64 lines
2.1 KiB
PHP
64 lines
2.1 KiB
PHP
<?php
|
|
namespace RSSSL\Security\WordPress\Two_Fa\Services;
|
|
|
|
class Rsssl_Two_Fa_Status_Service {
|
|
|
|
/**
|
|
* Determine the two-factor status for a user.
|
|
*
|
|
* @return string
|
|
*/
|
|
public function determineStatus(int $userId, array $forcedRoles, int $daysThreshold): string {
|
|
$userData = get_userdata($userId);
|
|
if (!$userData) {
|
|
return 'open';
|
|
}
|
|
|
|
$providerStatuses = [];
|
|
foreach ( \RSSSL\Security\WordPress\Two_Fa\Providers\Rsssl_Provider_Loader::get_loader()::available_providers() as $method => $provider ) {
|
|
if (!$provider::is_enabled($userData)) {
|
|
continue;
|
|
}
|
|
|
|
$providerStatuses[] = \RSSSL\Security\WordPress\Two_Fa\Rsssl_Two_Factor_Settings::get_user_status($method, $userId);
|
|
}
|
|
|
|
$lastLogin = get_user_meta($userId, 'rsssl_two_fa_last_login', true);
|
|
|
|
// User has active 2FA configured
|
|
if (in_array('active', $providerStatuses, true)) {
|
|
return 'active';
|
|
}
|
|
|
|
// Only mark the user as disabled when every enabled provider is disabled.
|
|
if (!empty($providerStatuses) && !array_diff($providerStatuses, array('disabled'))) {
|
|
return 'disabled';
|
|
}
|
|
|
|
// Check if user has a forced role
|
|
$isForced = !empty(array_intersect($forcedRoles, \RSSSL\Security\WordPress\Two_Fa\Rsssl_Two_Factor_Settings::get_user_roles($userId)));
|
|
|
|
// Non-forced users can still configure any remaining open provider.
|
|
if (!$isForced) {
|
|
return 'open';
|
|
}
|
|
|
|
// New user without lastLogin - initialize grace period
|
|
if (empty($lastLogin)) {
|
|
update_user_meta($userId, 'rsssl_two_fa_last_login', gmdate('Y-m-d H:i:s'));
|
|
return 'open';
|
|
}
|
|
|
|
// Grace period has expired
|
|
$lastLoginTime = strtotime($lastLogin);
|
|
$thresholdTime = strtotime("-$daysThreshold days");
|
|
|
|
if ($lastLoginTime !== false && $lastLoginTime < $thresholdTime) {
|
|
return 'expired';
|
|
}
|
|
|
|
// Still within grace period
|
|
return 'open';
|
|
}
|
|
}
|