0",
26 |                 "psr/http-client": "^1.0",
27 |                 "psr/http-factory": "^1.0"
28 |             },
29 |             "suggest": {
30 |                 "ext-sodium": "Support EdDSA (Ed25519) signatures",
31 |                 "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present"
32 |             },
33 |             "time": "2023-02-09T21:01:23+00:00",
34 |             "type": "library",
35 |             "installation-source": "dist",
36 |             "autoload": {
37 |                 "psr-4": {
38 |                     "Firebase\\JWT\\": "src"
39 |                 }
40 |             },
41 |             "notification-url": "https://packagist.org/downloads/",
42 |             "license": [
43 |                 "BSD-3-Clause"
44 |             ],
45 |             "authors": [
46 |                 {
47 |                     "name": "Neuman Vong",
48 |                     "email": "neuman+pear@twilio.com",
49 |                     "role": "Developer"
50 |                 },
51 |                 {
52 |                     "name": "Anant Narayanan",
53 |                     "email": "anant@php.net",
54 |                     "role": "Developer"
55 |                 }
56 |             ],
57 |             "description": "A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.",
58 |             "homepage": "https://github.com/firebase/php-jwt",
59 |             "keywords": [
60 |                 "jwt",
61 |                 "php"
62 |             ],
63 |             "support": {
64 |                 "issues": "https://github.com/firebase/php-jwt/issues",
65 |                 "source": "https://github.com/firebase/php-jwt/tree/v6.4.0"
66 |             },
67 |             "install-path": "../firebase/php-jwt"
68 |         }
69 |     ],
70 |     "dev": true,
71 |     "dev-package-names": []
72 | }
73 | 


--------------------------------------------------------------------------------
/test/SnippetSettingsTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | class FakeWordPressUserForSnippetTest
 3 | {
 4 |   public $user_email = "foo@bar.com";
 5 | }
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use PHPUnit\Framework\MockObject\MockObject;
 9 | use Firebase\JWT\JWT;
10 | 
11 | class IntercomSnippetSettingsTest extends TestCase
12 | {
13 |   protected function setUp(): void
14 |   {
15 |     parent::setUp();
16 |     // Freeze time to a specific timestamp
17 |     TimeProvider::setMockTime(strtotime('2024-04-08 12:00:00'));
18 |   }
19 | 
20 |   protected function tearDown(): void
21 |   {
22 |     TimeProvider::resetMockTime();
23 |     parent::tearDown();
24 |   }
25 | 
26 |   public function testJSONRendering()
27 |   {
28 |     $snippet_settings = new IntercomSnippetSettings(array("app_id" => "bar"));
29 |     $this->assertEquals("{\"app_id\":\"bar\",\"installation_type\":\"wordpress\",\"installation_version\":\"" . INTERCOM_PLUGIN_VERSION . "\"}", $snippet_settings->json());
30 |   }
31 |   public function testJSONRenderingWithIdentityVerification()
32 |   {
33 |     $snippet_settings = new IntercomSnippetSettings(array("app_id" => "bar"), "s3cre7", new FakeWordPressUserForSnippetTest());
34 |     $jwt_data = array(
35 |       "user_id" => "foo@bar.com",
36 |       "email" => "foo@bar.com",
37 |       "exp" => TimeProvider::getCurrentTime() + 3600
38 |     );
39 |     $jwt = JWT::encode($jwt_data, "s3cre7", 'HS256'); 
40 |     $this->assertEquals('{"app_id":"bar","intercom_user_jwt":"'.$jwt.'","installation_type":"wordpress","installation_version":"' . INTERCOM_PLUGIN_VERSION . '"}', $snippet_settings->json());
41 |   }
42 |   public function testJSONRenderingWithIdentityVerificationAndNoSecret()
43 |   {
44 |     $snippet_settings = new IntercomSnippetSettings(array("app_id" => "bar"), NULL, new FakeWordPressUserForSnippetTest());
45 |     $this->assertEquals("{\"app_id\":\"bar\",\"email\":\"foo@bar.com\",\"installation_type\":\"wordpress\",\"installation_version\":\"" . INTERCOM_PLUGIN_VERSION . "\"}", $snippet_settings->json());
46 |   }
47 |   public function testInstallationType()
48 |   {
49 |     $snippet_settings = new IntercomSnippetSettings(array("app_id" => "bar"));
50 |     $this->assertEquals("{\"app_id\":\"bar\",\"installation_type\":\"wordpress\",\"installation_version\":\"" . INTERCOM_PLUGIN_VERSION . "\"}", $snippet_settings->json());
51 |   }
52 |   public function testIclLanguageConstant()
53 |   {
54 |     define('ICL_LANGUAGE_CODE', 'fr');
55 |     $snippet_settings = new IntercomSnippetSettings(array("app_id" => "bar"));
56 |     $this->assertEquals("{\"app_id\":\"bar\",\"language_override\":\"fr\",\"installation_type\":\"wordpress\",\"installation_version\":\"" . INTERCOM_PLUGIN_VERSION . "\"}", $snippet_settings->json());
57 |   }
58 | 
59 |   public function testAppId()
60 |   {
61 |     $snippet_settings = new IntercomSnippetSettings(array("app_id" => "bar"));
62 |     $this->assertEquals("bar", $snippet_settings->appId());
63 |   }
64 | 
65 |   public function testValidation()
66 |   {
67 |     $this->expectException(\Exception::class);
68 |     $snippet = new IntercomSnippetSettings(array("foo" => "bar"));
69 |   }
70 | }
71 | 


--------------------------------------------------------------------------------
/composer.lock:
--------------------------------------------------------------------------------
 1 | {
 2 |     "_readme": [
 3 |         "This file locks the dependencies of your project to a known state",
 4 |         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
 5 |         "This file is @generated automatically"
 6 |     ],
 7 |     "content-hash": "f0ba7c25cd025ed8dd9b1c80e1eb2ef8",
 8 |     "packages": [
 9 |         {
10 |             "name": "firebase/php-jwt",
11 |             "version": "v6.4.0",
12 |             "source": {
13 |                 "type": "git",
14 |                 "url": "https://github.com/firebase/php-jwt.git",
15 |                 "reference": "4dd1e007f22a927ac77da5a3fbb067b42d3bc224"
16 |             },
17 |             "dist": {
18 |                 "type": "zip",
19 |                 "url": "https://api.github.com/repos/firebase/php-jwt/zipball/4dd1e007f22a927ac77da5a3fbb067b42d3bc224",
20 |                 "reference": "4dd1e007f22a927ac77da5a3fbb067b42d3bc224",
21 |                 "shasum": ""
22 |             },
23 |             "require": {
24 |                 "php": "^7.1||^8.0"
25 |             },
26 |             "require-dev": {
27 |                 "guzzlehttp/guzzle": "^6.5||^7.4",
28 |                 "phpspec/prophecy-phpunit": "^1.1",
29 |                 "phpunit/phpunit": "^7.5||^9.5",
30 |                 "psr/cache": "^1.0||^2.0",
31 |                 "psr/http-client": "^1.0",
32 |                 "psr/http-factory": "^1.0"
33 |             },
34 |             "suggest": {
35 |                 "ext-sodium": "Support EdDSA (Ed25519) signatures",
36 |                 "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present"
37 |             },
38 |             "type": "library",
39 |             "autoload": {
40 |                 "psr-4": {
41 |                     "Firebase\\JWT\\": "src"
42 |                 }
43 |             },
44 |             "notification-url": "https://packagist.org/downloads/",
45 |             "license": [
46 |                 "BSD-3-Clause"
47 |             ],
48 |             "authors": [
49 |                 {
50 |                     "name": "Neuman Vong",
51 |                     "email": "neuman+pear@twilio.com",
52 |                     "role": "Developer"
53 |                 },
54 |                 {
55 |                     "name": "Anant Narayanan",
56 |                     "email": "anant@php.net",
57 |                     "role": "Developer"
58 |                 }
59 |             ],
60 |             "description": "A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.",
61 |             "homepage": "https://github.com/firebase/php-jwt",
62 |             "keywords": [
63 |                 "jwt",
64 |                 "php"
65 |             ],
66 |             "support": {
67 |                 "issues": "https://github.com/firebase/php-jwt/issues",
68 |                 "source": "https://github.com/firebase/php-jwt/tree/v6.4.0"
69 |             },
70 |             "time": "2023-02-09T21:01:23+00:00"
71 |         }
72 |     ],
73 |     "packages-dev": [],
74 |     "aliases": [],
75 |     "minimum-stability": "stable",
76 |     "stability-flags": {},
77 |     "prefer-stable": false,
78 |     "prefer-lowest": false,
79 |     "platform": {},
80 |     "platform-dev": {},
81 |     "plugin-api-version": "2.6.0"
82 | }
83 | 


--------------------------------------------------------------------------------
/readme.txt:
--------------------------------------------------------------------------------
 1 | === Intercom ===
 2 | Contributors: bobintercom, jacopointercom
 3 | Tags: intercom, ai, customer, chat
 4 | Requires at least: 4.7.0
 5 | Tested up to: 6.7.2
 6 | Requires PHP: 7.2
 7 | License: Apache 2.0
 8 | Stable tag: 3.0.2
 9 | 
10 | Official Intercom WordPress plugin: Engage visitors in real time, power growth with AI, and convert leads into loyal customers.
11 | 
12 | == Description ==
13 | 
14 | [Intercom](https://www.intercom.com/) is a next-generation customer communications platform that combines powerful live chat, proactive messaging, and advanced AI solutions — like our Fin AI chatbot — to help businesses instantly connect with customers.
15 | 
16 | By installing the Intercom WordPress plugin, you can seamlessly add the Messenger to your site, track both logged-in users and visitors, and engage them right away. With Intercom’s industry-leading AI at your fingertips, you’ll deliver fast, personalized support and drive growth more effectively than ever before.
17 | 
18 | == Installation ==
19 | 
20 | Installing Intercom on your WordPress site takes just a few minutes.
21 | 
22 | You can find full instructions on signing up and installing Intercom using the WordPress plugin [here](https://www.intercom.com/help/en/articles/173-install-intercom-on-your-wordpress-site).
23 | 
24 | If you’re already an Intercom customer, you can also find instructions in the in-app [setup guide](https://app.intercom.com/a/apps/_/platform/guide) or [app store](https://app.intercom.com/a/apps/_/appstore?app_package_code=wordpress&search=wordpress).
25 | 
26 | The first thing you’ll need to do is install and activate the plugin - you must be using WordPress v4.9.0 or higher and have the ability to install plugins in order to use this method.
27 | 
28 | Note: This plugin injects a Javascript snippet on your website frontend containing dynamic user data. Some caching solutions will cache entire pages and should not be used with this plugin. Doing so may cause conversations to be delivered to the wrong user.
29 | 
30 | == Screenshots ==
31 | 1. Plugin settings authenticate with Intercom settings_not_auth.png
32 | 2. Plugin settings successfully authenticated with Intercom settings_auth.png
33 | 3. Intercom widget used by customers to communicate with the business widget.png
34 | == Changelog ==
35 | = 3.0.2 =
36 | 
37 | https://github.com/intercom/intercom-wordpress/pull/131
38 | * Updated version attribute to avoid it getting sent in the user data.
39 | 
40 | = 3.0.1 =
41 | 
42 | https://github.com/intercom/intercom-wordpress/pull/130
43 | * Added version tracking to help Intercom provide better support by identifying which plugin version is in use.
44 | 
45 | https://github.com/intercom/intercom-wordpress/pull/88
46 | * Loads Intercom messenger last to ensure JQuery is present. 
47 | 
48 | = 3.0.0 =
49 | 
50 | https://github.com/intercom/intercom-wordpress/pull/127
51 | * Replaced user_hash with intercom_user_jwt https://www.intercom.com/help/en/articles/10589769-authenticating-users-in-the-messenger-with-json-web-tokens-jwts.
52 | * Updated readme to follow guidelines.
53 | * Added missing tests.
54 | 
55 | == Upgrade Notice ==
56 | = 3.0.1 =
57 | Updated version attribute name to avoid setting it as part of user data.
58 | 
59 | = 3.0.1 =
60 | Help Intercom provide better support by sharing the plugin version is in use.
61 | 
62 | = 3.0.0 =
63 | Upgrade the security of your messenger with the introduction of JWT - https://www.intercom.com/help/en/articles/10589769-authenticating-users-in-the-messenger-with-json-web-tokens-jwts
64 | 


--------------------------------------------------------------------------------
/test/SecureModeCalculatorTest.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | use PHPUnit\Framework\TestCase;
  4 | use Firebase\JWT\JWT;
  5 | 
  6 | class MessengerSecurityCalculatorTest extends TestCase
  7 | {
  8 |   protected function setUp(): void
  9 |   {
 10 |     parent::setUp();
 11 |     // Freeze time to a specific timestamp
 12 |     TimeProvider::setMockTime(strtotime('2024-04-08 12:00:00'));
 13 |   }
 14 | 
 15 |   protected function tearDown(): void
 16 |   {
 17 |     TimeProvider::resetMockTime();
 18 |     parent::tearDown();
 19 |   }
 20 | 
 21 |   public function testEmailJWT()
 22 |   {
 23 |     $data = array("app_id" => "abcdef", "email" => "test@intercom.io");
 24 |     $calculator = new MessengerSecurityCalculator($data, "s3cre7");
 25 |     $jwt_data = array(
 26 |       "user_id" => "test@intercom.io",
 27 |       "email" => "test@intercom.io",
 28 |       "exp" => TimeProvider::getCurrentTime() + 3600
 29 |     );
 30 |     $jwt = JWT::encode($jwt_data, "s3cre7", 'HS256');
 31 |     $this->assertEquals(
 32 |       array(
 33 |         "app_id" => "abcdef",
 34 |         "intercom_user_jwt" => $jwt
 35 |       ),
 36 |       $calculator->messengerSecurityComponent()
 37 |     );
 38 |   }
 39 | 
 40 |   public function testUserIdEmailJWT()
 41 |   {
 42 |     $data = array("app_id" => "abcdef", "user_id" => "abcdef", "email" => "test@intercom.io");
 43 |     $calculator = new MessengerSecurityCalculator($data, "s3cre7");
 44 |     $jwt_data = array(
 45 |       "user_id" => "abcdef",
 46 |       "email" => "test@intercom.io",
 47 |       "exp" => TimeProvider::getCurrentTime() + 3600
 48 |     );
 49 |     $jwt = JWT::encode($jwt_data, "s3cre7", 'HS256');
 50 |     $this->assertEquals(
 51 |       array(
 52 |         "app_id" => "abcdef",
 53 |         "intercom_user_jwt" => $jwt
 54 |       ),
 55 |       $calculator->messengerSecurityComponent()
 56 |     );
 57 |   }
 58 | 
 59 |   public function testUserIdEmailNameJWT()
 60 |   {
 61 |     $data = array("app_id" => "abcdef", "user_id" => "abcdef", "email" => "test@intercom.io", "name" => "John Doe");
 62 |     $calculator = new MessengerSecurityCalculator($data, "s3cre7");
 63 |     $jwt_data = array(
 64 |       "user_id" => "abcdef",
 65 |       "email" => "test@intercom.io",
 66 |       "name" => "John Doe",
 67 |       "exp" => TimeProvider::getCurrentTime() + 3600
 68 |     );
 69 |     $jwt = JWT::encode($jwt_data, "s3cre7", 'HS256');
 70 |     $this->assertEquals(
 71 |       array(
 72 |         "app_id" => "abcdef",
 73 |         "intercom_user_jwt" => $jwt
 74 |       ),
 75 |       $calculator->messengerSecurityComponent()
 76 |     );
 77 |   }
 78 | 
 79 |   public function testEmpty()
 80 |   {
 81 |     $data = array("app_id" => "abcdef");
 82 |     $calculator = new MessengerSecurityCalculator($data, "s3cre7");
 83 |     $this->assertEquals(
 84 |       array(
 85 |         "app_id" => "abcdef",
 86 |       ),
 87 |       $calculator->messengerSecurityComponent()
 88 |     );
 89 |   }
 90 | 
 91 |   public function testExtraJWTData()
 92 |   {
 93 |     putenv('INTERCOM_PLUGIN_TEST_JWT_DATA=' . json_encode(array("custom_data" => "custom_value")));
 94 | 
 95 |     $data = array("app_id" => "abcdef", "user_id" => "abcdef", "email" => "test@intercom.io", "name" => "John Doe");
 96 |     $calculator = new MessengerSecurityCalculator($data, "s3cre7");
 97 |     $jwt_data = array(
 98 |       "user_id" => "abcdef",
 99 |       "email" => "test@intercom.io",
100 |       "name" => "John Doe",
101 |       "custom_data" => "custom_value",
102 |       "exp" => TimeProvider::getCurrentTime() + 3600
103 |     );
104 |     $jwt = JWT::encode($jwt_data, "s3cre7", 'HS256');
105 |     $this->assertEquals(
106 |       array(
107 |         "app_id" => "abcdef",
108 |         "intercom_user_jwt" => $jwt
109 |       ),
110 |       $calculator->messengerSecurityComponent()
111 |     );
112 |     putenv('INTERCOM_PLUGIN_TEST_JWT_DATA=');
113 |   }
114 | }
115 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/CHANGELOG.md:
--------------------------------------------------------------------------------
  1 | # Changelog
  2 | 
  3 | ## [6.4.0](https://github.com/firebase/php-jwt/compare/v6.3.2...v6.4.0) (2023-02-08)
  4 | 
  5 | 
  6 | ### Features
  7 | 
  8 | * add support for W3C ES256K ([#462](https://github.com/firebase/php-jwt/issues/462)) ([213924f](https://github.com/firebase/php-jwt/commit/213924f51936291fbbca99158b11bd4ae56c2c95))
  9 | * improve caching by only decoding jwks when necessary ([#486](https://github.com/firebase/php-jwt/issues/486)) ([78d3ed1](https://github.com/firebase/php-jwt/commit/78d3ed1073553f7d0bbffa6c2010009a0d483d5c))
 10 | 
 11 | ## [6.3.2](https://github.com/firebase/php-jwt/compare/v6.3.1...v6.3.2) (2022-11-01)
 12 | 
 13 | 
 14 | ### Bug Fixes
 15 | 
 16 | * check kid before using as array index ([bad1b04](https://github.com/firebase/php-jwt/commit/bad1b040d0c736bbf86814c6b5ae614f517cf7bd))
 17 | 
 18 | ## [6.3.1](https://github.com/firebase/php-jwt/compare/v6.3.0...v6.3.1) (2022-11-01)
 19 | 
 20 | 
 21 | ### Bug Fixes
 22 | 
 23 | * casing of GET for PSR compat ([#451](https://github.com/firebase/php-jwt/issues/451)) ([60b52b7](https://github.com/firebase/php-jwt/commit/60b52b71978790eafcf3b95cfbd83db0439e8d22))
 24 | * string interpolation format for php 8.2 ([#446](https://github.com/firebase/php-jwt/issues/446)) ([2e07d8a](https://github.com/firebase/php-jwt/commit/2e07d8a1524d12b69b110ad649f17461d068b8f2))
 25 | 
 26 | ## 6.3.0 / 2022-07-15
 27 | 
 28 |  - Added ES256 support to JWK parsing ([#399](https://github.com/firebase/php-jwt/pull/399))
 29 |  - Fixed potential caching error in `CachedKeySet` by caching jwks as strings ([#435](https://github.com/firebase/php-jwt/pull/435))
 30 | 
 31 | ## 6.2.0 / 2022-05-14
 32 | 
 33 |  - Added `CachedKeySet` ([#397](https://github.com/firebase/php-jwt/pull/397))
 34 |  - Added `$defaultAlg` parameter to `JWT::parseKey` and `JWT::parseKeySet` ([#426](https://github.com/firebase/php-jwt/pull/426)).
 35 | 
 36 | ## 6.1.0 / 2022-03-23
 37 | 
 38 |  - Drop support for PHP 5.3, 5.4, 5.5, 5.6, and 7.0
 39 |  - Add parameter typing and return types where possible
 40 | 
 41 | ## 6.0.0 / 2022-01-24
 42 | 
 43 |  - **Backwards-Compatibility Breaking Changes**: See the [Release Notes](https://github.com/firebase/php-jwt/releases/tag/v6.0.0) for more information.
 44 |  - New Key object to prevent key/algorithm type confusion (#365)
 45 |  - Add JWK support (#273)
 46 |  - Add ES256 support (#256)
 47 |  - Add ES384 support (#324)
 48 |  - Add Ed25519 support (#343)
 49 | 
 50 | ## 5.0.0 / 2017-06-26
 51 | - Support RS384 and RS512.
 52 |   See [#117](https://github.com/firebase/php-jwt/pull/117). Thanks [@joostfaassen](https://github.com/joostfaassen)!
 53 | - Add an example for RS256 openssl.
 54 |   See [#125](https://github.com/firebase/php-jwt/pull/125). Thanks [@akeeman](https://github.com/akeeman)!
 55 | - Detect invalid Base64 encoding in signature.
 56 |   See [#162](https://github.com/firebase/php-jwt/pull/162). Thanks [@psignoret](https://github.com/psignoret)!
 57 | - Update `JWT::verify` to handle OpenSSL errors.
 58 |   See [#159](https://github.com/firebase/php-jwt/pull/159). Thanks [@bshaffer](https://github.com/bshaffer)!
 59 | - Add `array` type hinting to `decode` method
 60 |   See [#101](https://github.com/firebase/php-jwt/pull/101). Thanks [@hywak](https://github.com/hywak)!
 61 | - Add all JSON error types.
 62 |   See [#110](https://github.com/firebase/php-jwt/pull/110). Thanks [@gbalduzzi](https://github.com/gbalduzzi)!
 63 | - Bugfix 'kid' not in given key list.
 64 |   See [#129](https://github.com/firebase/php-jwt/pull/129). Thanks [@stampycode](https://github.com/stampycode)!
 65 | - Miscellaneous cleanup, documentation and test fixes.
 66 |   See [#107](https://github.com/firebase/php-jwt/pull/107), [#115](https://github.com/firebase/php-jwt/pull/115),
 67 |   [#160](https://github.com/firebase/php-jwt/pull/160), [#161](https://github.com/firebase/php-jwt/pull/161), and
 68 |   [#165](https://github.com/firebase/php-jwt/pull/165). Thanks [@akeeman](https://github.com/akeeman),
 69 |   [@chinedufn](https://github.com/chinedufn), and [@bshaffer](https://github.com/bshaffer)!
 70 | 
 71 | ## 4.0.0 / 2016-07-17
 72 | - Add support for late static binding. See [#88](https://github.com/firebase/php-jwt/pull/88) for details. Thanks to [@chappy84](https://github.com/chappy84)!
 73 | - Use static `$timestamp` instead of `time()` to improve unit testing. See [#93](https://github.com/firebase/php-jwt/pull/93) for details. Thanks to [@josephmcdermott](https://github.com/josephmcdermott)!
 74 | - Fixes to exceptions classes. See [#81](https://github.com/firebase/php-jwt/pull/81) for details. Thanks to [@Maks3w](https://github.com/Maks3w)!
 75 | - Fixes to PHPDoc. See [#76](https://github.com/firebase/php-jwt/pull/76) for details. Thanks to [@akeeman](https://github.com/akeeman)!
 76 | 
 77 | ## 3.0.0 / 2015-07-22
 78 | - Minimum PHP version updated from `5.2.0` to `5.3.0`.
 79 | - Add `\Firebase\JWT` namespace. See
 80 | [#59](https://github.com/firebase/php-jwt/pull/59) for details. Thanks to
 81 | [@Dashron](https://github.com/Dashron)!
 82 | - Require a non-empty key to decode and verify a JWT. See
 83 | [#60](https://github.com/firebase/php-jwt/pull/60) for details. Thanks to
 84 | [@sjones608](https://github.com/sjones608)!
 85 | - Cleaner documentation blocks in the code. See
 86 | [#62](https://github.com/firebase/php-jwt/pull/62) for details. Thanks to
 87 | [@johanderuijter](https://github.com/johanderuijter)!
 88 | 
 89 | ## 2.2.0 / 2015-06-22
 90 | - Add support for adding custom, optional JWT headers to `JWT::encode()`. See
 91 | [#53](https://github.com/firebase/php-jwt/pull/53/files) for details. Thanks to
 92 | [@mcocaro](https://github.com/mcocaro)!
 93 | 
 94 | ## 2.1.0 / 2015-05-20
 95 | - Add support for adding a leeway to `JWT:decode()` that accounts for clock skew
 96 | between signing and verifying entities. Thanks to [@lcabral](https://github.com/lcabral)!
 97 | - Add support for passing an object implementing the `ArrayAccess` interface for
 98 | `$keys` argument in `JWT::decode()`. Thanks to [@aztech-dev](https://github.com/aztech-dev)!
 99 | 
100 | ## 2.0.0 / 2015-04-01
101 | - **Note**: It is strongly recommended that you update to > v2.0.0 to address
102 |   known security vulnerabilities in prior versions when both symmetric and
103 |   asymmetric keys are used together.
104 | - Update signature for `JWT::decode(...)` to require an array of supported
105 |   algorithms to use when verifying token signatures.
106 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/CachedKeySet.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | namespace Firebase\JWT;
  4 | 
  5 | use ArrayAccess;
  6 | use InvalidArgumentException;
  7 | use LogicException;
  8 | use OutOfBoundsException;
  9 | use Psr\Cache\CacheItemInterface;
 10 | use Psr\Cache\CacheItemPoolInterface;
 11 | use Psr\Http\Client\ClientInterface;
 12 | use Psr\Http\Message\RequestFactoryInterface;
 13 | use RuntimeException;
 14 | use UnexpectedValueException;
 15 | 
 16 | /**
 17 |  * @implements ArrayAccess<string, Key>
 18 |  */
 19 | class CachedKeySet implements ArrayAccess
 20 | {
 21 |     /**
 22 |      * @var string
 23 |      */
 24 |     private $jwksUri;
 25 |     /**
 26 |      * @var ClientInterface
 27 |      */
 28 |     private $httpClient;
 29 |     /**
 30 |      * @var RequestFactoryInterface
 31 |      */
 32 |     private $httpFactory;
 33 |     /**
 34 |      * @var CacheItemPoolInterface
 35 |      */
 36 |     private $cache;
 37 |     /**
 38 |      * @var ?int
 39 |      */
 40 |     private $expiresAfter;
 41 |     /**
 42 |      * @var ?CacheItemInterface
 43 |      */
 44 |     private $cacheItem;
 45 |     /**
 46 |      * @var array<string, array<mixed>>
 47 |      */
 48 |     private $keySet;
 49 |     /**
 50 |      * @var string
 51 |      */
 52 |     private $cacheKey;
 53 |     /**
 54 |      * @var string
 55 |      */
 56 |     private $cacheKeyPrefix = 'jwks';
 57 |     /**
 58 |      * @var int
 59 |      */
 60 |     private $maxKeyLength = 64;
 61 |     /**
 62 |      * @var bool
 63 |      */
 64 |     private $rateLimit;
 65 |     /**
 66 |      * @var string
 67 |      */
 68 |     private $rateLimitCacheKey;
 69 |     /**
 70 |      * @var int
 71 |      */
 72 |     private $maxCallsPerMinute = 10;
 73 |     /**
 74 |      * @var string|null
 75 |      */
 76 |     private $defaultAlg;
 77 | 
 78 |     public function __construct(
 79 |         string $jwksUri,
 80 |         ClientInterface $httpClient,
 81 |         RequestFactoryInterface $httpFactory,
 82 |         CacheItemPoolInterface $cache,
 83 |         int $expiresAfter = null,
 84 |         bool $rateLimit = false,
 85 |         string $defaultAlg = null
 86 |     ) {
 87 |         $this->jwksUri = $jwksUri;
 88 |         $this->httpClient = $httpClient;
 89 |         $this->httpFactory = $httpFactory;
 90 |         $this->cache = $cache;
 91 |         $this->expiresAfter = $expiresAfter;
 92 |         $this->rateLimit = $rateLimit;
 93 |         $this->defaultAlg = $defaultAlg;
 94 |         $this->setCacheKeys();
 95 |     }
 96 | 
 97 |     /**
 98 |      * @param string $keyId
 99 |      * @return Key
100 |      */
101 |     public function offsetGet($keyId): Key
102 |     {
103 |         if (!$this->keyIdExists($keyId)) {
104 |             throw new OutOfBoundsException('Key ID not found');
105 |         }
106 |         return JWK::parseKey($this->keySet[$keyId], $this->defaultAlg);
107 |     }
108 | 
109 |     /**
110 |      * @param string $keyId
111 |      * @return bool
112 |      */
113 |     public function offsetExists($keyId): bool
114 |     {
115 |         return $this->keyIdExists($keyId);
116 |     }
117 | 
118 |     /**
119 |      * @param string $offset
120 |      * @param Key $value
121 |      */
122 |     public function offsetSet($offset, $value): void
123 |     {
124 |         throw new LogicException('Method not implemented');
125 |     }
126 | 
127 |     /**
128 |      * @param string $offset
129 |      */
130 |     public function offsetUnset($offset): void
131 |     {
132 |         throw new LogicException('Method not implemented');
133 |     }
134 | 
135 |     /**
136 |      * @return array<mixed>
137 |      */
138 |     private function formatJwksForCache(string $jwks): array
139 |     {
140 |         $jwks = json_decode($jwks, true);
141 | 
142 |         if (!isset($jwks['keys'])) {
143 |             throw new UnexpectedValueException('"keys" member must exist in the JWK Set');
144 |         }
145 | 
146 |         if (empty($jwks['keys'])) {
147 |             throw new InvalidArgumentException('JWK Set did not contain any keys');
148 |         }
149 | 
150 |         $keys = [];
151 |         foreach ($jwks['keys'] as $k => $v) {
152 |             $kid = isset($v['kid']) ? $v['kid'] : $k;
153 |             $keys[(string) $kid] = $v;
154 |         }
155 | 
156 |         return $keys;
157 |     }
158 | 
159 |     private function keyIdExists(string $keyId): bool
160 |     {
161 |         if (null === $this->keySet) {
162 |             $item = $this->getCacheItem();
163 |             // Try to load keys from cache
164 |             if ($item->isHit()) {
165 |                 // item found! retrieve it
166 |                 $this->keySet = $item->get();
167 |                 // If the cached item is a string, the JWKS response was cached (previous behavior).
168 |                 // Parse this into expected format array<kid, jwk> instead.
169 |                 if (\is_string($this->keySet)) {
170 |                     $this->keySet = $this->formatJwksForCache($this->keySet);
171 |                 }
172 |             }
173 |         }
174 | 
175 |         if (!isset($this->keySet[$keyId])) {
176 |             if ($this->rateLimitExceeded()) {
177 |                 return false;
178 |             }
179 |             $request = $this->httpFactory->createRequest('GET', $this->jwksUri);
180 |             $jwksResponse = $this->httpClient->sendRequest($request);
181 |             $this->keySet = $this->formatJwksForCache((string) $jwksResponse->getBody());
182 | 
183 |             if (!isset($this->keySet[$keyId])) {
184 |                 return false;
185 |             }
186 | 
187 |             $item = $this->getCacheItem();
188 |             $item->set($this->keySet);
189 |             if ($this->expiresAfter) {
190 |                 $item->expiresAfter($this->expiresAfter);
191 |             }
192 |             $this->cache->save($item);
193 |         }
194 | 
195 |         return true;
196 |     }
197 | 
198 |     private function rateLimitExceeded(): bool
199 |     {
200 |         if (!$this->rateLimit) {
201 |             return false;
202 |         }
203 | 
204 |         $cacheItem = $this->cache->getItem($this->rateLimitCacheKey);
205 |         if (!$cacheItem->isHit()) {
206 |             $cacheItem->expiresAfter(1); // # of calls are cached each minute
207 |         }
208 | 
209 |         $callsPerMinute = (int) $cacheItem->get();
210 |         if (++$callsPerMinute > $this->maxCallsPerMinute) {
211 |             return true;
212 |         }
213 |         $cacheItem->set($callsPerMinute);
214 |         $this->cache->save($cacheItem);
215 |         return false;
216 |     }
217 | 
218 |     private function getCacheItem(): CacheItemInterface
219 |     {
220 |         if (\is_null($this->cacheItem)) {
221 |             $this->cacheItem = $this->cache->getItem($this->cacheKey);
222 |         }
223 | 
224 |         return $this->cacheItem;
225 |     }
226 | 
227 |     private function setCacheKeys(): void
228 |     {
229 |         if (empty($this->jwksUri)) {
230 |             throw new RuntimeException('JWKS URI is empty');
231 |         }
232 | 
233 |         // ensure we do not have illegal characters
234 |         $key = preg_replace('|[^a-zA-Z0-9_\.!]|', '', $this->jwksUri);
235 | 
236 |         // add prefix
237 |         $key = $this->cacheKeyPrefix . $key;
238 | 
239 |         // Hash keys if they exceed $maxKeyLength of 64
240 |         if (\strlen($key) > $this->maxKeyLength) {
241 |             $key = substr(hash('sha256', $key), 0, $this->maxKeyLength);
242 |         }
243 | 
244 |         $this->cacheKey = $key;
245 | 
246 |         if ($this->rateLimit) {
247 |             // add prefix
248 |             $rateLimitKey = $this->cacheKeyPrefix . 'ratelimit' . $key;
249 | 
250 |             // Hash keys if they exceed $maxKeyLength of 64
251 |             if (\strlen($rateLimitKey) > $this->maxKeyLength) {
252 |                 $rateLimitKey = substr(hash('sha256', $rateLimitKey), 0, $this->maxKeyLength);
253 |             }
254 | 
255 |             $this->rateLimitCacheKey = $rateLimitKey;
256 |         }
257 |     }
258 | }
259 | 


--------------------------------------------------------------------------------
/test/IntercomSettingsPageTest.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | use PHPUnit\Framework\TestCase;
  3 | use PHPUnit\Framework\MockObject\MockObject;
  4 | 
  5 | class IntercomSettingsPageTest extends TestCase
  6 | {
  7 |   private $settings;
  8 |   private $intercomSettingsPage;
  9 |   private $originalGet;
 10 | 
 11 |   protected function setUp(): void
 12 |   {
 13 |     parent::setUp();
 14 |     
 15 |     // Store original $_GET
 16 |     $this->originalGet = $_GET;
 17 |     
 18 |     // Default settings
 19 |     $this->settings = [
 20 |       'app_id' => 'test_app_id',
 21 |       'secret' => 'test_secret',
 22 |       'identity_verification' => false
 23 |     ];
 24 |     
 25 |     // Create the IntercomSettingsPage instance
 26 |     $this->intercomSettingsPage = new IntercomSettingsPage($this->settings);
 27 |   }
 28 | 
 29 |   protected function tearDown(): void
 30 |   {
 31 |     // Restore original $_GET
 32 |     $_GET = $this->originalGet;
 33 |     
 34 |     parent::tearDown();
 35 |   }
 36 | 
 37 |   /**
 38 |    * Test the constructor properly initializes the class
 39 |    */
 40 |   public function testConstructor()
 41 |   {
 42 |     $settings = [
 43 |       'app_id' => 'test_app_id',
 44 |       'secret' => 'test_secret',
 45 |       'identity_verification' => true
 46 |     ];
 47 |     
 48 |     $intercomSettingsPage = new IntercomSettingsPage($settings);
 49 |     
 50 |     // Use reflection to access private properties
 51 |     $reflection = new ReflectionClass($intercomSettingsPage);
 52 |     $settingsProperty = $reflection->getProperty('settings');
 53 |     $settingsProperty->setAccessible(true);
 54 |     $stylesProperty = $reflection->getProperty('styles');
 55 |     $stylesProperty->setAccessible(true);
 56 |     
 57 |     $this->assertEquals($settings, $settingsProperty->getValue($intercomSettingsPage));
 58 |     $this->assertNotEmpty($stylesProperty->getValue($intercomSettingsPage));
 59 |   }
 60 | 
 61 |   /**
 62 |    * Test the dismissibleMessage method
 63 |    */
 64 |   public function testDismissibleMessage()
 65 |   {
 66 |     $message = "Test message";
 67 |     $result = $this->intercomSettingsPage->dismissibleMessage($message);
 68 |     
 69 |     $this->assertStringContainsString('<div id="message" class="updated notice is-dismissible">', $result);
 70 |     $this->assertStringContainsString('<p>' . $message . '</p>', $result);
 71 |     $this->assertStringContainsString('<button type="button" class="notice-dismiss">', $result);
 72 |   }
 73 | 
 74 |   /**
 75 |    * Test the getAuthUrl method
 76 |    */
 77 |   public function testGetAuthUrl()
 78 |   {
 79 |     // Mock WordPress functions
 80 |     if (!function_exists('get_site_url')) {
 81 |       function get_site_url() {
 82 |         return 'https://example.com';
 83 |       }
 84 |     }
 85 |     
 86 |     if (!function_exists('wp_create_nonce')) {
 87 |       function wp_create_nonce($action) {
 88 |         return 'test_nonce';
 89 |       }
 90 |     }
 91 |     
 92 |     $authUrl = $this->intercomSettingsPage->getAuthUrl();
 93 |     
 94 |     $this->assertStringContainsString('https://wordpress_auth.intercom.io/confirm?state=', $authUrl);
 95 |     $this->assertStringContainsString('https://example.com', $authUrl);
 96 |     $this->assertStringContainsString('test_nonce', $authUrl);
 97 |   }
 98 | 
 99 |   /**
100 |    * Test the htmlUnclosed method with different GET parameters
101 |    */
102 |   public function testHtmlUnclosed()
103 |   {
104 |     // Test with appId parameter
105 |     $_GET['appId'] = 'new_app_id';
106 |     $html = $this->intercomSettingsPage->htmlUnclosed();
107 |     $this->assertStringContainsString('new_app_id', $html);
108 |     $this->assertStringContainsString("We've copied your new Intercom app id below", $html);
109 |     
110 |     // Test with saved parameter
111 |     $_GET = [];
112 |     $_GET['saved'] = true;
113 |     $html = $this->intercomSettingsPage->htmlUnclosed();
114 |     $this->assertStringContainsString("Your app id has been successfully saved", $html);
115 |     
116 |     // Test with authenticated parameter
117 |     $_GET = [];
118 |     $_GET['authenticated'] = true;
119 |     $html = $this->intercomSettingsPage->htmlUnclosed();
120 |     $this->assertStringContainsString("You successfully authenticated with Intercom", $html);
121 |   }
122 | 
123 |   /**
124 |    * Test the htmlClosed method
125 |    */
126 |   public function testHtmlClosed()
127 |   {
128 |     $html = $this->intercomSettingsPage->htmlClosed();
129 |     
130 |     $this->assertStringContainsString('</form>', $html);
131 |     $this->assertStringContainsString('Identity Verification', $html);
132 |     $this->assertStringContainsString('https://docs.intercom.com', $html);
133 |   }
134 | 
135 |   /**
136 |    * Test the html method
137 |    */
138 |   public function testHtml()
139 |   {
140 |     $html = $this->intercomSettingsPage->html();
141 |     
142 |     $this->assertStringContainsString('<div class="wrap">', $html);
143 |     $this->assertStringContainsString('</div>', $html);
144 |     $this->assertStringContainsString('https://code.jquery.com/jquery-2.2.0.min.js', $html);
145 |   }
146 | 
147 |   /**
148 |    * Test the setStyles method with different settings
149 |    */
150 |   public function testSetStyles()
151 |   {
152 |     // Test with identity verification enabled
153 |     $settings = [
154 |       'app_id' => 'test_app_id',
155 |       'secret' => 'test_secret',
156 |       'identity_verification' => true
157 |     ];
158 |     
159 |     $intercomSettingsPage = new IntercomSettingsPage($settings);
160 |     $reflection = new ReflectionClass($intercomSettingsPage);
161 |     $stylesProperty = $reflection->getProperty('styles');
162 |     $stylesProperty->setAccessible(true);
163 |     
164 |     $styles = $stylesProperty->getValue($intercomSettingsPage);
165 |     $this->assertEquals('checked disabled', $styles['identity_verification_state']);
166 |     
167 |     // Test with app_id but no secret
168 |     $settings = [
169 |       'app_id' => 'test_app_id',
170 |       'secret' => '',
171 |       'identity_verification' => false
172 |     ];
173 |     
174 |     $intercomSettingsPage = new IntercomSettingsPage($settings);
175 |     $styles = $stylesProperty->getValue($intercomSettingsPage);
176 |     $this->assertEquals('display: none;', $styles['app_secret_row_style']);
177 |     $this->assertEquals('', $styles['app_secret_link_style']);
178 |     
179 |     // Test with appId in GET
180 |     $_GET['appId'] = 'new_app_id';
181 |     $intercomSettingsPage = new IntercomSettingsPage($settings);
182 |     $styles = $stylesProperty->getValue($intercomSettingsPage);
183 |     $this->assertEquals('readonly', $styles['app_id_state']);
184 |     $this->assertEquals('cta__email', $styles['app_id_class']);
185 |     $this->assertEquals('', $styles['button_submit_style']);
186 |     $this->assertEquals('display: none;', $styles['app_id_copy_hidden']);
187 |     
188 |     // Test with saved in GET
189 |     $_GET = [];
190 |     $_GET['saved'] = true;
191 |     $intercomSettingsPage = new IntercomSettingsPage($settings);
192 |     $styles = $stylesProperty->getValue($intercomSettingsPage);
193 |     $this->assertEquals('display: none;', $styles['app_id_copy_hidden']);
194 |     $this->assertEquals('', $styles['app_id_saved_title']);
195 |     
196 |     // Test with empty app_id
197 |     $settings = [
198 |       'app_id' => '',
199 |       'secret' => 'test_secret',
200 |       'identity_verification' => false
201 |     ];
202 |     
203 |     $intercomSettingsPage = new IntercomSettingsPage($settings);
204 |     $styles = $stylesProperty->getValue($intercomSettingsPage);
205 |     $this->assertEquals('display: none;', $styles['app_id_row_style']);
206 |     $this->assertEquals('', $styles['app_id_link_style']);
207 |   }
208 | 
209 |   /**
210 |    * Test the getSettings method
211 |    */
212 |   public function testGetSettings()
213 |   {
214 |     $reflection = new ReflectionClass($this->intercomSettingsPage);
215 |     $method = $reflection->getMethod('getSettings');
216 |     $method->setAccessible(true);
217 |     
218 |     $settings = $method->invoke($this->intercomSettingsPage);
219 |     
220 |     $this->assertEquals($this->settings, $settings);
221 |   }
222 | 
223 |   /**
224 |    * Test the getStyles method
225 |    */
226 |   public function testGetStyles()
227 |   {
228 |     $reflection = new ReflectionClass($this->intercomSettingsPage);
229 |     $method = $reflection->getMethod('getStyles');
230 |     $method->setAccessible(true);
231 |     
232 |     $styles = $method->invoke($this->intercomSettingsPage);
233 |     
234 |     $this->assertNotEmpty($styles);
235 |     $this->assertIsArray($styles);
236 |   }
237 | }
238 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/README.md:
--------------------------------------------------------------------------------
  1 | ![Build Status](https://github.com/firebase/php-jwt/actions/workflows/tests.yml/badge.svg)
  2 | [![Latest Stable Version](https://poser.pugx.org/firebase/php-jwt/v/stable)](https://packagist.org/packages/firebase/php-jwt)
  3 | [![Total Downloads](https://poser.pugx.org/firebase/php-jwt/downloads)](https://packagist.org/packages/firebase/php-jwt)
  4 | [![License](https://poser.pugx.org/firebase/php-jwt/license)](https://packagist.org/packages/firebase/php-jwt)
  5 | 
  6 | PHP-JWT
  7 | =======
  8 | A simple library to encode and decode JSON Web Tokens (JWT) in PHP, conforming to [RFC 7519](https://tools.ietf.org/html/rfc7519).
  9 | 
 10 | Installation
 11 | ------------
 12 | 
 13 | Use composer to manage your dependencies and download PHP-JWT:
 14 | 
 15 | ```bash
 16 | composer require firebase/php-jwt
 17 | ```
 18 | 
 19 | Optionally, install the `paragonie/sodium_compat` package from composer if your
 20 | php is < 7.2 or does not have libsodium installed:
 21 | 
 22 | ```bash
 23 | composer require paragonie/sodium_compat
 24 | ```
 25 | 
 26 | Example
 27 | -------
 28 | ```php
 29 | use Firebase\JWT\JWT;
 30 | use Firebase\JWT\Key;
 31 | 
 32 | $key = 'example_key';
 33 | $payload = [
 34 |     'iss' => 'http://example.org',
 35 |     'aud' => 'http://example.com',
 36 |     'iat' => 1356999524,
 37 |     'nbf' => 1357000000
 38 | ];
 39 | 
 40 | /**
 41 |  * IMPORTANT:
 42 |  * You must specify supported algorithms for your application. See
 43 |  * https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40
 44 |  * for a list of spec-compliant algorithms.
 45 |  */
 46 | $jwt = JWT::encode($payload, $key, 'HS256');
 47 | $decoded = JWT::decode($jwt, new Key($key, 'HS256'));
 48 | 
 49 | print_r($decoded);
 50 | 
 51 | /*
 52 |  NOTE: This will now be an object instead of an associative array. To get
 53 |  an associative array, you will need to cast it as such:
 54 | */
 55 | 
 56 | $decoded_array = (array) $decoded;
 57 | 
 58 | /**
 59 |  * You can add a leeway to account for when there is a clock skew times between
 60 |  * the signing and verifying servers. It is recommended that this leeway should
 61 |  * not be bigger than a few minutes.
 62 |  *
 63 |  * Source: http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#nbfDef
 64 |  */
 65 | JWT::$leeway = 60; // $leeway in seconds
 66 | $decoded = JWT::decode($jwt, new Key($key, 'HS256'));
 67 | ```
 68 | Example with RS256 (openssl)
 69 | ----------------------------
 70 | ```php
 71 | use Firebase\JWT\JWT;
 72 | use Firebase\JWT\Key;
 73 | 
 74 | $privateKey = <<<EOD
 75 | -----BEGIN RSA PRIVATE KEY-----
 76 | MIICXAIBAAKBgQC8kGa1pSjbSYZVebtTRBLxBz5H4i2p/llLCrEeQhta5kaQu/Rn
 77 | vuER4W8oDH3+3iuIYW4VQAzyqFpwuzjkDI+17t5t0tyazyZ8JXw+KgXTxldMPEL9
 78 | 5+qVhgXvwtihXC1c5oGbRlEDvDF6Sa53rcFVsYJ4ehde/zUxo6UvS7UrBQIDAQAB
 79 | AoGAb/MXV46XxCFRxNuB8LyAtmLDgi/xRnTAlMHjSACddwkyKem8//8eZtw9fzxz
 80 | bWZ/1/doQOuHBGYZU8aDzzj59FZ78dyzNFoF91hbvZKkg+6wGyd/LrGVEB+Xre0J
 81 | Nil0GReM2AHDNZUYRv+HYJPIOrB0CRczLQsgFJ8K6aAD6F0CQQDzbpjYdx10qgK1
 82 | cP59UHiHjPZYC0loEsk7s+hUmT3QHerAQJMZWC11Qrn2N+ybwwNblDKv+s5qgMQ5
 83 | 5tNoQ9IfAkEAxkyffU6ythpg/H0Ixe1I2rd0GbF05biIzO/i77Det3n4YsJVlDck
 84 | ZkcvY3SK2iRIL4c9yY6hlIhs+K9wXTtGWwJBAO9Dskl48mO7woPR9uD22jDpNSwe
 85 | k90OMepTjzSvlhjbfuPN1IdhqvSJTDychRwn1kIJ7LQZgQ8fVz9OCFZ/6qMCQGOb
 86 | qaGwHmUK6xzpUbbacnYrIM6nLSkXgOAwv7XXCojvY614ILTK3iXiLBOxPu5Eu13k
 87 | eUz9sHyD6vkgZzjtxXECQAkp4Xerf5TGfQXGXhxIX52yH+N2LtujCdkQZjXAsGdm
 88 | B2zNzvrlgRmgBrklMTrMYgm1NPcW+bRLGcwgW2PTvNM=
 89 | -----END RSA PRIVATE KEY-----
 90 | EOD;
 91 | 
 92 | $publicKey = <<<EOD
 93 | -----BEGIN PUBLIC KEY-----
 94 | MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8kGa1pSjbSYZVebtTRBLxBz5H
 95 | 4i2p/llLCrEeQhta5kaQu/RnvuER4W8oDH3+3iuIYW4VQAzyqFpwuzjkDI+17t5t
 96 | 0tyazyZ8JXw+KgXTxldMPEL95+qVhgXvwtihXC1c5oGbRlEDvDF6Sa53rcFVsYJ4
 97 | ehde/zUxo6UvS7UrBQIDAQAB
 98 | -----END PUBLIC KEY-----
 99 | EOD;
100 | 
101 | $payload = [
102 |     'iss' => 'example.org',
103 |     'aud' => 'example.com',
104 |     'iat' => 1356999524,
105 |     'nbf' => 1357000000
106 | ];
107 | 
108 | $jwt = JWT::encode($payload, $privateKey, 'RS256');
109 | echo "Encode:\n" . print_r($jwt, true) . "\n";
110 | 
111 | $decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));
112 | 
113 | /*
114 |  NOTE: This will now be an object instead of an associative array. To get
115 |  an associative array, you will need to cast it as such:
116 | */
117 | 
118 | $decoded_array = (array) $decoded;
119 | echo "Decode:\n" . print_r($decoded_array, true) . "\n";
120 | ```
121 | 
122 | Example with a passphrase
123 | -------------------------
124 | 
125 | ```php
126 | use Firebase\JWT\JWT;
127 | use Firebase\JWT\Key;
128 | 
129 | // Your passphrase
130 | $passphrase = '[YOUR_PASSPHRASE]';
131 | 
132 | // Your private key file with passphrase
133 | // Can be generated with "ssh-keygen -t rsa -m pem"
134 | $privateKeyFile = '/path/to/key-with-passphrase.pem';
135 | 
136 | // Create a private key of type "resource"
137 | $privateKey = openssl_pkey_get_private(
138 |     file_get_contents($privateKeyFile),
139 |     $passphrase
140 | );
141 | 
142 | $payload = [
143 |     'iss' => 'example.org',
144 |     'aud' => 'example.com',
145 |     'iat' => 1356999524,
146 |     'nbf' => 1357000000
147 | ];
148 | 
149 | $jwt = JWT::encode($payload, $privateKey, 'RS256');
150 | echo "Encode:\n" . print_r($jwt, true) . "\n";
151 | 
152 | // Get public key from the private key, or pull from from a file.
153 | $publicKey = openssl_pkey_get_details($privateKey)['key'];
154 | 
155 | $decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));
156 | echo "Decode:\n" . print_r((array) $decoded, true) . "\n";
157 | ```
158 | 
159 | Example with EdDSA (libsodium and Ed25519 signature)
160 | ----------------------------
161 | ```php
162 | use Firebase\JWT\JWT;
163 | use Firebase\JWT\Key;
164 | 
165 | // Public and private keys are expected to be Base64 encoded. The last
166 | // non-empty line is used so that keys can be generated with
167 | // sodium_crypto_sign_keypair(). The secret keys generated by other tools may
168 | // need to be adjusted to match the input expected by libsodium.
169 | 
170 | $keyPair = sodium_crypto_sign_keypair();
171 | 
172 | $privateKey = base64_encode(sodium_crypto_sign_secretkey($keyPair));
173 | 
174 | $publicKey = base64_encode(sodium_crypto_sign_publickey($keyPair));
175 | 
176 | $payload = [
177 |     'iss' => 'example.org',
178 |     'aud' => 'example.com',
179 |     'iat' => 1356999524,
180 |     'nbf' => 1357000000
181 | ];
182 | 
183 | $jwt = JWT::encode($payload, $privateKey, 'EdDSA');
184 | echo "Encode:\n" . print_r($jwt, true) . "\n";
185 | 
186 | $decoded = JWT::decode($jwt, new Key($publicKey, 'EdDSA'));
187 | echo "Decode:\n" . print_r((array) $decoded, true) . "\n";
188 | ````
189 | 
190 | Using JWKs
191 | ----------
192 | 
193 | ```php
194 | use Firebase\JWT\JWK;
195 | use Firebase\JWT\JWT;
196 | 
197 | // Set of keys. The "keys" key is required. For example, the JSON response to
198 | // this endpoint: https://www.gstatic.com/iap/verify/public_key-jwk
199 | $jwks = ['keys' => []];
200 | 
201 | // JWK::parseKeySet($jwks) returns an associative array of **kid** to Firebase\JWT\Key
202 | // objects. Pass this as the second parameter to JWT::decode.
203 | JWT::decode($payload, JWK::parseKeySet($jwks));
204 | ```
205 | 
206 | Using Cached Key Sets
207 | ---------------------
208 | 
209 | The `CachedKeySet` class can be used to fetch and cache JWKS (JSON Web Key Sets) from a public URI.
210 | This has the following advantages:
211 | 
212 | 1. The results are cached for performance.
213 | 2. If an unrecognized key is requested, the cache is refreshed, to accomodate for key rotation.
214 | 3. If rate limiting is enabled, the JWKS URI will not make more than 10 requests a second.
215 | 
216 | ```php
217 | use Firebase\JWT\CachedKeySet;
218 | use Firebase\JWT\JWT;
219 | 
220 | // The URI for the JWKS you wish to cache the results from
221 | $jwksUri = 'https://www.gstatic.com/iap/verify/public_key-jwk';
222 | 
223 | // Create an HTTP client (can be any PSR-7 compatible HTTP client)
224 | $httpClient = new GuzzleHttp\Client();
225 | 
226 | // Create an HTTP request factory (can be any PSR-17 compatible HTTP request factory)
227 | $httpFactory = new GuzzleHttp\Psr\HttpFactory();
228 | 
229 | // Create a cache item pool (can be any PSR-6 compatible cache item pool)
230 | $cacheItemPool = Phpfastcache\CacheManager::getInstance('files');
231 | 
232 | $keySet = new CachedKeySet(
233 |     $jwksUri,
234 |     $httpClient,
235 |     $httpFactory,
236 |     $cacheItemPool,
237 |     null, // $expiresAfter int seconds to set the JWKS to expire
238 |     true  // $rateLimit    true to enable rate limit of 10 RPS on lookup of invalid keys
239 | );
240 | 
241 | $jwt = 'eyJhbGci...'; // Some JWT signed by a key from the $jwkUri above
242 | $decoded = JWT::decode($jwt, $keySet);
243 | ```
244 | 
245 | Miscellaneous
246 | -------------
247 | 
248 | #### Exception Handling
249 | 
250 | When a call to `JWT::decode` is invalid, it will throw one of the following exceptions:
251 | 
252 | ```php
253 | use Firebase\JWT\JWT;
254 | use Firebase\JWT\SignatureInvalidException;
255 | use Firebase\JWT\BeforeValidException;
256 | use Firebase\JWT\ExpiredException;
257 | use DomainException;
258 | use InvalidArgumentException;
259 | use UnexpectedValueException;
260 | 
261 | try {
262 |     $decoded = JWT::decode($payload, $keys);
263 | } catch (InvalidArgumentException $e) {
264 |     // provided key/key-array is empty or malformed.
265 | } catch (DomainException $e) {
266 |     // provided algorithm is unsupported OR
267 |     // provided key is invalid OR
268 |     // unknown error thrown in openSSL or libsodium OR
269 |     // libsodium is required but not available.
270 | } catch (SignatureInvalidException $e) {
271 |     // provided JWT signature verification failed.
272 | } catch (BeforeValidException $e) {
273 |     // provided JWT is trying to be used before "nbf" claim OR
274 |     // provided JWT is trying to be used before "iat" claim.
275 | } catch (ExpiredException $e) {
276 |     // provided JWT is trying to be used after "exp" claim.
277 | } catch (UnexpectedValueException $e) {
278 |     // provided JWT is malformed OR
279 |     // provided JWT is missing an algorithm / using an unsupported algorithm OR
280 |     // provided JWT algorithm does not match provided key OR
281 |     // provided key ID in key/key-array is empty or invalid.
282 | }
283 | ```
284 | 
285 | All exceptions in the `Firebase\JWT` namespace extend `UnexpectedValueException`, and can be simplified
286 | like this:
287 | 
288 | ```php
289 | try {
290 |     $decoded = JWT::decode($payload, $keys);
291 | } catch (LogicException $e) {
292 |     // errors having to do with environmental setup or malformed JWT Keys
293 | } catch (UnexpectedValueException $e) {
294 |     // errors having to do with JWT signature and claims
295 | }
296 | ```
297 | 
298 | #### Casting to array
299 | 
300 | The return value of `JWT::decode` is the generic PHP object `stdClass`. If you'd like to handle with arrays
301 | instead, you can do the following:
302 | 
303 | ```php
304 | // return type is stdClass
305 | $decoded = JWT::decode($payload, $keys);
306 | 
307 | // cast to array
308 | $decoded = json_decode(json_encode($decoded), true);
309 | ```
310 | 
311 | Tests
312 | -----
313 | Run the tests using phpunit:
314 | 
315 | ```bash
316 | $ pear install PHPUnit
317 | $ phpunit --configuration phpunit.xml.dist
318 | PHPUnit 3.7.10 by Sebastian Bergmann.
319 | .....
320 | Time: 0 seconds, Memory: 2.50Mb
321 | OK (5 tests, 5 assertions)
322 | ```
323 | 
324 | New Lines in private keys
325 | -----
326 | 
327 | If your private key contains `\n` characters, be sure to wrap it in double quotes `""`
328 | and not single quotes `''` in order to properly interpret the escaped characters.
329 | 
330 | License
331 | -------
332 | [3-Clause BSD](http://opensource.org/licenses/BSD-3-Clause).
333 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/JWK.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | namespace Firebase\JWT;
  4 | 
  5 | use DomainException;
  6 | use InvalidArgumentException;
  7 | use UnexpectedValueException;
  8 | 
  9 | /**
 10 |  * JSON Web Key implementation, based on this spec:
 11 |  * https://tools.ietf.org/html/draft-ietf-jose-json-web-key-41
 12 |  *
 13 |  * PHP version 5
 14 |  *
 15 |  * @category Authentication
 16 |  * @package  Authentication_JWT
 17 |  * @author   Bui Sy Nguyen <nguyenbs@gmail.com>
 18 |  * @license  http://opensource.org/licenses/BSD-3-Clause 3-clause BSD
 19 |  * @link     https://github.com/firebase/php-jwt
 20 |  */
 21 | class JWK
 22 | {
 23 |     private const OID = '1.2.840.10045.2.1';
 24 |     private const ASN1_OBJECT_IDENTIFIER = 0x06;
 25 |     private const ASN1_SEQUENCE = 0x10; // also defined in JWT
 26 |     private const ASN1_BIT_STRING = 0x03;
 27 |     private const EC_CURVES = [
 28 |         'P-256' => '1.2.840.10045.3.1.7', // Len: 64
 29 |         'secp256k1' => '1.3.132.0.10', // Len: 64
 30 |         // 'P-384' => '1.3.132.0.34', // Len: 96 (not yet supported)
 31 |         // 'P-521' => '1.3.132.0.35', // Len: 132 (not supported)
 32 |     ];
 33 | 
 34 |     /**
 35 |      * Parse a set of JWK keys
 36 |      *
 37 |      * @param array<mixed> $jwks The JSON Web Key Set as an associative array
 38 |      * @param string       $defaultAlg The algorithm for the Key object if "alg" is not set in the
 39 |      *                                 JSON Web Key Set
 40 |      *
 41 |      * @return array<string, Key> An associative array of key IDs (kid) to Key objects
 42 |      *
 43 |      * @throws InvalidArgumentException     Provided JWK Set is empty
 44 |      * @throws UnexpectedValueException     Provided JWK Set was invalid
 45 |      * @throws DomainException              OpenSSL failure
 46 |      *
 47 |      * @uses parseKey
 48 |      */
 49 |     public static function parseKeySet(array $jwks, string $defaultAlg = null): array
 50 |     {
 51 |         $keys = [];
 52 | 
 53 |         if (!isset($jwks['keys'])) {
 54 |             throw new UnexpectedValueException('"keys" member must exist in the JWK Set');
 55 |         }
 56 | 
 57 |         if (empty($jwks['keys'])) {
 58 |             throw new InvalidArgumentException('JWK Set did not contain any keys');
 59 |         }
 60 | 
 61 |         foreach ($jwks['keys'] as $k => $v) {
 62 |             $kid = isset($v['kid']) ? $v['kid'] : $k;
 63 |             if ($key = self::parseKey($v, $defaultAlg)) {
 64 |                 $keys[(string) $kid] = $key;
 65 |             }
 66 |         }
 67 | 
 68 |         if (0 === \count($keys)) {
 69 |             throw new UnexpectedValueException('No supported algorithms found in JWK Set');
 70 |         }
 71 | 
 72 |         return $keys;
 73 |     }
 74 | 
 75 |     /**
 76 |      * Parse a JWK key
 77 |      *
 78 |      * @param array<mixed> $jwk An individual JWK
 79 |      * @param string       $defaultAlg The algorithm for the Key object if "alg" is not set in the
 80 |      *                                 JSON Web Key Set
 81 |      *
 82 |      * @return Key The key object for the JWK
 83 |      *
 84 |      * @throws InvalidArgumentException     Provided JWK is empty
 85 |      * @throws UnexpectedValueException     Provided JWK was invalid
 86 |      * @throws DomainException              OpenSSL failure
 87 |      *
 88 |      * @uses createPemFromModulusAndExponent
 89 |      */
 90 |     public static function parseKey(array $jwk, string $defaultAlg = null): ?Key
 91 |     {
 92 |         if (empty($jwk)) {
 93 |             throw new InvalidArgumentException('JWK must not be empty');
 94 |         }
 95 | 
 96 |         if (!isset($jwk['kty'])) {
 97 |             throw new UnexpectedValueException('JWK must contain a "kty" parameter');
 98 |         }
 99 | 
100 |         if (!isset($jwk['alg'])) {
101 |             if (\is_null($defaultAlg)) {
102 |                 // The "alg" parameter is optional in a KTY, but an algorithm is required
103 |                 // for parsing in this library. Use the $defaultAlg parameter when parsing the
104 |                 // key set in order to prevent this error.
105 |                 // @see https://datatracker.ietf.org/doc/html/rfc7517#section-4.4
106 |                 throw new UnexpectedValueException('JWK must contain an "alg" parameter');
107 |             }
108 |             $jwk['alg'] = $defaultAlg;
109 |         }
110 | 
111 |         switch ($jwk['kty']) {
112 |             case 'RSA':
113 |                 if (!empty($jwk['d'])) {
114 |                     throw new UnexpectedValueException('RSA private keys are not supported');
115 |                 }
116 |                 if (!isset($jwk['n']) || !isset($jwk['e'])) {
117 |                     throw new UnexpectedValueException('RSA keys must contain values for both "n" and "e"');
118 |                 }
119 | 
120 |                 $pem = self::createPemFromModulusAndExponent($jwk['n'], $jwk['e']);
121 |                 $publicKey = \openssl_pkey_get_public($pem);
122 |                 if (false === $publicKey) {
123 |                     throw new DomainException(
124 |                         'OpenSSL error: ' . \openssl_error_string()
125 |                     );
126 |                 }
127 |                 return new Key($publicKey, $jwk['alg']);
128 |             case 'EC':
129 |                 if (isset($jwk['d'])) {
130 |                     // The key is actually a private key
131 |                     throw new UnexpectedValueException('Key data must be for a public key');
132 |                 }
133 | 
134 |                 if (empty($jwk['crv'])) {
135 |                     throw new UnexpectedValueException('crv not set');
136 |                 }
137 | 
138 |                 if (!isset(self::EC_CURVES[$jwk['crv']])) {
139 |                     throw new DomainException('Unrecognised or unsupported EC curve');
140 |                 }
141 | 
142 |                 if (empty($jwk['x']) || empty($jwk['y'])) {
143 |                     throw new UnexpectedValueException('x and y not set');
144 |                 }
145 | 
146 |                 $publicKey = self::createPemFromCrvAndXYCoordinates($jwk['crv'], $jwk['x'], $jwk['y']);
147 |                 return new Key($publicKey, $jwk['alg']);
148 |             default:
149 |                 // Currently only RSA is supported
150 |                 break;
151 |         }
152 | 
153 |         return null;
154 |     }
155 | 
156 |     /**
157 |      * Converts the EC JWK values to pem format.
158 |      *
159 |      * @param   string  $crv The EC curve (only P-256 is supported)
160 |      * @param   string  $x   The EC x-coordinate
161 |      * @param   string  $y   The EC y-coordinate
162 |      *
163 |      * @return  string
164 |      */
165 |     private static function createPemFromCrvAndXYCoordinates(string $crv, string $x, string $y): string
166 |     {
167 |         $pem =
168 |             self::encodeDER(
169 |                 self::ASN1_SEQUENCE,
170 |                 self::encodeDER(
171 |                     self::ASN1_SEQUENCE,
172 |                     self::encodeDER(
173 |                         self::ASN1_OBJECT_IDENTIFIER,
174 |                         self::encodeOID(self::OID)
175 |                     )
176 |                     . self::encodeDER(
177 |                         self::ASN1_OBJECT_IDENTIFIER,
178 |                         self::encodeOID(self::EC_CURVES[$crv])
179 |                     )
180 |                 ) .
181 |                 self::encodeDER(
182 |                     self::ASN1_BIT_STRING,
183 |                     \chr(0x00) . \chr(0x04)
184 |                     . JWT::urlsafeB64Decode($x)
185 |                     . JWT::urlsafeB64Decode($y)
186 |                 )
187 |             );
188 | 
189 |         return sprintf(
190 |             "-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----\n",
191 |             wordwrap(base64_encode($pem), 64, "\n", true)
192 |         );
193 |     }
194 | 
195 |     /**
196 |      * Create a public key represented in PEM format from RSA modulus and exponent information
197 |      *
198 |      * @param string $n The RSA modulus encoded in Base64
199 |      * @param string $e The RSA exponent encoded in Base64
200 |      *
201 |      * @return string The RSA public key represented in PEM format
202 |      *
203 |      * @uses encodeLength
204 |      */
205 |     private static function createPemFromModulusAndExponent(
206 |         string $n,
207 |         string $e
208 |     ): string {
209 |         $mod = JWT::urlsafeB64Decode($n);
210 |         $exp = JWT::urlsafeB64Decode($e);
211 | 
212 |         $modulus = \pack('Ca*a*', 2, self::encodeLength(\strlen($mod)), $mod);
213 |         $publicExponent = \pack('Ca*a*', 2, self::encodeLength(\strlen($exp)), $exp);
214 | 
215 |         $rsaPublicKey = \pack(
216 |             'Ca*a*a*',
217 |             48,
218 |             self::encodeLength(\strlen($modulus) + \strlen($publicExponent)),
219 |             $modulus,
220 |             $publicExponent
221 |         );
222 | 
223 |         // sequence(oid(1.2.840.113549.1.1.1), null)) = rsaEncryption.
224 |         $rsaOID = \pack('H*', '300d06092a864886f70d0101010500'); // hex version of MA0GCSqGSIb3DQEBAQUA
225 |         $rsaPublicKey = \chr(0) . $rsaPublicKey;
226 |         $rsaPublicKey = \chr(3) . self::encodeLength(\strlen($rsaPublicKey)) . $rsaPublicKey;
227 | 
228 |         $rsaPublicKey = \pack(
229 |             'Ca*a*',
230 |             48,
231 |             self::encodeLength(\strlen($rsaOID . $rsaPublicKey)),
232 |             $rsaOID . $rsaPublicKey
233 |         );
234 | 
235 |         return "-----BEGIN PUBLIC KEY-----\r\n" .
236 |             \chunk_split(\base64_encode($rsaPublicKey), 64) .
237 |             '-----END PUBLIC KEY-----';
238 |     }
239 | 
240 |     /**
241 |      * DER-encode the length
242 |      *
243 |      * DER supports lengths up to (2**8)**127, however, we'll only support lengths up to (2**8)**4.  See
244 |      * {@link http://itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf#p=13 X.690 paragraph 8.1.3} for more information.
245 |      *
246 |      * @param int $length
247 |      * @return string
248 |      */
249 |     private static function encodeLength(int $length): string
250 |     {
251 |         if ($length <= 0x7F) {
252 |             return \chr($length);
253 |         }
254 | 
255 |         $temp = \ltrim(\pack('N', $length), \chr(0));
256 | 
257 |         return \pack('Ca*', 0x80 | \strlen($temp), $temp);
258 |     }
259 | 
260 |     /**
261 |      * Encodes a value into a DER object.
262 |      * Also defined in Firebase\JWT\JWT
263 |      *
264 |      * @param   int     $type DER tag
265 |      * @param   string  $value the value to encode
266 |      * @return  string  the encoded object
267 |      */
268 |     private static function encodeDER(int $type, string $value): string
269 |     {
270 |         $tag_header = 0;
271 |         if ($type === self::ASN1_SEQUENCE) {
272 |             $tag_header |= 0x20;
273 |         }
274 | 
275 |         // Type
276 |         $der = \chr($tag_header | $type);
277 | 
278 |         // Length
279 |         $der .= \chr(\strlen($value));
280 | 
281 |         return $der . $value;
282 |     }
283 | 
284 |     /**
285 |      * Encodes a string into a DER-encoded OID.
286 |      *
287 |      * @param   string $oid the OID string
288 |      * @return  string the binary DER-encoded OID
289 |      */
290 |     private static function encodeOID(string $oid): string
291 |     {
292 |         $octets = explode('.', $oid);
293 | 
294 |         // Get the first octet
295 |         $first = (int) array_shift($octets);
296 |         $second = (int) array_shift($octets);
297 |         $oid = \chr($first * 40 + $second);
298 | 
299 |         // Iterate over subsequent octets
300 |         foreach ($octets as $octet) {
301 |             if ($octet == 0) {
302 |                 $oid .= \chr(0x00);
303 |                 continue;
304 |             }
305 |             $bin = '';
306 | 
307 |             while ($octet) {
308 |                 $bin .= \chr(0x80 | ($octet & 0x7f));
309 |                 $octet >>= 7;
310 |             }
311 |             $bin[0] = $bin[0] & \chr(0x7f);
312 | 
313 |             // Convert to big endian if necessary
314 |             if (pack('V', 65534) == pack('L', 65534)) {
315 |                 $oid .= strrev($bin);
316 |             } else {
317 |                 $oid .= $bin;
318 |             }
319 |         }
320 | 
321 |         return $oid;
322 |     }
323 | }
324 | 


--------------------------------------------------------------------------------
/vendor/composer/InstalledVersions.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /*
  4 |  * This file is part of Composer.
  5 |  *
  6 |  * (c) Nils Adermann <naderman@naderman.de>
  7 |  *     Jordi Boggiano <j.boggiano@seld.be>
  8 |  *
  9 |  * For the full copyright and license information, please view the LICENSE
 10 |  * file that was distributed with this source code.
 11 |  */
 12 | 
 13 | namespace Composer;
 14 | 
 15 | use Composer\Autoload\ClassLoader;
 16 | use Composer\Semver\VersionParser;
 17 | 
 18 | /**
 19 |  * This class is copied in every Composer installed project and available to all
 20 |  *
 21 |  * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 22 |  *
 23 |  * To require its presence, you can require `composer-runtime-api ^2.0`
 24 |  *
 25 |  * @final
 26 |  */
 27 | class InstalledVersions
 28 | {
 29 |     /**
 30 |      * @var string|null if set (by reflection by Composer), this should be set to the path where this class is being copied to
 31 |      * @internal
 32 |      */
 33 |     private static $selfDir = null;
 34 | 
 35 |     /**
 36 |      * @var mixed[]|null
 37 |      * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
 38 |      */
 39 |     private static $installed;
 40 | 
 41 |     /**
 42 |      * @var bool
 43 |      */
 44 |     private static $installedIsLocalDir;
 45 | 
 46 |     /**
 47 |      * @var bool|null
 48 |      */
 49 |     private static $canGetVendors;
 50 | 
 51 |     /**
 52 |      * @var array[]
 53 |      * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
 54 |      */
 55 |     private static $installedByVendor = array();
 56 | 
 57 |     /**
 58 |      * Returns a list of all package names which are present, either by being installed, replaced or provided
 59 |      *
 60 |      * @return string[]
 61 |      * @psalm-return list<string>
 62 |      */
 63 |     public static function getInstalledPackages()
 64 |     {
 65 |         $packages = array();
 66 |         foreach (self::getInstalled() as $installed) {
 67 |             $packages[] = array_keys($installed['versions']);
 68 |         }
 69 | 
 70 |         if (1 === \count($packages)) {
 71 |             return $packages[0];
 72 |         }
 73 | 
 74 |         return array_keys(array_flip(\call_user_func_array('array_merge', $packages)));
 75 |     }
 76 | 
 77 |     /**
 78 |      * Returns a list of all package names with a specific type e.g. 'library'
 79 |      *
 80 |      * @param  string   $type
 81 |      * @return string[]
 82 |      * @psalm-return list<string>
 83 |      */
 84 |     public static function getInstalledPackagesByType($type)
 85 |     {
 86 |         $packagesByType = array();
 87 | 
 88 |         foreach (self::getInstalled() as $installed) {
 89 |             foreach ($installed['versions'] as $name => $package) {
 90 |                 if (isset($package['type']) && $package['type'] === $type) {
 91 |                     $packagesByType[] = $name;
 92 |                 }
 93 |             }
 94 |         }
 95 | 
 96 |         return $packagesByType;
 97 |     }
 98 | 
 99 |     /**
100 |      * Checks whether the given package is installed
101 |      *
102 |      * This also returns true if the package name is provided or replaced by another package
103 |      *
104 |      * @param  string $packageName
105 |      * @param  bool   $includeDevRequirements
106 |      * @return bool
107 |      */
108 |     public static function isInstalled($packageName, $includeDevRequirements = true)
109 |     {
110 |         foreach (self::getInstalled() as $installed) {
111 |             if (isset($installed['versions'][$packageName])) {
112 |                 return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
113 |             }
114 |         }
115 | 
116 |         return false;
117 |     }
118 | 
119 |     /**
120 |      * Checks whether the given package satisfies a version constraint
121 |      *
122 |      * e.g. If you want to know whether version 2.3+ of package foo/bar is installed, you would call:
123 |      *
124 |      *   Composer\InstalledVersions::satisfies(new VersionParser, 'foo/bar', '^2.3')
125 |      *
126 |      * @param  VersionParser $parser      Install composer/semver to have access to this class and functionality
127 |      * @param  string        $packageName
128 |      * @param  string|null   $constraint  A version constraint to check for, if you pass one you have to make sure composer/semver is required by your package
129 |      * @return bool
130 |      */
131 |     public static function satisfies(VersionParser $parser, $packageName, $constraint)
132 |     {
133 |         $constraint = $parser->parseConstraints((string) $constraint);
134 |         $provided = $parser->parseConstraints(self::getVersionRanges($packageName));
135 | 
136 |         return $provided->matches($constraint);
137 |     }
138 | 
139 |     /**
140 |      * Returns a version constraint representing all the range(s) which are installed for a given package
141 |      *
142 |      * It is easier to use this via isInstalled() with the $constraint argument if you need to check
143 |      * whether a given version of a package is installed, and not just whether it exists
144 |      *
145 |      * @param  string $packageName
146 |      * @return string Version constraint usable with composer/semver
147 |      */
148 |     public static function getVersionRanges($packageName)
149 |     {
150 |         foreach (self::getInstalled() as $installed) {
151 |             if (!isset($installed['versions'][$packageName])) {
152 |                 continue;
153 |             }
154 | 
155 |             $ranges = array();
156 |             if (isset($installed['versions'][$packageName]['pretty_version'])) {
157 |                 $ranges[] = $installed['versions'][$packageName]['pretty_version'];
158 |             }
159 |             if (array_key_exists('aliases', $installed['versions'][$packageName])) {
160 |                 $ranges = array_merge($ranges, $installed['versions'][$packageName]['aliases']);
161 |             }
162 |             if (array_key_exists('replaced', $installed['versions'][$packageName])) {
163 |                 $ranges = array_merge($ranges, $installed['versions'][$packageName]['replaced']);
164 |             }
165 |             if (array_key_exists('provided', $installed['versions'][$packageName])) {
166 |                 $ranges = array_merge($ranges, $installed['versions'][$packageName]['provided']);
167 |             }
168 | 
169 |             return implode(' || ', $ranges);
170 |         }
171 | 
172 |         throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
173 |     }
174 | 
175 |     /**
176 |      * @param  string      $packageName
177 |      * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as version, use satisfies or getVersionRanges if you need to know if a given version is present
178 |      */
179 |     public static function getVersion($packageName)
180 |     {
181 |         foreach (self::getInstalled() as $installed) {
182 |             if (!isset($installed['versions'][$packageName])) {
183 |                 continue;
184 |             }
185 | 
186 |             if (!isset($installed['versions'][$packageName]['version'])) {
187 |                 return null;
188 |             }
189 | 
190 |             return $installed['versions'][$packageName]['version'];
191 |         }
192 | 
193 |         throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
194 |     }
195 | 
196 |     /**
197 |      * @param  string      $packageName
198 |      * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as version, use satisfies or getVersionRanges if you need to know if a given version is present
199 |      */
200 |     public static function getPrettyVersion($packageName)
201 |     {
202 |         foreach (self::getInstalled() as $installed) {
203 |             if (!isset($installed['versions'][$packageName])) {
204 |                 continue;
205 |             }
206 | 
207 |             if (!isset($installed['versions'][$packageName]['pretty_version'])) {
208 |                 return null;
209 |             }
210 | 
211 |             return $installed['versions'][$packageName]['pretty_version'];
212 |         }
213 | 
214 |         throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
215 |     }
216 | 
217 |     /**
218 |      * @param  string      $packageName
219 |      * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as reference
220 |      */
221 |     public static function getReference($packageName)
222 |     {
223 |         foreach (self::getInstalled() as $installed) {
224 |             if (!isset($installed['versions'][$packageName])) {
225 |                 continue;
226 |             }
227 | 
228 |             if (!isset($installed['versions'][$packageName]['reference'])) {
229 |                 return null;
230 |             }
231 | 
232 |             return $installed['versions'][$packageName]['reference'];
233 |         }
234 | 
235 |         throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
236 |     }
237 | 
238 |     /**
239 |      * @param  string      $packageName
240 |      * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as install path. Packages of type metapackages also have a null install path.
241 |      */
242 |     public static function getInstallPath($packageName)
243 |     {
244 |         foreach (self::getInstalled() as $installed) {
245 |             if (!isset($installed['versions'][$packageName])) {
246 |                 continue;
247 |             }
248 | 
249 |             return isset($installed['versions'][$packageName]['install_path']) ? $installed['versions'][$packageName]['install_path'] : null;
250 |         }
251 | 
252 |         throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
253 |     }
254 | 
255 |     /**
256 |      * @return array
257 |      * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
258 |      */
259 |     public static function getRootPackage()
260 |     {
261 |         $installed = self::getInstalled();
262 | 
263 |         return $installed[0]['root'];
264 |     }
265 | 
266 |     /**
267 |      * Returns the raw installed.php data for custom implementations
268 |      *
269 |      * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
270 |      * @return array[]
271 |      * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
272 |      */
273 |     public static function getRawData()
274 |     {
275 |         @trigger_error('getRawData only returns the first dataset loaded, which may not be what you expect. Use getAllRawData() instead which returns all datasets for all autoloaders present in the process.', E_USER_DEPRECATED);
276 | 
277 |         if (null === self::$installed) {
278 |             // only require the installed.php file if this file is loaded from its dumped location,
279 |             // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
280 |             if (substr(__DIR__, -8, 1) !== 'C') {
281 |                 self::$installed = include __DIR__ . '/installed.php';
282 |             } else {
283 |                 self::$installed = array();
284 |             }
285 |         }
286 | 
287 |         return self::$installed;
288 |     }
289 | 
290 |     /**
291 |      * Returns the raw data of all installed.php which are currently loaded for custom implementations
292 |      *
293 |      * @return array[]
294 |      * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
295 |      */
296 |     public static function getAllRawData()
297 |     {
298 |         return self::getInstalled();
299 |     }
300 | 
301 |     /**
302 |      * Lets you reload the static array from another file
303 |      *
304 |      * This is only useful for complex integrations in which a project needs to use
305 |      * this class but then also needs to execute another project's autoloader in process,
306 |      * and wants to ensure both projects have access to their version of installed.php.
307 |      *
308 |      * A typical case would be PHPUnit, where it would need to make sure it reads all
309 |      * the data it needs from this class, then call reload() with
310 |      * `require $CWD/vendor/composer/installed.php` (or similar) as input to make sure
311 |      * the project in which it runs can then also use this class safely, without
312 |      * interference between PHPUnit's dependencies and the project's dependencies.
313 |      *
314 |      * @param  array[] $data A vendor/composer/installed.php data set
315 |      * @return void
316 |      *
317 |      * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
318 |      */
319 |     public static function reload($data)
320 |     {
321 |         self::$installed = $data;
322 |         self::$installedByVendor = array();
323 | 
324 |         // when using reload, we disable the duplicate protection to ensure that self::$installed data is
325 |         // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
326 |         // so we have to assume it does not, and that may result in duplicate data being returned when listing
327 |         // all installed packages for example
328 |         self::$installedIsLocalDir = false;
329 |     }
330 | 
331 |     /**
332 |      * @return string
333 |      */
334 |     private static function getSelfDir()
335 |     {
336 |         if (self::$selfDir === null) {
337 |             self::$selfDir = strtr(__DIR__, '\\', '/');
338 |         }
339 | 
340 |         return self::$selfDir;
341 |     }
342 | 
343 |     /**
344 |      * @return array[]
345 |      * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
346 |      */
347 |     private static function getInstalled()
348 |     {
349 |         if (null === self::$canGetVendors) {
350 |             self::$canGetVendors = method_exists('Composer\Autoload\ClassLoader', 'getRegisteredLoaders');
351 |         }
352 | 
353 |         $installed = array();
354 |         $copiedLocalDir = false;
355 | 
356 |         if (self::$canGetVendors) {
357 |             $selfDir = self::getSelfDir();
358 |             foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
359 |                 $vendorDir = strtr($vendorDir, '\\', '/');
360 |                 if (isset(self::$installedByVendor[$vendorDir])) {
361 |                     $installed[] = self::$installedByVendor[$vendorDir];
362 |                 } elseif (is_file($vendorDir.'/composer/installed.php')) {
363 |                     /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
364 |                     $required = require $vendorDir.'/composer/installed.php';
365 |                     self::$installedByVendor[$vendorDir] = $required;
366 |                     $installed[] = $required;
367 |                     if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
368 |                         self::$installed = $required;
369 |                         self::$installedIsLocalDir = true;
370 |                     }
371 |                 }
372 |                 if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
373 |                     $copiedLocalDir = true;
374 |                 }
375 |             }
376 |         }
377 | 
378 |         if (null === self::$installed) {
379 |             // only require the installed.php file if this file is loaded from its dumped location,
380 |             // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
381 |             if (substr(__DIR__, -8, 1) !== 'C') {
382 |                 /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
383 |                 $required = require __DIR__ . '/installed.php';
384 |                 self::$installed = $required;
385 |             } else {
386 |                 self::$installed = array();
387 |             }
388 |         }
389 | 
390 |         if (self::$installed !== array() && !$copiedLocalDir) {
391 |             $installed[] = self::$installed;
392 |         }
393 | 
394 |         return $installed;
395 |     }
396 | }
397 | 


--------------------------------------------------------------------------------
/vendor/composer/ClassLoader.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /*
  4 |  * This file is part of Composer.
  5 |  *
  6 |  * (c) Nils Adermann <naderman@naderman.de>
  7 |  *     Jordi Boggiano <j.boggiano@seld.be>
  8 |  *
  9 |  * For the full copyright and license information, please view the LICENSE
 10 |  * file that was distributed with this source code.
 11 |  */
 12 | 
 13 | namespace Composer\Autoload;
 14 | 
 15 | /**
 16 |  * ClassLoader implements a PSR-0, PSR-4 and classmap class loader.
 17 |  *
 18 |  *     $loader = new \Composer\Autoload\ClassLoader();
 19 |  *
 20 |  *     // register classes with namespaces
 21 |  *     $loader->add('Symfony\Component', __DIR__.'/component');
 22 |  *     $loader->add('Symfony',           __DIR__.'/framework');
 23 |  *
 24 |  *     // activate the autoloader
 25 |  *     $loader->register();
 26 |  *
 27 |  *     // to enable searching the include path (eg. for PEAR packages)
 28 |  *     $loader->setUseIncludePath(true);
 29 |  *
 30 |  * In this example, if you try to use a class in the Symfony\Component
 31 |  * namespace or one of its children (Symfony\Component\Console for instance),
 32 |  * the autoloader will first look for the class under the component/
 33 |  * directory, and it will then fallback to the framework/ directory if not
 34 |  * found before giving up.
 35 |  *
 36 |  * This class is loosely based on the Symfony UniversalClassLoader.
 37 |  *
 38 |  * @author Fabien Potencier <fabien@symfony.com>
 39 |  * @author Jordi Boggiano <j.boggiano@seld.be>
 40 |  * @see    https://www.php-fig.org/psr/psr-0/
 41 |  * @see    https://www.php-fig.org/psr/psr-4/
 42 |  */
 43 | class ClassLoader
 44 | {
 45 |     /** @var \Closure(string):void */
 46 |     private static $includeFile;
 47 | 
 48 |     /** @var string|null */
 49 |     private $vendorDir;
 50 | 
 51 |     // PSR-4
 52 |     /**
 53 |      * @var array<string, array<string, int>>
 54 |      */
 55 |     private $prefixLengthsPsr4 = array();
 56 |     /**
 57 |      * @var array<string, list<string>>
 58 |      */
 59 |     private $prefixDirsPsr4 = array();
 60 |     /**
 61 |      * @var list<string>
 62 |      */
 63 |     private $fallbackDirsPsr4 = array();
 64 | 
 65 |     // PSR-0
 66 |     /**
 67 |      * List of PSR-0 prefixes
 68 |      *
 69 |      * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
 70 |      *
 71 |      * @var array<string, array<string, list<string>>>
 72 |      */
 73 |     private $prefixesPsr0 = array();
 74 |     /**
 75 |      * @var list<string>
 76 |      */
 77 |     private $fallbackDirsPsr0 = array();
 78 | 
 79 |     /** @var bool */
 80 |     private $useIncludePath = false;
 81 | 
 82 |     /**
 83 |      * @var array<string, string>
 84 |      */
 85 |     private $classMap = array();
 86 | 
 87 |     /** @var bool */
 88 |     private $classMapAuthoritative = false;
 89 | 
 90 |     /**
 91 |      * @var array<string, bool>
 92 |      */
 93 |     private $missingClasses = array();
 94 | 
 95 |     /** @var string|null */
 96 |     private $apcuPrefix;
 97 | 
 98 |     /**
 99 |      * @var array<string, self>
100 |      */
101 |     private static $registeredLoaders = array();
102 | 
103 |     /**
104 |      * @param string|null $vendorDir
105 |      */
106 |     public function __construct($vendorDir = null)
107 |     {
108 |         $this->vendorDir = $vendorDir;
109 |         self::initializeIncludeClosure();
110 |     }
111 | 
112 |     /**
113 |      * @return array<string, list<string>>
114 |      */
115 |     public function getPrefixes()
116 |     {
117 |         if (!empty($this->prefixesPsr0)) {
118 |             return call_user_func_array('array_merge', array_values($this->prefixesPsr0));
119 |         }
120 | 
121 |         return array();
122 |     }
123 | 
124 |     /**
125 |      * @return array<string, list<string>>
126 |      */
127 |     public function getPrefixesPsr4()
128 |     {
129 |         return $this->prefixDirsPsr4;
130 |     }
131 | 
132 |     /**
133 |      * @return list<string>
134 |      */
135 |     public function getFallbackDirs()
136 |     {
137 |         return $this->fallbackDirsPsr0;
138 |     }
139 | 
140 |     /**
141 |      * @return list<string>
142 |      */
143 |     public function getFallbackDirsPsr4()
144 |     {
145 |         return $this->fallbackDirsPsr4;
146 |     }
147 | 
148 |     /**
149 |      * @return array<string, string> Array of classname => path
150 |      */
151 |     public function getClassMap()
152 |     {
153 |         return $this->classMap;
154 |     }
155 | 
156 |     /**
157 |      * @param array<string, string> $classMap Class to filename map
158 |      *
159 |      * @return void
160 |      */
161 |     public function addClassMap(array $classMap)
162 |     {
163 |         if ($this->classMap) {
164 |             $this->classMap = array_merge($this->classMap, $classMap);
165 |         } else {
166 |             $this->classMap = $classMap;
167 |         }
168 |     }
169 | 
170 |     /**
171 |      * Registers a set of PSR-0 directories for a given prefix, either
172 |      * appending or prepending to the ones previously set for this prefix.
173 |      *
174 |      * @param string              $prefix  The prefix
175 |      * @param list<string>|string $paths   The PSR-0 root directories
176 |      * @param bool                $prepend Whether to prepend the directories
177 |      *
178 |      * @return void
179 |      */
180 |     public function add($prefix, $paths, $prepend = false)
181 |     {
182 |         $paths = (array) $paths;
183 |         if (!$prefix) {
184 |             if ($prepend) {
185 |                 $this->fallbackDirsPsr0 = array_merge(
186 |                     $paths,
187 |                     $this->fallbackDirsPsr0
188 |                 );
189 |             } else {
190 |                 $this->fallbackDirsPsr0 = array_merge(
191 |                     $this->fallbackDirsPsr0,
192 |                     $paths
193 |                 );
194 |             }
195 | 
196 |             return;
197 |         }
198 | 
199 |         $first = $prefix[0];
200 |         if (!isset($this->prefixesPsr0[$first][$prefix])) {
201 |             $this->prefixesPsr0[$first][$prefix] = $paths;
202 | 
203 |             return;
204 |         }
205 |         if ($prepend) {
206 |             $this->prefixesPsr0[$first][$prefix] = array_merge(
207 |                 $paths,
208 |                 $this->prefixesPsr0[$first][$prefix]
209 |             );
210 |         } else {
211 |             $this->prefixesPsr0[$first][$prefix] = array_merge(
212 |                 $this->prefixesPsr0[$first][$prefix],
213 |                 $paths
214 |             );
215 |         }
216 |     }
217 | 
218 |     /**
219 |      * Registers a set of PSR-4 directories for a given namespace, either
220 |      * appending or prepending to the ones previously set for this namespace.
221 |      *
222 |      * @param string              $prefix  The prefix/namespace, with trailing '\\'
223 |      * @param list<string>|string $paths   The PSR-4 base directories
224 |      * @param bool                $prepend Whether to prepend the directories
225 |      *
226 |      * @throws \InvalidArgumentException
227 |      *
228 |      * @return void
229 |      */
230 |     public function addPsr4($prefix, $paths, $prepend = false)
231 |     {
232 |         $paths = (array) $paths;
233 |         if (!$prefix) {
234 |             // Register directories for the root namespace.
235 |             if ($prepend) {
236 |                 $this->fallbackDirsPsr4 = array_merge(
237 |                     $paths,
238 |                     $this->fallbackDirsPsr4
239 |                 );
240 |             } else {
241 |                 $this->fallbackDirsPsr4 = array_merge(
242 |                     $this->fallbackDirsPsr4,
243 |                     $paths
244 |                 );
245 |             }
246 |         } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
247 |             // Register directories for a new namespace.
248 |             $length = strlen($prefix);
249 |             if ('\\' !== $prefix[$length - 1]) {
250 |                 throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
251 |             }
252 |             $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
253 |             $this->prefixDirsPsr4[$prefix] = $paths;
254 |         } elseif ($prepend) {
255 |             // Prepend directories for an already registered namespace.
256 |             $this->prefixDirsPsr4[$prefix] = array_merge(
257 |                 $paths,
258 |                 $this->prefixDirsPsr4[$prefix]
259 |             );
260 |         } else {
261 |             // Append directories for an already registered namespace.
262 |             $this->prefixDirsPsr4[$prefix] = array_merge(
263 |                 $this->prefixDirsPsr4[$prefix],
264 |                 $paths
265 |             );
266 |         }
267 |     }
268 | 
269 |     /**
270 |      * Registers a set of PSR-0 directories for a given prefix,
271 |      * replacing any others previously set for this prefix.
272 |      *
273 |      * @param string              $prefix The prefix
274 |      * @param list<string>|string $paths  The PSR-0 base directories
275 |      *
276 |      * @return void
277 |      */
278 |     public function set($prefix, $paths)
279 |     {
280 |         if (!$prefix) {
281 |             $this->fallbackDirsPsr0 = (array) $paths;
282 |         } else {
283 |             $this->prefixesPsr0[$prefix[0]][$prefix] = (array) $paths;
284 |         }
285 |     }
286 | 
287 |     /**
288 |      * Registers a set of PSR-4 directories for a given namespace,
289 |      * replacing any others previously set for this namespace.
290 |      *
291 |      * @param string              $prefix The prefix/namespace, with trailing '\\'
292 |      * @param list<string>|string $paths  The PSR-4 base directories
293 |      *
294 |      * @throws \InvalidArgumentException
295 |      *
296 |      * @return void
297 |      */
298 |     public function setPsr4($prefix, $paths)
299 |     {
300 |         if (!$prefix) {
301 |             $this->fallbackDirsPsr4 = (array) $paths;
302 |         } else {
303 |             $length = strlen($prefix);
304 |             if ('\\' !== $prefix[$length - 1]) {
305 |                 throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
306 |             }
307 |             $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
308 |             $this->prefixDirsPsr4[$prefix] = (array) $paths;
309 |         }
310 |     }
311 | 
312 |     /**
313 |      * Turns on searching the include path for class files.
314 |      *
315 |      * @param bool $useIncludePath
316 |      *
317 |      * @return void
318 |      */
319 |     public function setUseIncludePath($useIncludePath)
320 |     {
321 |         $this->useIncludePath = $useIncludePath;
322 |     }
323 | 
324 |     /**
325 |      * Can be used to check if the autoloader uses the include path to check
326 |      * for classes.
327 |      *
328 |      * @return bool
329 |      */
330 |     public function getUseIncludePath()
331 |     {
332 |         return $this->useIncludePath;
333 |     }
334 | 
335 |     /**
336 |      * Turns off searching the prefix and fallback directories for classes
337 |      * that have not been registered with the class map.
338 |      *
339 |      * @param bool $classMapAuthoritative
340 |      *
341 |      * @return void
342 |      */
343 |     public function setClassMapAuthoritative($classMapAuthoritative)
344 |     {
345 |         $this->classMapAuthoritative = $classMapAuthoritative;
346 |     }
347 | 
348 |     /**
349 |      * Should class lookup fail if not found in the current class map?
350 |      *
351 |      * @return bool
352 |      */
353 |     public function isClassMapAuthoritative()
354 |     {
355 |         return $this->classMapAuthoritative;
356 |     }
357 | 
358 |     /**
359 |      * APCu prefix to use to cache found/not-found classes, if the extension is enabled.
360 |      *
361 |      * @param string|null $apcuPrefix
362 |      *
363 |      * @return void
364 |      */
365 |     public function setApcuPrefix($apcuPrefix)
366 |     {
367 |         $this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null;
368 |     }
369 | 
370 |     /**
371 |      * The APCu prefix in use, or null if APCu caching is not enabled.
372 |      *
373 |      * @return string|null
374 |      */
375 |     public function getApcuPrefix()
376 |     {
377 |         return $this->apcuPrefix;
378 |     }
379 | 
380 |     /**
381 |      * Registers this instance as an autoloader.
382 |      *
383 |      * @param bool $prepend Whether to prepend the autoloader or not
384 |      *
385 |      * @return void
386 |      */
387 |     public function register($prepend = false)
388 |     {
389 |         spl_autoload_register(array($this, 'loadClass'), true, $prepend);
390 | 
391 |         if (null === $this->vendorDir) {
392 |             return;
393 |         }
394 | 
395 |         if ($prepend) {
396 |             self::$registeredLoaders = array($this->vendorDir => $this) + self::$registeredLoaders;
397 |         } else {
398 |             unset(self::$registeredLoaders[$this->vendorDir]);
399 |             self::$registeredLoaders[$this->vendorDir] = $this;
400 |         }
401 |     }
402 | 
403 |     /**
404 |      * Unregisters this instance as an autoloader.
405 |      *
406 |      * @return void
407 |      */
408 |     public function unregister()
409 |     {
410 |         spl_autoload_unregister(array($this, 'loadClass'));
411 | 
412 |         if (null !== $this->vendorDir) {
413 |             unset(self::$registeredLoaders[$this->vendorDir]);
414 |         }
415 |     }
416 | 
417 |     /**
418 |      * Loads the given class or interface.
419 |      *
420 |      * @param  string    $class The name of the class
421 |      * @return true|null True if loaded, null otherwise
422 |      */
423 |     public function loadClass($class)
424 |     {
425 |         if ($file = $this->findFile($class)) {
426 |             $includeFile = self::$includeFile;
427 |             $includeFile($file);
428 | 
429 |             return true;
430 |         }
431 | 
432 |         return null;
433 |     }
434 | 
435 |     /**
436 |      * Finds the path to the file where the class is defined.
437 |      *
438 |      * @param string $class The name of the class
439 |      *
440 |      * @return string|false The path if found, false otherwise
441 |      */
442 |     public function findFile($class)
443 |     {
444 |         // class map lookup
445 |         if (isset($this->classMap[$class])) {
446 |             return $this->classMap[$class];
447 |         }
448 |         if ($this->classMapAuthoritative || isset($this->missingClasses[$class])) {
449 |             return false;
450 |         }
451 |         if (null !== $this->apcuPrefix) {
452 |             $file = apcu_fetch($this->apcuPrefix.$class, $hit);
453 |             if ($hit) {
454 |                 return $file;
455 |             }
456 |         }
457 | 
458 |         $file = $this->findFileWithExtension($class, '.php');
459 | 
460 |         // Search for Hack files if we are running on HHVM
461 |         if (false === $file && defined('HHVM_VERSION')) {
462 |             $file = $this->findFileWithExtension($class, '.hh');
463 |         }
464 | 
465 |         if (null !== $this->apcuPrefix) {
466 |             apcu_add($this->apcuPrefix.$class, $file);
467 |         }
468 | 
469 |         if (false === $file) {
470 |             // Remember that this class does not exist.
471 |             $this->missingClasses[$class] = true;
472 |         }
473 | 
474 |         return $file;
475 |     }
476 | 
477 |     /**
478 |      * Returns the currently registered loaders keyed by their corresponding vendor directories.
479 |      *
480 |      * @return array<string, self>
481 |      */
482 |     public static function getRegisteredLoaders()
483 |     {
484 |         return self::$registeredLoaders;
485 |     }
486 | 
487 |     /**
488 |      * @param  string       $class
489 |      * @param  string       $ext
490 |      * @return string|false
491 |      */
492 |     private function findFileWithExtension($class, $ext)
493 |     {
494 |         // PSR-4 lookup
495 |         $logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext;
496 | 
497 |         $first = $class[0];
498 |         if (isset($this->prefixLengthsPsr4[$first])) {
499 |             $subPath = $class;
500 |             while (false !== $lastPos = strrpos($subPath, '\\')) {
501 |                 $subPath = substr($subPath, 0, $lastPos);
502 |                 $search = $subPath . '\\';
503 |                 if (isset($this->prefixDirsPsr4[$search])) {
504 |                     $pathEnd = DIRECTORY_SEPARATOR . substr($logicalPathPsr4, $lastPos + 1);
505 |                     foreach ($this->prefixDirsPsr4[$search] as $dir) {
506 |                         if (file_exists($file = $dir . $pathEnd)) {
507 |                             return $file;
508 |                         }
509 |                     }
510 |                 }
511 |             }
512 |         }
513 | 
514 |         // PSR-4 fallback dirs
515 |         foreach ($this->fallbackDirsPsr4 as $dir) {
516 |             if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr4)) {
517 |                 return $file;
518 |             }
519 |         }
520 | 
521 |         // PSR-0 lookup
522 |         if (false !== $pos = strrpos($class, '\\')) {
523 |             // namespaced class name
524 |             $logicalPathPsr0 = substr($logicalPathPsr4, 0, $pos + 1)
525 |                 . strtr(substr($logicalPathPsr4, $pos + 1), '_', DIRECTORY_SEPARATOR);
526 |         } else {
527 |             // PEAR-like class name
528 |             $logicalPathPsr0 = strtr($class, '_', DIRECTORY_SEPARATOR) . $ext;
529 |         }
530 | 
531 |         if (isset($this->prefixesPsr0[$first])) {
532 |             foreach ($this->prefixesPsr0[$first] as $prefix => $dirs) {
533 |                 if (0 === strpos($class, $prefix)) {
534 |                     foreach ($dirs as $dir) {
535 |                         if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) {
536 |                             return $file;
537 |                         }
538 |                     }
539 |                 }
540 |             }
541 |         }
542 | 
543 |         // PSR-0 fallback dirs
544 |         foreach ($this->fallbackDirsPsr0 as $dir) {
545 |             if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) {
546 |                 return $file;
547 |             }
548 |         }
549 | 
550 |         // PSR-0 include paths.
551 |         if ($this->useIncludePath && $file = stream_resolve_include_path($logicalPathPsr0)) {
552 |             return $file;
553 |         }
554 | 
555 |         return false;
556 |     }
557 | 
558 |     /**
559 |      * @return void
560 |      */
561 |     private static function initializeIncludeClosure()
562 |     {
563 |         if (self::$includeFile !== null) {
564 |             return;
565 |         }
566 | 
567 |         /**
568 |          * Scope isolated include.
569 |          *
570 |          * Prevents access to $this/self from included files.
571 |          *
572 |          * @param  string $file
573 |          * @return void
574 |          */
575 |         self::$includeFile = \Closure::bind(static function($file) {
576 |             include $file;
577 |         }, null, null);
578 |     }
579 | }
580 | 


--------------------------------------------------------------------------------
/bootstrap.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | /*
  3 | Plugin Name: Intercom
  4 | Plugin URI: https://wordpress.org/plugins/intercom
  5 | Description: Official <a href="https://www.intercom.io">Intercom</a> support for WordPress.
  6 | Author: Intercom
  7 | Author URI: https://www.intercom.io
  8 | Version: 3.0.2
  9 |  */
 10 | 
 11 | define('INTERCOM_PLUGIN_VERSION', '3.0.2');
 12 | 
 13 | require_once __DIR__ . '/vendor/autoload.php';
 14 | use Firebase\JWT\JWT;
 15 | 
 16 | class TimeProvider
 17 | {
 18 |     private static $mockTime = null;
 19 | 
 20 |     public static function setMockTime($timestamp)
 21 |     {
 22 |         self::$mockTime = $timestamp;
 23 |     }
 24 | 
 25 |     public static function resetMockTime()
 26 |     {
 27 |         self::$mockTime = null;
 28 |     }
 29 | 
 30 |     public static function getCurrentTime()
 31 |     {
 32 |         return self::$mockTime !== null ? self::$mockTime : time();
 33 |     }
 34 | }
 35 | 
 36 | class MessengerSecurityCalculator
 37 | {
 38 |   private $raw_data = array();
 39 |   private $secret_key = "";
 40 | 
 41 |   public function __construct($data, $secret_key)
 42 |   {
 43 |     $this->raw_data = $data;
 44 |     $this->secret_key = $secret_key;
 45 |   }
 46 | 
 47 |   public function messengerSecurityComponent()
 48 |   {
 49 |     $secret_key = $this->getSecretKey();
 50 | 
 51 |     if (empty($secret_key))
 52 |     {
 53 |       return $this->getRawData();
 54 |     }
 55 |     if (array_key_exists("user_id", $this->getRawData()) || array_key_exists("email", $this->getRawData()))
 56 |     {
 57 |       return $this->messengerSecurityJWTComponent();
 58 |     }
 59 | 
 60 |     return $this->getRawData();
 61 |   }
 62 | 
 63 |   private function messengerSecurityJWTComponent()
 64 |   {
 65 |     $raw_data = $this->getRawData();
 66 | 
 67 |     $filtered_data = $raw_data;
 68 |     $payload = array();
 69 | 
 70 |     if (array_key_exists("email", $filtered_data)) {
 71 |       unset($filtered_data["email"]);
 72 |       $payload["user_id"] = $raw_data["email"];
 73 |       $payload["email"] = $raw_data["email"];
 74 |     }
 75 |     if (array_key_exists("user_id", $filtered_data)) {
 76 |       unset($filtered_data["user_id"]);
 77 |       $payload["user_id"] = $raw_data["user_id"];
 78 |     }
 79 |     if (array_key_exists("name", $filtered_data)) {
 80 |       unset($filtered_data["name"]);
 81 |       $payload["name"] = $raw_data["name"];
 82 |     }
 83 | 
 84 |     $payload = array_merge($payload, apply_filters("intercom_sensitive_attributes", array()));
 85 |     $payload["exp"] = TimeProvider::getCurrentTime() + 3600;
 86 | 
 87 |     $filtered_data["intercom_user_jwt"] = JWT::encode(
 88 |       $payload, $this->getSecretKey(),
 89 |       'HS256'
 90 |     );
 91 | 
 92 |     return $filtered_data;
 93 |   }
 94 | 
 95 |   private function getSecretKey()
 96 |   {
 97 |     return $this->secret_key;
 98 |   }
 99 | 
100 |   private function getRawData()
101 |   {
102 |     return $this->raw_data;
103 |   }
104 | }
105 | 
106 | class IntercomSettingsPage
107 | {
108 |   private $settings = array();
109 |   private $styles = array();
110 | 
111 |   public function __construct($settings)
112 |   {
113 |     $this->settings = $settings;
114 |     $this->styles = $this->setStyles($settings);
115 |   }
116 | 
117 |   public function dismissibleMessage($text)
118 |   {
119 |     return <<<END
120 |   <div id="message" class="updated notice is-dismissible">
121 |     <p>$text</p>
122 |     <button type="button" class="notice-dismiss"><span class="screen-reader-text">Dismiss this notice.</span></button>
123 |   </div>
124 | END;
125 |   }
126 | 
127 |   public function getAuthUrl() {
128 |     return "https://wordpress_auth.intercom.io/confirm?state=".get_site_url()."::".wp_create_nonce('intercom-oauth');
129 |   }
130 | 
131 |   public function htmlUnclosed()
132 |   {
133 |     $settings = $this->getSettings();
134 |     $styles = $this->getStyles();
135 |     $app_id = WordPressEscaper::escAttr($settings['app_id']);
136 |     $secret = WordPressEscaper::escAttr($settings['secret']);
137 |     $auth_url = $this->getAuthUrl();
138 |     $dismissable_message = '';
139 |     if (isset($_GET['appId'])) {
140 |       // Copying app_id from setup guide
141 |       $app_id = WordPressEscaper::escAttr($_GET['appId']);
142 |       $dismissable_message = $this->dismissibleMessage("We've copied your new Intercom app id below. click to save changes and then close this window to finish signing up for Intercom.");
143 |     }
144 |     if (isset($_GET['saved'])) {
145 |       $dismissable_message = $this->dismissibleMessage("Your app id has been successfully saved. You can now close this window to finish signing up for Intercom.");
146 |     }
147 |     if (isset($_GET['authenticated'])) {
148 |       $dismissable_message = $this->dismissibleMessage('You successfully authenticated with Intercom');
149 |     }
150 | 
151 |     return <<<END
152 | 
153 |     <link rel="stylesheet" property='stylesheet' href="https://marketing.intercomassets.com/assets/redesign-ead0ee66f7c89e2930e04ac1b7e423494c29e8e681382f41d0b6b8a98b4591e1.css">
154 |     <style>
155 |       #wpcontent {
156 |         background-color: #ffffff;
157 |       }
158 |     </style>
159 | 
160 |     <div class="wrap">
161 |       $dismissable_message
162 | 
163 |       <section id="main_content" style="padding-top: 70px;">
164 |         <div class="container">
165 |           <div class="cta">
166 | 
167 |             <div class="sp__2--lg sp__2--xlg"></div>
168 |             <div id="oauth_content" style="$styles[app_id_link_style]">
169 |               <div class="t__h1 c__red">Get started with Intercom</div>
170 | 
171 |               <div class="cta__desc">
172 |                 Chat with visitors to your website in real-time, capture them as leads, and convert them to customers. Install Intercom on your WordPress site in a couple of clicks.
173 |               </div>
174 | 
175 |               <div id="get_intercom_btn_container" style="position:relative;margin-top:30px;">
176 |                 <a href="$auth_url">
177 |                   <img src="https://static.intercomassets.com/assets/oauth/primary-7edb2ebce84c088063f4b86049747c3a.png" srcset="https://static.intercomassets.com/assets/oauth/primary-7edb2ebce84c088063f4b86049747c3a.png 1x, https://static.intercomassets.com/assets/oauth/primary@2x-0d69ca2141dfdfa0535634610be80994.png 2x, https://static.intercomassets.com/assets/oauth/primary@3x-788ed3c44d63a6aec3927285e920f542.png 3x"/>
178 |                 </a>
179 |               </div>
180 |             </div>
181 | 
182 |             <div class="t__h1 c__red" style="$styles[app_id_copy_title]">Intercom setup</div>
183 |             <div class="t__h1 c__red" style="$styles[app_id_saved_title]">Intercom app ID saved</div>
184 |             <div id="app_id_and_secret_content" style="$styles[app_id_row_style]">
185 |               <div class="t__h1 c__red" style="$styles[app_id_copy_hidden]">Intercom has been installed</div>
186 | 
187 |               <div class="cta__desc">
188 |                 <div style="$styles[app_id_copy_hidden]">
189 |                   Intercom is now set up and ready to go. You can now chat with your existing and potential new customers, send them targeted messages, and get feedback.
190 |                   <br/>
191 |                   <br/>
192 |                   <a class="c__blue" href="https://app.intercom.com/a/apps/$app_id" target="_blank">Click here to access your Intercom Team Inbox.</a>
193 |                   <br/>
194 |                   <br/>
195 |                   Need help? <a class="c__blue" href="https://docs.intercom.io/for-converting-visitors-to-users" target="_blank">Visit our documentation</a> for best practices, tips, and much more.
196 |                   <br/>
197 |                   <br/>
198 |                 </div>
199 | 
200 |                 <div>
201 |                   <div style="font-size:0.87em;$styles[app_id_copy_hidden]">
202 |                   Learn more about our products : <a class="c__blue" href="https://www.intercom.com/customer-engagement" target="_blank">Messages</a>, <a class="c__blue" href="https://www.intercom.com/customer-support-software/knowledge-base" target="_blank">Articles</a> and <a class="c__blue" href="https://www.intercom.com/customer-support-software/help-desk" target="_blank">Inbox</a>.
203 |                   </div>
204 |                   <form method="post" action="" name="update_settings">
205 |                     <table class="form-table" align="center" style="margin-top: 16px; width: inherit;">
206 |                       <tbody>
207 |                         <tr>
208 |                           <th scope="row" style="text-align: center; vertical-align: middle;"><label for="intercom_app_id">App ID</label></th>
209 |                           <td>
210 |                             <input id="intercom_app_id" $styles[app_id_state] name="app_id" type="text" value="$app_id" class="$styles[app_id_class]">
211 |                             <button type="submit" class="btn btn__primary cta__submit" style="$styles[button_submit_style]">Save</button>
212 |                           </td>
213 |                         </tr>
214 |                       </tbody>
215 |                     </table>
216 | 
217 | END;
218 |   }
219 | 
220 |   public function htmlClosed()
221 |   {
222 |     $settings = $this->getSettings();
223 |     $styles = $this->getStyles();
224 |     $auth_url = $this->getAuthUrl();
225 |     $secret = WordPressEscaper::escAttr($settings['secret']);
226 |     $app_id = WordPressEscaper::escAttr($settings['app_id']);
227 |     $auth_url_identity_verification = "";
228 |     if (empty($secret) && !empty($app_id)) {
229 |       $auth_url_identity_verification = $auth_url.'&enable_identity_verification=1';
230 |     }
231 |     return <<<END
232 |                   </form>
233 |                   <div style="$styles[app_id_copy_hidden]">
234 |                     <div style="$styles[app_secret_link_style]">
235 |                       <a class="c__blue" href="$auth_url_identity_verification">Authenticate with your Intercom application to enable Identity Verification</a>
236 |                     </div>
237 |                     <p style="font-size:0.86em">Identity Verification ensures that conversations between you and your users are kept private.<br/>
238 |                     <br/>
239 |                       <a class="c__blue" href="https://docs.intercom.com/configure-intercom-for-your-product-or-site/staying-secure/enable-identity-verification-on-your-web-product" target="_blank">Learn more about Identity Verification</a>
240 |                     </p>
241 |                     <br/>
242 |                     <div style="font-size:0.8em">If the Intercom application associated with your WordPress is incorrect, please <a class="c__blue" href="$auth_url">click here</a> to reconnect with Intercom, to choose a new application.</div>
243 |                   </div>
244 |                 </div>
245 |               </div>
246 |             </div>
247 |           </div>
248 |         </div>
249 |       </section>
250 |     </div>
251 |     <script src="https://code.jquery.com/jquery-2.2.0.min.js"></script>
252 | END;
253 |   }
254 | 
255 |   public function html()
256 |   {
257 |     return $this->htmlUnclosed() . $this->htmlClosed();
258 |   }
259 | 
260 |   public function setStyles($settings) {
261 |     $styles = array();
262 |     $app_id = WordPressEscaper::escAttr($settings['app_id']);
263 |     $secret = WordPressEscaper::escAttr($settings['secret']);
264 |     $identity_verification = WordPressEscaper::escAttr($settings['identity_verification']);
265 | 
266 |     // Use Case : Identity Verification enabled : checkbox checked and disabled
267 |     if($identity_verification) {
268 |       $styles['identity_verification_state'] = 'checked disabled';
269 |     } else {
270 |       $styles['identity_verification_state'] = '';
271 |     }
272 | 
273 |     // Use Case : app_id here but Identity Verification disabled
274 |     if (empty($secret) && !empty($app_id)) {
275 |       $styles['app_secret_row_style'] = 'display: none;';
276 |       $styles['app_secret_link_style'] = '';
277 |     } else {
278 |       $styles['app_secret_row_style'] = '';
279 |       $styles['app_secret_link_style'] = 'display: none;';
280 |     }
281 | 
282 |     // Copying appId from Intercom Setup Guide for validation
283 |     if (isset($_GET['appId'])) {
284 |         $app_id = WordPressEscaper::escAttr($_GET['appId']);
285 |         $styles['app_id_state'] = 'readonly';
286 |         $styles['app_id_class'] = "cta__email";
287 |         $styles['button_submit_style'] = '';
288 |         $styles['app_id_copy_hidden'] = 'display: none;';
289 |         $styles['app_id_copy_title'] = '';
290 |         $styles['identity_verification_state'] = 'disabled'; # Prevent from sending POST data about identity_verification when using app_id form
291 |     } else {
292 |       $styles['app_id_class'] = "";
293 |       $styles['button_submit_style'] = 'display: none;';
294 |       $styles['app_id_copy_title'] = 'display: none;';
295 |       $styles['app_id_state'] = 'disabled'; # Prevent from sending POST data about app_id when using identity_verification form
296 |       $styles['app_id_copy_hidden'] = '';
297 |     }
298 | 
299 |     //Use Case App_id successfully copied
300 |     if (isset($_GET['saved'])) {
301 |       $styles['app_id_copy_hidden'] = 'display: none;';
302 |       $styles['app_id_saved_title'] = '';
303 |     } else {
304 |       $styles['app_id_saved_title'] = 'display: none;';
305 |     }
306 | 
307 |     // Display 'connect with intercom' button if no app_id provided (copied from setup guide or from Oauth)
308 |     if (empty($app_id)) {
309 |       $styles['app_id_row_style'] = 'display: none;';
310 |       $styles['app_id_link_style'] = '';
311 |     } else {
312 |       $styles['app_id_row_style'] = '';
313 |       $styles['app_id_link_style'] = 'display: none;';
314 |     }
315 |     return $styles;
316 |   }
317 | 
318 |   private function getSettings()
319 |   {
320 |     return $this->settings;
321 |   }
322 | 
323 |   private function getStyles()
324 |   {
325 |     return $this->styles;
326 |   }
327 | }
328 | 
329 | class IntercomSnippet
330 | {
331 |   private $snippet_settings = "";
332 | 
333 |   public function __construct($snippet_settings)
334 |   {
335 |     $this->snippet_settings = $snippet_settings;
336 |   }
337 |   public function html()
338 |   {
339 |     return $this->shutdown_on_logout() . $this->source();
340 |   }
341 | 
342 |   private function shutdown_on_logout()
343 |   {
344 |     return <<<HTML
345 | <script data-cfasync="false">
346 |   document.onreadystatechange = function () {
347 |     if (document.readyState == "complete") {
348 |       var logout_link = document.querySelectorAll('a[href*="wp-login.php?action=logout"]');
349 |       if (logout_link) {
350 |         for(var i=0; i < logout_link.length; i++) {
351 |           logout_link[i].addEventListener( "click", function() {
352 |             Intercom('shutdown');
353 |           });
354 |         }
355 |       }
356 |     }
357 |   };
358 | </script>
359 | 
360 | HTML;
361 |   }
362 | 
363 |   private function source()
364 |   {
365 |     $snippet_json = $this->snippet_settings->json();
366 |     $app_id = $this->snippet_settings->appId();
367 | 
368 |     return <<<HTML
369 | <script data-cfasync="false">
370 |   window.intercomSettings = $snippet_json;
371 | </script>
372 | <script data-cfasync="false">(function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',w.intercomSettings);}else{var d=document;var i=function(){i.c(arguments);};i.q=[];i.c=function(args){i.q.push(args);};w.Intercom=i;var l=function(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='https://widget.intercom.io/widget/$app_id';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s, x);};if(document.readyState==='complete'){l();}else if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}}})()</script>
373 | HTML;
374 |   }
375 | }
376 | 
377 | class IntercomSnippetSettings
378 | {
379 |   private $raw_data = array();
380 |   private $secret = NULL;
381 |   private $wordpress_user = NULL;
382 | 
383 |   public function __construct($raw_data, $secret = NULL, $wordpress_user = NULL, $constants = array('ICL_LANGUAGE_CODE' => 'language_override'))
384 |   {
385 |     $this->raw_data = $this->validateRawData($raw_data);
386 |     $this->secret = $secret;
387 |     $this->wordpress_user = $wordpress_user;
388 |     $this->constants = $constants;
389 |   }
390 | 
391 |   public function json()
392 |   {
393 |     return json_encode($this->getRawData());
394 |   }
395 | 
396 |   public function appId()
397 |   {
398 |     $raw_data = $this->getRawData();
399 |     return $raw_data["app_id"];
400 |   }
401 | 
402 |   private function getRawData()
403 |   {
404 |     $user = new IntercomUser($this->wordpress_user, $this->raw_data);
405 |     $messengerSecurityCalculator = new MessengerSecurityCalculator($user->buildSettings(), $this->secret);
406 |     $settings = $messengerSecurityCalculator->messengerSecurityComponent();
407 |     $result = $this->mergeConstants(apply_filters("intercom_settings", $settings));
408 |     $result['installation_type'] = 'wordpress';
409 |     $result['installation_version'] = INTERCOM_PLUGIN_VERSION;
410 |     return $result;
411 |   }
412 | 
413 |   private function mergeConstants($settings) {
414 |     foreach($this->constants as $key => $value) {
415 |       if (defined($key)) {
416 |         $const_val = WordPressEscaper::escJS(constant($key));
417 |         $settings = array_merge($settings, array($value => $const_val));
418 |       }
419 |     }
420 |     return $settings;
421 |   }
422 | 
423 |   private function validateRawData($raw_data)
424 |   {
425 |     if (!array_key_exists("app_id", $raw_data)) {
426 |       throw new Exception("app_id is required");
427 |     }
428 |     return $raw_data;
429 |   }
430 | }
431 | 
432 | if (getenv('INTERCOM_PLUGIN_TEST') == '1' && !function_exists('apply_filters')) {
433 |   function apply_filters($key, $value) {
434 |     if ($key == "intercom_sensitive_attributes") {
435 |       $extra_data_key = 'INTERCOM_PLUGIN_TEST_JWT_DATA';
436 |     } elseif ($key == "intercom_settings") {
437 |       $extra_data_key = 'INTERCOM_PLUGIN_TEST_SETTINGS';
438 |     }
439 | 
440 |     $extra_data = getenv($extra_data_key);
441 |     if ($extra_data) {
442 |       $extra_data = json_decode($extra_data, true);
443 |       return array_merge($value, $extra_data);
444 |     }
445 | 
446 |     return $value;
447 |   }
448 | }
449 | 
450 | class WordPressEscaper
451 | {
452 |   public static function escAttr($value)
453 |   {
454 |     if (function_exists('esc_attr')) {
455 |       return esc_attr($value);
456 |     } else {
457 |       if (getenv('INTERCOM_PLUGIN_TEST') == '1') {
458 |         return $value;
459 |       }
460 |     }
461 |   }
462 | 
463 |   public static function escJS($value)
464 |   {
465 |     if (function_exists('esc_js')) {
466 |       return esc_js($value);
467 |     } else {
468 |       if (getenv('INTERCOM_PLUGIN_TEST') == '1') {
469 |         return $value;
470 |       }
471 |     }
472 |   }
473 | }
474 | 
475 | class IntercomUser
476 | {
477 |   private $wordpress_user = NULL;
478 |   private $settings = array();
479 | 
480 |   public function __construct($wordpress_user, $settings)
481 |   {
482 |     $this->wordpress_user = $wordpress_user;
483 |     $this->settings = $settings;
484 |   }
485 | 
486 |   public function buildSettings()
487 |   {
488 |     if (empty($this->wordpress_user))
489 |     {
490 |       return $this->settings;
491 |     }
492 |     if (!empty($this->wordpress_user->user_email))
493 |     {
494 |       $this->settings["email"] = WordPressEscaper::escJS($this->wordpress_user->user_email);
495 |     }
496 |     if (!empty($this->wordpress_user->ID))
497 |     {
498 |       $this->settings["user_id"] = WordPressEscaper::escJS($this->wordpress_user->ID);
499 |     }
500 |     if (!empty($this->wordpress_user->display_name))
501 |     {
502 |       $this->settings["name"] = WordPressEscaper::escJS($this->wordpress_user->display_name);
503 |     }
504 |     return $this->settings;
505 |   }
506 | }
507 | 
508 | class Validator
509 | {
510 |   private $inputs = array();
511 |   private $validation;
512 | 
513 |   public function __construct($inputs, $validation)
514 |   {
515 |     $this->input = $inputs;
516 |     $this->validation = $validation;
517 |   }
518 | 
519 |   public function validAppId()
520 |   {
521 |     return $this->validate($this->input["app_id"]);
522 |   }
523 | 
524 |   public function validSecret()
525 |   {
526 |     return $this->validate($this->input["secret"]);
527 |   }
528 | 
529 |   private function validate($x)
530 |   {
531 |     return call_user_func($this->validation, $x);
532 |   }
533 | }
534 | 
535 | if (getenv('INTERCOM_PLUGIN_TEST') != '1') {
536 |   if (!defined('ABSPATH')) exit;
537 | }
538 | 
539 | function add_intercom_snippet()
540 | {
541 |   $options = get_option('intercom');
542 |   $snippet_settings = new IntercomSnippetSettings(
543 |     array("app_id" => WordPressEscaper::escJS($options['app_id'])),
544 |     WordPressEscaper::escJS($options['secret']),
545 |     wp_get_current_user()
546 |   );
547 |   $snippet = new IntercomSnippet($snippet_settings);
548 |   echo $snippet->html();
549 | }
550 | 
551 | function add_intercom_settings_page()
552 | {
553 |   add_options_page(
554 |     'Intercom Settings',
555 |     'Intercom',
556 |     'manage_options',
557 |     'intercom',
558 |     'render_intercom_options_page'
559 |   );
560 | }
561 | 
562 | function render_intercom_options_page()
563 | {
564 |   if (!current_user_can('manage_options'))
565 |   {
566 |     wp_die('You do not have sufficient permissions to access Intercom settings');
567 |   }
568 |   $options = get_option('intercom');
569 |   $settings_page = new IntercomSettingsPage(array("app_id" => $options['app_id'], "secret" => $options['secret']));
570 |   echo $settings_page->htmlUnclosed();
571 |   wp_nonce_field('intercom-update');
572 |   echo $settings_page->htmlClosed();
573 | }
574 | 
575 | function intercom_settings() {
576 |   register_setting('intercom', 'intercom');
577 |   if (isset($_GET['state']) && wp_verify_nonce($_GET[ 'state'], 'intercom-oauth') && current_user_can('manage_options') && isset($_GET['app_id']) && isset($_GET['secret']) ) {
578 |     $validator = new Validator($_GET, function($x) { return wp_kses(trim($x), array()); });
579 |     update_option("intercom", array("app_id" => $validator->validAppId(), "secret" => $validator->validSecret()));
580 |     $redirect_to = 'options-general.php?page=intercom&authenticated=1';
581 |     wp_safe_redirect(admin_url($redirect_to));
582 |   }
583 |   if (current_user_can('manage_options') && isset($_POST['app_id']) && isset($_POST[ '_wpnonce']) && wp_verify_nonce($_POST[ '_wpnonce'],'intercom-update')) {
584 |       $options = array();
585 |       $options["app_id"] = WordPressEscaper::escAttr($_POST['app_id']);
586 |       update_option("intercom", $options);
587 |       wp_safe_redirect(admin_url('options-general.php?page=intercom&saved=1'));
588 |   }
589 | }
590 | 
591 | if (getenv('INTERCOM_PLUGIN_TEST') != '1') {
592 |   add_action('admin_menu', 'add_intercom_settings_page');
593 |   add_action('network_admin_menu', 'add_intercom_settings_page');
594 |   add_action('admin_init', 'intercom_settings');
595 |   // Add in priority to load the snippet last
596 |   add_action('wp_footer', 'add_intercom_snippet', 999);
597 | }
598 | 


--------------------------------------------------------------------------------
/vendor/firebase/php-jwt/src/JWT.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | namespace Firebase\JWT;
  4 | 
  5 | use ArrayAccess;
  6 | use DateTime;
  7 | use DomainException;
  8 | use Exception;
  9 | use InvalidArgumentException;
 10 | use OpenSSLAsymmetricKey;
 11 | use OpenSSLCertificate;
 12 | use stdClass;
 13 | use UnexpectedValueException;
 14 | 
 15 | /**
 16 |  * JSON Web Token implementation, based on this spec:
 17 |  * https://tools.ietf.org/html/rfc7519
 18 |  *
 19 |  * PHP version 5
 20 |  *
 21 |  * @category Authentication
 22 |  * @package  Authentication_JWT
 23 |  * @author   Neuman Vong <neuman@twilio.com>
 24 |  * @author   Anant Narayanan <anant@php.net>
 25 |  * @license  http://opensource.org/licenses/BSD-3-Clause 3-clause BSD
 26 |  * @link     https://github.com/firebase/php-jwt
 27 |  */
 28 | class JWT
 29 | {
 30 |     private const ASN1_INTEGER = 0x02;
 31 |     private const ASN1_SEQUENCE = 0x10;
 32 |     private const ASN1_BIT_STRING = 0x03;
 33 | 
 34 |     /**
 35 |      * When checking nbf, iat or expiration times,
 36 |      * we want to provide some extra leeway time to
 37 |      * account for clock skew.
 38 |      *
 39 |      * @var int
 40 |      */
 41 |     public static $leeway = 0;
 42 | 
 43 |     /**
 44 |      * Allow the current timestamp to be specified.
 45 |      * Useful for fixing a value within unit testing.
 46 |      * Will default to PHP time() value if null.
 47 |      *
 48 |      * @var ?int
 49 |      */
 50 |     public static $timestamp = null;
 51 | 
 52 |     /**
 53 |      * @var array<string, string[]>
 54 |      */
 55 |     public static $supported_algs = [
 56 |         'ES384' => ['openssl', 'SHA384'],
 57 |         'ES256' => ['openssl', 'SHA256'],
 58 |         'ES256K' => ['openssl', 'SHA256'],
 59 |         'HS256' => ['hash_hmac', 'SHA256'],
 60 |         'HS384' => ['hash_hmac', 'SHA384'],
 61 |         'HS512' => ['hash_hmac', 'SHA512'],
 62 |         'RS256' => ['openssl', 'SHA256'],
 63 |         'RS384' => ['openssl', 'SHA384'],
 64 |         'RS512' => ['openssl', 'SHA512'],
 65 |         'EdDSA' => ['sodium_crypto', 'EdDSA'],
 66 |     ];
 67 | 
 68 |     /**
 69 |      * Decodes a JWT string into a PHP object.
 70 |      *
 71 |      * @param string                 $jwt            The JWT
 72 |      * @param Key|array<string,Key> $keyOrKeyArray  The Key or associative array of key IDs (kid) to Key objects.
 73 |      *                                               If the algorithm used is asymmetric, this is the public key
 74 |      *                                               Each Key object contains an algorithm and matching key.
 75 |      *                                               Supported algorithms are 'ES384','ES256', 'HS256', 'HS384',
 76 |      *                                               'HS512', 'RS256', 'RS384', and 'RS512'
 77 |      *
 78 |      * @return stdClass The JWT's payload as a PHP object
 79 |      *
 80 |      * @throws InvalidArgumentException     Provided key/key-array was empty or malformed
 81 |      * @throws DomainException              Provided JWT is malformed
 82 |      * @throws UnexpectedValueException     Provided JWT was invalid
 83 |      * @throws SignatureInvalidException    Provided JWT was invalid because the signature verification failed
 84 |      * @throws BeforeValidException         Provided JWT is trying to be used before it's eligible as defined by 'nbf'
 85 |      * @throws BeforeValidException         Provided JWT is trying to be used before it's been created as defined by 'iat'
 86 |      * @throws ExpiredException             Provided JWT has since expired, as defined by the 'exp' claim
 87 |      *
 88 |      * @uses jsonDecode
 89 |      * @uses urlsafeB64Decode
 90 |      */
 91 |     public static function decode(
 92 |         string $jwt,
 93 |         $keyOrKeyArray
 94 |     ): stdClass {
 95 |         // Validate JWT
 96 |         $timestamp = \is_null(static::$timestamp) ? \time() : static::$timestamp;
 97 | 
 98 |         if (empty($keyOrKeyArray)) {
 99 |             throw new InvalidArgumentException('Key may not be empty');
100 |         }
101 |         $tks = \explode('.', $jwt);
102 |         if (\count($tks) !== 3) {
103 |             throw new UnexpectedValueException('Wrong number of segments');
104 |         }
105 |         list($headb64, $bodyb64, $cryptob64) = $tks;
106 |         $headerRaw = static::urlsafeB64Decode($headb64);
107 |         if (null === ($header = static::jsonDecode($headerRaw))) {
108 |             throw new UnexpectedValueException('Invalid header encoding');
109 |         }
110 |         $payloadRaw = static::urlsafeB64Decode($bodyb64);
111 |         if (null === ($payload = static::jsonDecode($payloadRaw))) {
112 |             throw new UnexpectedValueException('Invalid claims encoding');
113 |         }
114 |         if (\is_array($payload)) {
115 |             // prevent PHP Fatal Error in edge-cases when payload is empty array
116 |             $payload = (object) $payload;
117 |         }
118 |         if (!$payload instanceof stdClass) {
119 |             throw new UnexpectedValueException('Payload must be a JSON object');
120 |         }
121 |         $sig = static::urlsafeB64Decode($cryptob64);
122 |         if (empty($header->alg)) {
123 |             throw new UnexpectedValueException('Empty algorithm');
124 |         }
125 |         if (empty(static::$supported_algs[$header->alg])) {
126 |             throw new UnexpectedValueException('Algorithm not supported');
127 |         }
128 | 
129 |         $key = self::getKey($keyOrKeyArray, property_exists($header, 'kid') ? $header->kid : null);
130 | 
131 |         // Check the algorithm
132 |         if (!self::constantTimeEquals($key->getAlgorithm(), $header->alg)) {
133 |             // See issue #351
134 |             throw new UnexpectedValueException('Incorrect key for this algorithm');
135 |         }
136 |         if (\in_array($header->alg, ['ES256', 'ES256K', 'ES384'], true)) {
137 |             // OpenSSL expects an ASN.1 DER sequence for ES256/ES256K/ES384 signatures
138 |             $sig = self::signatureToDER($sig);
139 |         }
140 |         if (!self::verify("{$headb64}.{$bodyb64}", $sig, $key->getKeyMaterial(), $header->alg)) {
141 |             throw new SignatureInvalidException('Signature verification failed');
142 |         }
143 | 
144 |         // Check the nbf if it is defined. This is the time that the
145 |         // token can actually be used. If it's not yet that time, abort.
146 |         if (isset($payload->nbf) && $payload->nbf > ($timestamp + static::$leeway)) {
147 |             throw new BeforeValidException(
148 |                 'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->nbf)
149 |             );
150 |         }
151 | 
152 |         // Check that this token has been created before 'now'. This prevents
153 |         // using tokens that have been created for later use (and haven't
154 |         // correctly used the nbf claim).
155 |         if (isset($payload->iat) && $payload->iat > ($timestamp + static::$leeway)) {
156 |             throw new BeforeValidException(
157 |                 'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->iat)
158 |             );
159 |         }
160 | 
161 |         // Check if this token has expired.
162 |         if (isset($payload->exp) && ($timestamp - static::$leeway) >= $payload->exp) {
163 |             throw new ExpiredException('Expired token');
164 |         }
165 | 
166 |         return $payload;
167 |     }
168 | 
169 |     /**
170 |      * Converts and signs a PHP array into a JWT string.
171 |      *
172 |      * @param array<mixed>          $payload PHP array
173 |      * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate $key The secret key.
174 |      * @param string                $alg     Supported algorithms are 'ES384','ES256', 'ES256K', 'HS256',
175 |      *                                       'HS384', 'HS512', 'RS256', 'RS384', and 'RS512'
176 |      * @param string                $keyId
177 |      * @param array<string, string> $head    An array with header elements to attach
178 |      *
179 |      * @return string A signed JWT
180 |      *
181 |      * @uses jsonEncode
182 |      * @uses urlsafeB64Encode
183 |      */
184 |     public static function encode(
185 |         array $payload,
186 |         $key,
187 |         string $alg,
188 |         string $keyId = null,
189 |         array $head = null
190 |     ): string {
191 |         $header = ['typ' => 'JWT', 'alg' => $alg];
192 |         if ($keyId !== null) {
193 |             $header['kid'] = $keyId;
194 |         }
195 |         if (isset($head) && \is_array($head)) {
196 |             $header = \array_merge($head, $header);
197 |         }
198 |         $segments = [];
199 |         $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($header));
200 |         $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($payload));
201 |         $signing_input = \implode('.', $segments);
202 | 
203 |         $signature = static::sign($signing_input, $key, $alg);
204 |         $segments[] = static::urlsafeB64Encode($signature);
205 | 
206 |         return \implode('.', $segments);
207 |     }
208 | 
209 |     /**
210 |      * Sign a string with a given key and algorithm.
211 |      *
212 |      * @param string $msg  The message to sign
213 |      * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate  $key  The secret key.
214 |      * @param string $alg  Supported algorithms are 'ES384','ES256', 'ES256K', 'HS256',
215 |      *                    'HS384', 'HS512', 'RS256', 'RS384', and 'RS512'
216 |      *
217 |      * @return string An encrypted message
218 |      *
219 |      * @throws DomainException Unsupported algorithm or bad key was specified
220 |      */
221 |     public static function sign(
222 |         string $msg,
223 |         $key,
224 |         string $alg
225 |     ): string {
226 |         if (empty(static::$supported_algs[$alg])) {
227 |             throw new DomainException('Algorithm not supported');
228 |         }
229 |         list($function, $algorithm) = static::$supported_algs[$alg];
230 |         switch ($function) {
231 |             case 'hash_hmac':
232 |                 if (!\is_string($key)) {
233 |                     throw new InvalidArgumentException('key must be a string when using hmac');
234 |                 }
235 |                 return \hash_hmac($algorithm, $msg, $key, true);
236 |             case 'openssl':
237 |                 $signature = '';
238 |                 $success = \openssl_sign($msg, $signature, $key, $algorithm); // @phpstan-ignore-line
239 |                 if (!$success) {
240 |                     throw new DomainException('OpenSSL unable to sign data');
241 |                 }
242 |                 if ($alg === 'ES256' || $alg === 'ES256K') {
243 |                     $signature = self::signatureFromDER($signature, 256);
244 |                 } elseif ($alg === 'ES384') {
245 |                     $signature = self::signatureFromDER($signature, 384);
246 |                 }
247 |                 return $signature;
248 |             case 'sodium_crypto':
249 |                 if (!\function_exists('sodium_crypto_sign_detached')) {
250 |                     throw new DomainException('libsodium is not available');
251 |                 }
252 |                 if (!\is_string($key)) {
253 |                     throw new InvalidArgumentException('key must be a string when using EdDSA');
254 |                 }
255 |                 try {
256 |                     // The last non-empty line is used as the key.
257 |                     $lines = array_filter(explode("\n", $key));
258 |                     $key = base64_decode((string) end($lines));
259 |                     if (\strlen($key) === 0) {
260 |                         throw new DomainException('Key cannot be empty string');
261 |                     }
262 |                     return sodium_crypto_sign_detached($msg, $key);
263 |                 } catch (Exception $e) {
264 |                     throw new DomainException($e->getMessage(), 0, $e);
265 |                 }
266 |         }
267 | 
268 |         throw new DomainException('Algorithm not supported');
269 |     }
270 | 
271 |     /**
272 |      * Verify a signature with the message, key and method. Not all methods
273 |      * are symmetric, so we must have a separate verify and sign method.
274 |      *
275 |      * @param string $msg         The original message (header and body)
276 |      * @param string $signature   The original signature
277 |      * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate  $keyMaterial For HS*, a string key works. for RS*, must be an instance of OpenSSLAsymmetricKey
278 |      * @param string $alg         The algorithm
279 |      *
280 |      * @return bool
281 |      *
282 |      * @throws DomainException Invalid Algorithm, bad key, or OpenSSL failure
283 |      */
284 |     private static function verify(
285 |         string $msg,
286 |         string $signature,
287 |         $keyMaterial,
288 |         string $alg
289 |     ): bool {
290 |         if (empty(static::$supported_algs[$alg])) {
291 |             throw new DomainException('Algorithm not supported');
292 |         }
293 | 
294 |         list($function, $algorithm) = static::$supported_algs[$alg];
295 |         switch ($function) {
296 |             case 'openssl':
297 |                 $success = \openssl_verify($msg, $signature, $keyMaterial, $algorithm); // @phpstan-ignore-line
298 |                 if ($success === 1) {
299 |                     return true;
300 |                 }
301 |                 if ($success === 0) {
302 |                     return false;
303 |                 }
304 |                 // returns 1 on success, 0 on failure, -1 on error.
305 |                 throw new DomainException(
306 |                     'OpenSSL error: ' . \openssl_error_string()
307 |                 );
308 |             case 'sodium_crypto':
309 |                 if (!\function_exists('sodium_crypto_sign_verify_detached')) {
310 |                     throw new DomainException('libsodium is not available');
311 |                 }
312 |                 if (!\is_string($keyMaterial)) {
313 |                     throw new InvalidArgumentException('key must be a string when using EdDSA');
314 |                 }
315 |                 try {
316 |                     // The last non-empty line is used as the key.
317 |                     $lines = array_filter(explode("\n", $keyMaterial));
318 |                     $key = base64_decode((string) end($lines));
319 |                     if (\strlen($key) === 0) {
320 |                         throw new DomainException('Key cannot be empty string');
321 |                     }
322 |                     if (\strlen($signature) === 0) {
323 |                         throw new DomainException('Signature cannot be empty string');
324 |                     }
325 |                     return sodium_crypto_sign_verify_detached($signature, $msg, $key);
326 |                 } catch (Exception $e) {
327 |                     throw new DomainException($e->getMessage(), 0, $e);
328 |                 }
329 |             case 'hash_hmac':
330 |             default:
331 |                 if (!\is_string($keyMaterial)) {
332 |                     throw new InvalidArgumentException('key must be a string when using hmac');
333 |                 }
334 |                 $hash = \hash_hmac($algorithm, $msg, $keyMaterial, true);
335 |                 return self::constantTimeEquals($hash, $signature);
336 |         }
337 |     }
338 | 
339 |     /**
340 |      * Decode a JSON string into a PHP object.
341 |      *
342 |      * @param string $input JSON string
343 |      *
344 |      * @return mixed The decoded JSON string
345 |      *
346 |      * @throws DomainException Provided string was invalid JSON
347 |      */
348 |     public static function jsonDecode(string $input)
349 |     {
350 |         $obj = \json_decode($input, false, 512, JSON_BIGINT_AS_STRING);
351 | 
352 |         if ($errno = \json_last_error()) {
353 |             self::handleJsonError($errno);
354 |         } elseif ($obj === null && $input !== 'null') {
355 |             throw new DomainException('Null result with non-null input');
356 |         }
357 |         return $obj;
358 |     }
359 | 
360 |     /**
361 |      * Encode a PHP array into a JSON string.
362 |      *
363 |      * @param array<mixed> $input A PHP array
364 |      *
365 |      * @return string JSON representation of the PHP array
366 |      *
367 |      * @throws DomainException Provided object could not be encoded to valid JSON
368 |      */
369 |     public static function jsonEncode(array $input): string
370 |     {
371 |         if (PHP_VERSION_ID >= 50400) {
372 |             $json = \json_encode($input, \JSON_UNESCAPED_SLASHES);
373 |         } else {
374 |             // PHP 5.3 only
375 |             $json = \json_encode($input);
376 |         }
377 |         if ($errno = \json_last_error()) {
378 |             self::handleJsonError($errno);
379 |         } elseif ($json === 'null' && $input !== null) {
380 |             throw new DomainException('Null result with non-null input');
381 |         }
382 |         if ($json === false) {
383 |             throw new DomainException('Provided object could not be encoded to valid JSON');
384 |         }
385 |         return $json;
386 |     }
387 | 
388 |     /**
389 |      * Decode a string with URL-safe Base64.
390 |      *
391 |      * @param string $input A Base64 encoded string
392 |      *
393 |      * @return string A decoded string
394 |      *
395 |      * @throws InvalidArgumentException invalid base64 characters
396 |      */
397 |     public static function urlsafeB64Decode(string $input): string
398 |     {
399 |         $remainder = \strlen($input) % 4;
400 |         if ($remainder) {
401 |             $padlen = 4 - $remainder;
402 |             $input .= \str_repeat('=', $padlen);
403 |         }
404 |         return \base64_decode(\strtr($input, '-_', '+/'));
405 |     }
406 | 
407 |     /**
408 |      * Encode a string with URL-safe Base64.
409 |      *
410 |      * @param string $input The string you want encoded
411 |      *
412 |      * @return string The base64 encode of what you passed in
413 |      */
414 |     public static function urlsafeB64Encode(string $input): string
415 |     {
416 |         return \str_replace('=', '', \strtr(\base64_encode($input), '+/', '-_'));
417 |     }
418 | 
419 | 
420 |     /**
421 |      * Determine if an algorithm has been provided for each Key
422 |      *
423 |      * @param Key|ArrayAccess<string,Key>|array<string,Key> $keyOrKeyArray
424 |      * @param string|null            $kid
425 |      *
426 |      * @throws UnexpectedValueException
427 |      *
428 |      * @return Key
429 |      */
430 |     private static function getKey(
431 |         $keyOrKeyArray,
432 |         ?string $kid
433 |     ): Key {
434 |         if ($keyOrKeyArray instanceof Key) {
435 |             return $keyOrKeyArray;
436 |         }
437 | 
438 |         if (empty($kid)) {
439 |             throw new UnexpectedValueException('"kid" empty, unable to lookup correct key');
440 |         }
441 | 
442 |         if ($keyOrKeyArray instanceof CachedKeySet) {
443 |             // Skip "isset" check, as this will automatically refresh if not set
444 |             return $keyOrKeyArray[$kid];
445 |         }
446 | 
447 |         if (!isset($keyOrKeyArray[$kid])) {
448 |             throw new UnexpectedValueException('"kid" invalid, unable to lookup correct key');
449 |         }
450 | 
451 |         return $keyOrKeyArray[$kid];
452 |     }
453 | 
454 |     /**
455 |      * @param string $left  The string of known length to compare against
456 |      * @param string $right The user-supplied string
457 |      * @return bool
458 |      */
459 |     public static function constantTimeEquals(string $left, string $right): bool
460 |     {
461 |         if (\function_exists('hash_equals')) {
462 |             return \hash_equals($left, $right);
463 |         }
464 |         $len = \min(self::safeStrlen($left), self::safeStrlen($right));
465 | 
466 |         $status = 0;
467 |         for ($i = 0; $i < $len; $i++) {
468 |             $status |= (\ord($left[$i]) ^ \ord($right[$i]));
469 |         }
470 |         $status |= (self::safeStrlen($left) ^ self::safeStrlen($right));
471 | 
472 |         return ($status === 0);
473 |     }
474 | 
475 |     /**
476 |      * Helper method to create a JSON error.
477 |      *
478 |      * @param int $errno An error number from json_last_error()
479 |      *
480 |      * @throws DomainException
481 |      *
482 |      * @return void
483 |      */
484 |     private static function handleJsonError(int $errno): void
485 |     {
486 |         $messages = [
487 |             JSON_ERROR_DEPTH => 'Maximum stack depth exceeded',
488 |             JSON_ERROR_STATE_MISMATCH => 'Invalid or malformed JSON',
489 |             JSON_ERROR_CTRL_CHAR => 'Unexpected control character found',
490 |             JSON_ERROR_SYNTAX => 'Syntax error, malformed JSON',
491 |             JSON_ERROR_UTF8 => 'Malformed UTF-8 characters' //PHP >= 5.3.3
492 |         ];
493 |         throw new DomainException(
494 |             isset($messages[$errno])
495 |             ? $messages[$errno]
496 |             : 'Unknown JSON error: ' . $errno
497 |         );
498 |     }
499 | 
500 |     /**
501 |      * Get the number of bytes in cryptographic strings.
502 |      *
503 |      * @param string $str
504 |      *
505 |      * @return int
506 |      */
507 |     private static function safeStrlen(string $str): int
508 |     {
509 |         if (\function_exists('mb_strlen')) {
510 |             return \mb_strlen($str, '8bit');
511 |         }
512 |         return \strlen($str);
513 |     }
514 | 
515 |     /**
516 |      * Convert an ECDSA signature to an ASN.1 DER sequence
517 |      *
518 |      * @param   string $sig The ECDSA signature to convert
519 |      * @return  string The encoded DER object
520 |      */
521 |     private static function signatureToDER(string $sig): string
522 |     {
523 |         // Separate the signature into r-value and s-value
524 |         $length = max(1, (int) (\strlen($sig) / 2));
525 |         list($r, $s) = \str_split($sig, $length);
526 | 
527 |         // Trim leading zeros
528 |         $r = \ltrim($r, "\x00");
529 |         $s = \ltrim($s, "\x00");
530 | 
531 |         // Convert r-value and s-value from unsigned big-endian integers to
532 |         // signed two's complement
533 |         if (\ord($r[0]) > 0x7f) {
534 |             $r = "\x00" . $r;
535 |         }
536 |         if (\ord($s[0]) > 0x7f) {
537 |             $s = "\x00" . $s;
538 |         }
539 | 
540 |         return self::encodeDER(
541 |             self::ASN1_SEQUENCE,
542 |             self::encodeDER(self::ASN1_INTEGER, $r) .
543 |             self::encodeDER(self::ASN1_INTEGER, $s)
544 |         );
545 |     }
546 | 
547 |     /**
548 |      * Encodes a value into a DER object.
549 |      *
550 |      * @param   int     $type DER tag
551 |      * @param   string  $value the value to encode
552 |      *
553 |      * @return  string  the encoded object
554 |      */
555 |     private static function encodeDER(int $type, string $value): string
556 |     {
557 |         $tag_header = 0;
558 |         if ($type === self::ASN1_SEQUENCE) {
559 |             $tag_header |= 0x20;
560 |         }
561 | 
562 |         // Type
563 |         $der = \chr($tag_header | $type);
564 | 
565 |         // Length
566 |         $der .= \chr(\strlen($value));
567 | 
568 |         return $der . $value;
569 |     }
570 | 
571 |     /**
572 |      * Encodes signature from a DER object.
573 |      *
574 |      * @param   string  $der binary signature in DER format
575 |      * @param   int     $keySize the number of bits in the key
576 |      *
577 |      * @return  string  the signature
578 |      */
579 |     private static function signatureFromDER(string $der, int $keySize): string
580 |     {
581 |         // OpenSSL returns the ECDSA signatures as a binary ASN.1 DER SEQUENCE
582 |         list($offset, $_) = self::readDER($der);
583 |         list($offset, $r) = self::readDER($der, $offset);
584 |         list($offset, $s) = self::readDER($der, $offset);
585 | 
586 |         // Convert r-value and s-value from signed two's compliment to unsigned
587 |         // big-endian integers
588 |         $r = \ltrim($r, "\x00");
589 |         $s = \ltrim($s, "\x00");
590 | 
591 |         // Pad out r and s so that they are $keySize bits long
592 |         $r = \str_pad($r, $keySize / 8, "\x00", STR_PAD_LEFT);
593 |         $s = \str_pad($s, $keySize / 8, "\x00", STR_PAD_LEFT);
594 | 
595 |         return $r . $s;
596 |     }
597 | 
598 |     /**
599 |      * Reads binary DER-encoded data and decodes into a single object
600 |      *
601 |      * @param string $der the binary data in DER format
602 |      * @param int $offset the offset of the data stream containing the object
603 |      * to decode
604 |      *
605 |      * @return array{int, string|null} the new offset and the decoded object
606 |      */
607 |     private static function readDER(string $der, int $offset = 0): array
608 |     {
609 |         $pos = $offset;
610 |         $size = \strlen($der);
611 |         $constructed = (\ord($der[$pos]) >> 5) & 0x01;
612 |         $type = \ord($der[$pos++]) & 0x1f;
613 | 
614 |         // Length
615 |         $len = \ord($der[$pos++]);
616 |         if ($len & 0x80) {
617 |             $n = $len & 0x1f;
618 |             $len = 0;
619 |             while ($n-- && $pos < $size) {
620 |                 $len = ($len << 8) | \ord($der[$pos++]);
621 |             }
622 |         }
623 | 
624 |         // Value
625 |         if ($type === self::ASN1_BIT_STRING) {
626 |             $pos++; // Skip the first contents octet (padding indicator)
627 |             $data = \substr($der, $pos, $len - 1);
628 |             $pos += $len - 1;
629 |         } elseif (!$constructed) {
630 |             $data = \substr($der, $pos, $len);
631 |             $pos += $len;
632 |         } else {
633 |             $data = null;
634 |         }
635 | 
636 |         return [$pos, $data];
637 |     }
638 | }
639 | 


--------------------------------------------------------------------------------