ProcessSelfSignedLoginTask.php

<?php
 
/*
 *
 *  ____            _        _   __  __ _                  __  __ ____
 * |  _ \ ___   ___| | _____| |_|  \/  (_)_ __   ___      |  \/  |  _ \
 * | |_) / _ \ / __| |/ / _ \ __| |\/| | | '_ \ / _ \_____| |\/| | |_) |
 * |  __/ (_) | (__|   <  __/ |_| |  | | | | | |  __/_____| |  | |  __/
 * |_|   \___/ \___|_|\_\___|\__|_|  |_|_|_| |_|\___|     |_|  |_|_|
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * @author PocketMine Team
 * @link http://www.pocketmine.net/
 *
 *
 */
 
declare(strict_types=1);
 
namespace pocketmine\network\mcpe\auth;
 
use pocketmine\lang\Translatable;
use pocketmine\scheduler\AsyncTask;
use pocketmine\thread\NonThreadSafeValue;
use function base64_decode;
 
class ProcessSelfSignedLoginTask extends AsyncTask{
    private const TLS_KEY_ON_COMPLETION = "completion";
 
    public const MOJANG_AUDIENCE = "api://auth-minecraft-services/multiplayer";
 
    private NonThreadSafeValue|string|null $error = "Unknown";
    private ?string $clientPublicKeyDer = null;
 
    public function __construct(
        private string $jwt,
        private string $selfSignedKeyDer,
        private string $clientDataJwt,
        private bool $authRequired,
        \Closure $onCompletion
    ){
        $this->storeLocal(self::TLS_KEY_ON_COMPLETION, $onCompletion);
    }
 
    public function onRun() : void{
        try{
            $this->clientPublicKeyDer = $this->validateChain();
            $this->error = null;
        }catch(VerifyLoginException $e){
            $disconnectMessage = $e->getDisconnectMessage();
            $this->error = $disconnectMessage instanceof Translatable ? new NonThreadSafeValue($disconnectMessage) : $disconnectMessage;
        }
    }
 
    private function validateChain() : string{
        $claims = AuthJwtHelper::validateSelfSignedAuthToken($this->jwt, $this->selfSignedKeyDer, audience: self::MOJANG_AUDIENCE);
        //validateToken will throw if the JWT is not valid
 
        $clientDerKey = base64_decode($claims->cpk, strict: true);
        if($clientDerKey === false){
            throw new VerifyLoginException("Invalid client public key: base64 error decoding");
        }
        //no further validation needed - OpenSSL will bail if the key is invalid
        AuthJwtHelper::validateSelfSignedToken($this->clientDataJwt, $clientDerKey);
 
        return $clientDerKey;
    }
 
    public function onCompletion() : void{
        $callback = $this->fetchLocal(self::TLS_KEY_ON_COMPLETION);
        $callback(false, $this->authRequired, $this->error instanceof NonThreadSafeValue ? $this->error->deserialize() : $this->error, $this->clientPublicKeyDer);
    }
}