commit vendor

vendor/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php

@@ -0,0 +1,136 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+use Sabre\HTTP;
+use Sabre\HTTP\RequestInterface;
+use Sabre\HTTP\ResponseInterface;
+
+/**
+ * HTTP Basic authentication backend class.
+ *
+ * This class can be used by authentication objects wishing to use HTTP Basic
+ * Most of the digest logic is handled, implementors just need to worry about
+ * the validateUserPass method.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author James David Low (http://jameslow.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+abstract class AbstractBasic implements BackendInterface
+{
+    /**
+     * Authentication Realm.
+     *
+     * The realm is often displayed by browser clients when showing the
+     * authentication dialog.
+     *
+     * @var string
+     */
+    protected $realm = 'sabre/dav';
+
+    /**
+     * This is the prefix that will be used to generate principal urls.
+     *
+     * @var string
+     */
+    protected $principalPrefix = 'principals/';
+
+    /**
+     * Validates a username and password.
+     *
+     * This method should return true or false depending on if login
+     * succeeded.
+     *
+     * @param string $username
+     * @param string $password
+     *
+     * @return bool
+     */
+    abstract protected function validateUserPass($username, $password);
+
+    /**
+     * Sets the authentication realm for this backend.
+     *
+     * @param string $realm
+     */
+    public function setRealm($realm)
+    {
+        $this->realm = $realm;
+    }
+
+    /**
+     * When this method is called, the backend must check if authentication was
+     * successful.
+     *
+     * The returned value must be one of the following
+     *
+     * [true, "principals/username"]
+     * [false, "reason for failure"]
+     *
+     * If authentication was successful, it's expected that the authentication
+     * backend returns a so-called principal url.
+     *
+     * Examples of a principal url:
+     *
+     * principals/admin
+     * principals/user1
+     * principals/users/joe
+     * principals/uid/123457
+     *
+     * If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+     * return a string such as:
+     *
+     * principals/users/[username]
+     *
+     * @return array
+     */
+    public function check(RequestInterface $request, ResponseInterface $response)
+    {
+        $auth = new HTTP\Auth\Basic(
+            $this->realm,
+            $request,
+            $response
+        );
+
+        $userpass = $auth->getCredentials();
+        if (!$userpass) {
+            return [false, "No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured"];
+        }
+        if (!$this->validateUserPass($userpass[0], $userpass[1])) {
+            return [false, 'Username or password was incorrect'];
+        }
+
+        return [true, $this->principalPrefix.$userpass[0]];
+    }
+
+    /**
+     * This method is called when a user could not be authenticated, and
+     * authentication was required for the current request.
+     *
+     * This gives you the opportunity to set authentication headers. The 401
+     * status code will already be set.
+     *
+     * In this case of Basic Auth, this would for example mean that the
+     * following header needs to be set:
+     *
+     * $response->addHeader('WWW-Authenticate', 'Basic realm=SabreDAV');
+     *
+     * Keep in mind that in the case of multiple authentication backends, other
+     * WWW-Authenticate headers may already have been set, and you'll want to
+     * append your own WWW-Authenticate header instead of overwriting the
+     * existing one.
+     */
+    public function challenge(RequestInterface $request, ResponseInterface $response)
+    {
+        $auth = new HTTP\Auth\Basic(
+            $this->realm,
+            $request,
+            $response
+        );
+        $auth->requireLogin();
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/AbstractBearer.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+use Sabre\HTTP;
+use Sabre\HTTP\RequestInterface;
+use Sabre\HTTP\ResponseInterface;
+
+/**
+ * HTTP Bearer authentication backend class.
+ *
+ * This class can be used by authentication objects wishing to use HTTP Bearer
+ * Most of the digest logic is handled, implementors just need to worry about
+ * the validateBearerToken method.
+ *
+ * @copyright Copyright (C) 2007-2015 fruux GmbH (https://fruux.com/).
+ * @author François Kooman (https://tuxed.net/)
+ * @author James David Low (http://jameslow.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+abstract class AbstractBearer implements BackendInterface
+{
+    /**
+     * Authentication Realm.
+     *
+     * The realm is often displayed by browser clients when showing the
+     * authentication dialog.
+     *
+     * @var string
+     */
+    protected $realm = 'sabre/dav';
+
+    /**
+     * Validates a Bearer token.
+     *
+     * This method should return the full principal url, or false if the
+     * token was incorrect.
+     *
+     * @param string $bearerToken
+     *
+     * @return string|false
+     */
+    abstract protected function validateBearerToken($bearerToken);
+
+    /**
+     * Sets the authentication realm for this backend.
+     *
+     * @param string $realm
+     */
+    public function setRealm($realm)
+    {
+        $this->realm = $realm;
+    }
+
+    /**
+     * When this method is called, the backend must check if authentication was
+     * successful.
+     *
+     * The returned value must be one of the following
+     *
+     * [true, "principals/username"]
+     * [false, "reason for failure"]
+     *
+     * If authentication was successful, it's expected that the authentication
+     * backend returns a so-called principal url.
+     *
+     * Examples of a principal url:
+     *
+     * principals/admin
+     * principals/user1
+     * principals/users/joe
+     * principals/uid/123457
+     *
+     * If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+     * return a string such as:
+     *
+     * principals/users/[username]
+     *
+     * @return array
+     */
+    public function check(RequestInterface $request, ResponseInterface $response)
+    {
+        $auth = new HTTP\Auth\Bearer(
+            $this->realm,
+            $request,
+            $response
+        );
+
+        $bearerToken = $auth->getToken($request);
+        if (!$bearerToken) {
+            return [false, "No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured"];
+        }
+        $principalUrl = $this->validateBearerToken($bearerToken);
+        if (!$principalUrl) {
+            return [false, 'Bearer token was incorrect'];
+        }
+
+        return [true, $principalUrl];
+    }
+
+    /**
+     * This method is called when a user could not be authenticated, and
+     * authentication was required for the current request.
+     *
+     * This gives you the opportunity to set authentication headers. The 401
+     * status code will already be set.
+     *
+     * In this case of Bearer Auth, this would for example mean that the
+     * following header needs to be set:
+     *
+     * $response->addHeader('WWW-Authenticate', 'Bearer realm=SabreDAV');
+     *
+     * Keep in mind that in the case of multiple authentication backends, other
+     * WWW-Authenticate headers may already have been set, and you'll want to
+     * append your own WWW-Authenticate header instead of overwriting the
+     * existing one.
+     */
+    public function challenge(RequestInterface $request, ResponseInterface $response)
+    {
+        $auth = new HTTP\Auth\Bearer(
+            $this->realm,
+            $request,
+            $response
+        );
+        $auth->requireLogin();
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/AbstractDigest.php

@@ -0,0 +1,160 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+use Sabre\DAV;
+use Sabre\HTTP;
+use Sabre\HTTP\RequestInterface;
+use Sabre\HTTP\ResponseInterface;
+
+/**
+ * HTTP Digest authentication backend class.
+ *
+ * This class can be used by authentication objects wishing to use HTTP Digest
+ * Most of the digest logic is handled, implementors just need to worry about
+ * the getDigestHash method
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+abstract class AbstractDigest implements BackendInterface
+{
+    /**
+     * Authentication Realm.
+     *
+     * The realm is often displayed by browser clients when showing the
+     * authentication dialog.
+     *
+     * @var string
+     */
+    protected $realm = 'SabreDAV';
+
+    /**
+     * This is the prefix that will be used to generate principal urls.
+     *
+     * @var string
+     */
+    protected $principalPrefix = 'principals/';
+
+    /**
+     * Sets the authentication realm for this backend.
+     *
+     * Be aware that for Digest authentication, the realm influences the digest
+     * hash. Choose the realm wisely, because if you change it later, all the
+     * existing hashes will break and nobody can authenticate.
+     *
+     * @param string $realm
+     */
+    public function setRealm($realm)
+    {
+        $this->realm = $realm;
+    }
+
+    /**
+     * Returns a users digest hash based on the username and realm.
+     *
+     * If the user was not known, null must be returned.
+     *
+     * @param string $realm
+     * @param string $username
+     *
+     * @return string|null
+     */
+    abstract public function getDigestHash($realm, $username);
+
+    /**
+     * When this method is called, the backend must check if authentication was
+     * successful.
+     *
+     * The returned value must be one of the following
+     *
+     * [true, "principals/username"]
+     * [false, "reason for failure"]
+     *
+     * If authentication was successful, it's expected that the authentication
+     * backend returns a so-called principal url.
+     *
+     * Examples of a principal url:
+     *
+     * principals/admin
+     * principals/user1
+     * principals/users/joe
+     * principals/uid/123457
+     *
+     * If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+     * return a string such as:
+     *
+     * principals/users/[username]
+     *
+     * @return array
+     */
+    public function check(RequestInterface $request, ResponseInterface $response)
+    {
+        $digest = new HTTP\Auth\Digest(
+            $this->realm,
+            $request,
+            $response
+        );
+        $digest->init();
+
+        $username = $digest->getUsername();
+
+        // No username was given
+        if (!$username) {
+            return [false, "No 'Authorization: Digest' header found. Either the client didn't send one, or the server is misconfigured"];
+        }
+
+        $hash = $this->getDigestHash($this->realm, $username);
+        // If this was false, the user account didn't exist
+        if (false === $hash || is_null($hash)) {
+            return [false, 'Username or password was incorrect'];
+        }
+        if (!is_string($hash)) {
+            throw new DAV\Exception('The returned value from getDigestHash must be a string or null');
+        }
+
+        // If this was false, the password or part of the hash was incorrect.
+        if (!$digest->validateA1($hash)) {
+            return [false, 'Username or password was incorrect'];
+        }
+
+        return [true, $this->principalPrefix.$username];
+    }
+
+    /**
+     * This method is called when a user could not be authenticated, and
+     * authentication was required for the current request.
+     *
+     * This gives you the opportunity to set authentication headers. The 401
+     * status code will already be set.
+     *
+     * In this case of Basic Auth, this would for example mean that the
+     * following header needs to be set:
+     *
+     * $response->addHeader('WWW-Authenticate', 'Basic realm=SabreDAV');
+     *
+     * Keep in mind that in the case of multiple authentication backends, other
+     * WWW-Authenticate headers may already have been set, and you'll want to
+     * append your own WWW-Authenticate header instead of overwriting the
+     * existing one.
+     */
+    public function challenge(RequestInterface $request, ResponseInterface $response)
+    {
+        $auth = new HTTP\Auth\Digest(
+            $this->realm,
+            $request,
+            $response
+        );
+        $auth->init();
+
+        $oldStatus = $response->getStatus() ?: 200;
+        $auth->requireLogin();
+
+        // Preventing the digest utility from modifying the http status code,
+        // this should be handled by the main plugin.
+        $response->setStatus($oldStatus);
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/Apache.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+use Sabre\HTTP\RequestInterface;
+use Sabre\HTTP\ResponseInterface;
+
+/**
+ * Apache (or NGINX) authenticator.
+ *
+ * This authentication backend assumes that authentication has been
+ * configured in apache (or NGINX), rather than within SabreDAV.
+ *
+ * Make sure apache (or NGINX) is properly configured for this to work.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+class Apache implements BackendInterface
+{
+    /**
+     * This is the prefix that will be used to generate principal urls.
+     *
+     * @var string
+     */
+    protected $principalPrefix = 'principals/';
+
+    /**
+     * When this method is called, the backend must check if authentication was
+     * successful.
+     *
+     * The returned value must be one of the following
+     *
+     * [true, "principals/username"]
+     * [false, "reason for failure"]
+     *
+     * If authentication was successful, it's expected that the authentication
+     * backend returns a so-called principal url.
+     *
+     * Examples of a principal url:
+     *
+     * principals/admin
+     * principals/user1
+     * principals/users/joe
+     * principals/uid/123457
+     *
+     * If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+     * return a string such as:
+     *
+     * principals/users/[username]
+     *
+     * @return array
+     */
+    public function check(RequestInterface $request, ResponseInterface $response)
+    {
+        $remoteUser = $request->getRawServerValue('REMOTE_USER');
+        if (is_null($remoteUser)) {
+            $remoteUser = $request->getRawServerValue('REDIRECT_REMOTE_USER');
+        }
+        if (is_null($remoteUser)) {
+            $remoteUser = $request->getRawServerValue('PHP_AUTH_USER');
+        }
+        if (is_null($remoteUser)) {
+            return [false, 'No REMOTE_USER, REDIRECT_REMOTE_USER, or PHP_AUTH_USER property was found in the PHP $_SERVER super-global. This likely means your server is not configured correctly'];
+        }
+
+        return [true, $this->principalPrefix.$remoteUser];
+    }
+
+    /**
+     * This method is called when a user could not be authenticated, and
+     * authentication was required for the current request.
+     *
+     * This gives you the opportunity to set authentication headers. The 401
+     * status code will already be set.
+     *
+     * In this case of Basic Auth, this would for example mean that the
+     * following header needs to be set:
+     *
+     * $response->addHeader('WWW-Authenticate', 'Basic realm=SabreDAV');
+     *
+     * Keep in mind that in the case of multiple authentication backends, other
+     * WWW-Authenticate headers may already have been set, and you'll want to
+     * append your own WWW-Authenticate header instead of overwriting the
+     * existing one.
+     */
+    public function challenge(RequestInterface $request, ResponseInterface $response)
+    {
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/BackendInterface.php

@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+use Sabre\HTTP\RequestInterface;
+use Sabre\HTTP\ResponseInterface;
+
+/**
+ * This is the base class for any authentication object.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+interface BackendInterface
+{
+    /**
+     * When this method is called, the backend must check if authentication was
+     * successful.
+     *
+     * The returned value must be one of the following
+     *
+     * [true, "principals/username"]
+     * [false, "reason for failure"]
+     *
+     * If authentication was successful, it's expected that the authentication
+     * backend returns a so-called principal url.
+     *
+     * Examples of a principal url:
+     *
+     * principals/admin
+     * principals/user1
+     * principals/users/joe
+     * principals/uid/123457
+     *
+     * If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+     * return a string such as:
+     *
+     * principals/users/[username]
+     *
+     * @return array
+     */
+    public function check(RequestInterface $request, ResponseInterface $response);
+
+    /**
+     * This method is called when a user could not be authenticated, and
+     * authentication was required for the current request.
+     *
+     * This gives you the opportunity to set authentication headers. The 401
+     * status code will already be set.
+     *
+     * In this case of Basic Auth, this would for example mean that the
+     * following header needs to be set:
+     *
+     * $response->addHeader('WWW-Authenticate', 'Basic realm=SabreDAV');
+     *
+     * Keep in mind that in the case of multiple authentication backends, other
+     * WWW-Authenticate headers may already have been set, and you'll want to
+     * append your own WWW-Authenticate header instead of overwriting the
+     * existing one.
+     */
+    public function challenge(RequestInterface $request, ResponseInterface $response);
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/BasicCallBack.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+/**
+ * Extremely simply HTTP Basic auth backend.
+ *
+ * This backend basically works by calling a callback, which receives a
+ * username and password.
+ * The callback must return true or false depending on if authentication was
+ * correct.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+class BasicCallBack extends AbstractBasic
+{
+    /**
+     * Callback.
+     *
+     * @var callable
+     */
+    protected $callBack;
+
+    /**
+     * Creates the backend.
+     *
+     * A callback must be provided to handle checking the username and
+     * password.
+     */
+    public function __construct(callable $callBack)
+    {
+        $this->callBack = $callBack;
+    }
+
+    /**
+     * Validates a username and password.
+     *
+     * This method should return true or false depending on if login
+     * succeeded.
+     *
+     * @param string $username
+     * @param string $password
+     *
+     * @return bool
+     */
+    protected function validateUserPass($username, $password)
+    {
+        $cb = $this->callBack;
+
+        return $cb($username, $password);
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/File.php

@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+use Sabre\DAV;
+
+/**
+ * This is an authentication backend that uses a file to manage passwords.
+ *
+ * The backend file must conform to Apache's htdigest format
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+class File extends AbstractDigest
+{
+    /**
+     * List of users.
+     *
+     * @var array
+     */
+    protected $users = [];
+
+    /**
+     * Creates the backend object.
+     *
+     * If the filename argument is passed in, it will parse out the specified file first.
+     *
+     * @param string|null $filename
+     */
+    public function __construct($filename = null)
+    {
+        if (!is_null($filename)) {
+            $this->loadFile($filename);
+        }
+    }
+
+    /**
+     * Loads an htdigest-formatted file. This method can be called multiple times if
+     * more than 1 file is used.
+     *
+     * @param string $filename
+     */
+    public function loadFile($filename)
+    {
+        foreach (file($filename, FILE_IGNORE_NEW_LINES) as $line) {
+            if (2 !== substr_count($line, ':')) {
+                throw new DAV\Exception('Malformed htdigest file. Every line should contain 2 colons');
+            }
+            list($username, $realm, $A1) = explode(':', $line);
+
+            if (!preg_match('/^[a-zA-Z0-9]{32}$/', $A1)) {
+                throw new DAV\Exception('Malformed htdigest file. Invalid md5 hash');
+            }
+            $this->users[$realm.':'.$username] = $A1;
+        }
+    }
+
+    /**
+     * Returns a users' information.
+     *
+     * @param string $realm
+     * @param string $username
+     *
+     * @return string
+     */
+    public function getDigestHash($realm, $username)
+    {
+        return isset($this->users[$realm.':'.$username]) ? $this->users[$realm.':'.$username] : false;
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/IMAP.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Sabre\DAV\Auth\Backend;
+
+/**
+ * This is an authentication backend that uses imap.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Michael Niewöhner (foss@mniewoehner.de)
+ * @author rosali (https://github.com/rosali)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+class IMAP extends AbstractBasic
+{
+    /**
+     * IMAP server in the form {host[:port][/flag1/flag2...]}.
+     *
+     * @see http://php.net/manual/en/function.imap-open.php
+     *
+     * @var string
+     */
+    protected $mailbox;
+
+    /**
+     * Creates the backend object.
+     *
+     * @param string $mailbox
+     */
+    public function __construct($mailbox)
+    {
+        $this->mailbox = $mailbox;
+    }
+
+    /**
+     * Connects to an IMAP server and tries to authenticate.
+     *
+     * @param string $username
+     * @param string $password
+     *
+     * @return bool
+     */
+    protected function imapOpen($username, $password)
+    {
+        $success = false;
+
+        try {
+            $imap = imap_open($this->mailbox, $username, $password, OP_HALFOPEN | OP_READONLY, 1);
+            if ($imap) {
+                $success = true;
+            }
+        } catch (\ErrorException $e) {
+            error_log($e->getMessage());
+        }
+
+        $errors = imap_errors();
+        if ($errors) {
+            foreach ($errors as $error) {
+                error_log($error);
+            }
+        }
+
+        if (isset($imap) && $imap) {
+            imap_close($imap);
+        }
+
+        return $success;
+    }
+
+    /**
+     * Validates a username and password by trying to authenticate against IMAP.
+     *
+     * @param string $username
+     * @param string $password
+     *
+     * @return bool
+     */
+    protected function validateUserPass($username, $password)
+    {
+        return $this->imapOpen($username, $password);
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Backend/PDO.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth\Backend;
+
+/**
+ * This is an authentication backend that uses a database to manage passwords.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+class PDO extends AbstractDigest
+{
+    /**
+     * Reference to PDO connection.
+     *
+     * @var PDO
+     */
+    protected $pdo;
+
+    /**
+     * PDO table name we'll be using.
+     *
+     * @var string
+     */
+    public $tableName = 'users';
+
+    /**
+     * Creates the backend object.
+     *
+     * If the filename argument is passed in, it will parse out the specified file fist.
+     */
+    public function __construct(\PDO $pdo)
+    {
+        $this->pdo = $pdo;
+    }
+
+    /**
+     * Returns the digest hash for a user.
+     *
+     * @param string $realm
+     * @param string $username
+     *
+     * @return string|null
+     */
+    public function getDigestHash($realm, $username)
+    {
+        $stmt = $this->pdo->prepare('SELECT digesta1 FROM '.$this->tableName.' WHERE username = ?');
+        $stmt->execute([$username]);
+
+        return $stmt->fetchColumn() ?: null;
+    }
+}

vendor/sabre/dav/lib/DAV/Auth/Plugin.php

@@ -0,0 +1,259 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sabre\DAV\Auth;
+
+use Sabre\DAV\Exception\NotAuthenticated;
+use Sabre\DAV\Server;
+use Sabre\DAV\ServerPlugin;
+use Sabre\HTTP\RequestInterface;
+use Sabre\HTTP\ResponseInterface;
+
+/**
+ * This plugin provides Authentication for a WebDAV server.
+ *
+ * It works by providing a Auth\Backend class. Several examples of these
+ * classes can be found in the Backend directory.
+ *
+ * It's possible to provide more than one backend to this plugin. If more than
+ * one backend was provided, each backend will attempt to authenticate. Only if
+ * all backends fail, we throw a 401.
+ *
+ * @copyright Copyright (C) fruux GmbH (https://fruux.com/)
+ * @author Evert Pot (http://evertpot.com/)
+ * @license http://sabre.io/license/ Modified BSD License
+ */
+class Plugin extends ServerPlugin
+{
+    /**
+     * By default this plugin will require that the user is authenticated,
+     * and refuse any access if the user is not authenticated.
+     *
+     * If this setting is set to false, we let the user through, whether they
+     * are authenticated or not.
+     *
+     * This is useful if you want to allow both authenticated and
+     * unauthenticated access to your server.
+     *
+     * @param bool
+     */
+    public $autoRequireLogin = true;
+
+    /**
+     * authentication backends.
+     */
+    protected $backends;
+
+    /**
+     * The currently logged in principal. Will be `null` if nobody is currently
+     * logged in.
+     *
+     * @var string|null
+     */
+    protected $currentPrincipal;
+
+    /**
+     * Creates the authentication plugin.
+     *
+     * @param Backend\BackendInterface $authBackend
+     */
+    public function __construct(Backend\BackendInterface $authBackend = null)
+    {
+        if (!is_null($authBackend)) {
+            $this->addBackend($authBackend);
+        }
+    }
+
+    /**
+     * Adds an authentication backend to the plugin.
+     */
+    public function addBackend(Backend\BackendInterface $authBackend)
+    {
+        $this->backends[] = $authBackend;
+    }
+
+    /**
+     * Initializes the plugin. This function is automatically called by the server.
+     */
+    public function initialize(Server $server)
+    {
+        $server->on('beforeMethod:*', [$this, 'beforeMethod'], 10);
+    }
+
+    /**
+     * Returns a plugin name.
+     *
+     * Using this name other plugins will be able to access other plugins
+     * using DAV\Server::getPlugin
+     *
+     * @return string
+     */
+    public function getPluginName()
+    {
+        return 'auth';
+    }
+
+    /**
+     * Returns the currently logged-in principal.
+     *
+     * This will return a string such as:
+     *
+     * principals/username
+     * principals/users/username
+     *
+     * This method will return null if nobody is logged in.
+     *
+     * @return string|null
+     */
+    public function getCurrentPrincipal()
+    {
+        return $this->currentPrincipal;
+    }
+
+    /**
+     * This method is called before any HTTP method and forces users to be authenticated.
+     *
+     * @return bool
+     */
+    public function beforeMethod(RequestInterface $request, ResponseInterface $response)
+    {
+        if ($this->currentPrincipal) {
+            // We already have authentication information. This means that the
+            // event has already fired earlier, and is now likely fired for a
+            // sub-request.
+            //
+            // We don't want to authenticate users twice, so we simply don't do
+            // anything here. See Issue #700 for additional reasoning.
+            //
+            // This is not a perfect solution, but will be fixed once the
+            // "currently authenticated principal" is information that's not
+            // not associated with the plugin, but rather per-request.
+            //
+            // See issue #580 for more information about that.
+            return;
+        }
+
+        $authResult = $this->check($request, $response);
+
+        if ($authResult[0]) {
+            // Auth was successful
+            $this->currentPrincipal = $authResult[1];
+            $this->loginFailedReasons = null;
+
+            return;
+        }
+
+        // If we got here, it means that no authentication backend was
+        // successful in authenticating the user.
+        $this->currentPrincipal = null;
+        $this->loginFailedReasons = $authResult[1];
+
+        if ($this->autoRequireLogin) {
+            $this->challenge($request, $response);
+            throw new NotAuthenticated(implode(', ', $authResult[1]));
+        }
+    }
+
+    /**
+     * Checks authentication credentials, and logs the user in if possible.
+     *
+     * This method returns an array. The first item in the array is a boolean
+     * indicating if login was successful.
+     *
+     * If login was successful, the second item in the array will contain the
+     * current principal url/path of the logged in user.
+     *
+     * If login was not successful, the second item in the array will contain a
+     * an array with strings. The strings are a list of reasons why login was
+     * unsuccessful. For every auth backend there will be one reason, so usually
+     * there's just one.
+     *
+     * @return array
+     */
+    public function check(RequestInterface $request, ResponseInterface $response)
+    {
+        if (!$this->backends) {
+            throw new \Sabre\DAV\Exception('No authentication backends were configured on this server.');
+        }
+        $reasons = [];
+        foreach ($this->backends as $backend) {
+            $result = $backend->check(
+                $request,
+                $response
+            );
+
+            if (!is_array($result) || 2 !== count($result) || !is_bool($result[0]) || !is_string($result[1])) {
+                throw new \Sabre\DAV\Exception('The authentication backend did not return a correct value from the check() method.');
+            }
+
+            if ($result[0]) {
+                $this->currentPrincipal = $result[1];
+                // Exit early
+                return [true, $result[1]];
+            }
+            $reasons[] = $result[1];
+        }
+
+        return [false, $reasons];
+    }
+
+    /**
+     * This method sends authentication challenges to the user.
+     *
+     * This method will for example cause a HTTP Basic backend to set a
+     * WWW-Authorization header, indicating to the client that it should
+     * authenticate.
+     *
+     * @return array
+     */
+    public function challenge(RequestInterface $request, ResponseInterface $response)
+    {
+        foreach ($this->backends as $backend) {
+            $backend->challenge($request, $response);
+        }
+    }
+
+    /**
+     * List of reasons why login failed for the last login operation.
+     *
+     * @var string[]|null
+     */
+    protected $loginFailedReasons;
+
+    /**
+     * Returns a list of reasons why login was unsuccessful.
+     *
+     * This method will return the login failed reasons for the last login
+     * operation. One for each auth backend.
+     *
+     * This method returns null if the last authentication attempt was
+     * successful, or if there was no authentication attempt yet.
+     *
+     * @return string[]|null
+     */
+    public function getLoginFailedReasons()
+    {
+        return $this->loginFailedReasons;
+    }
+
+    /**
+     * Returns a bunch of meta-data about the plugin.
+     *
+     * Providing this information is optional, and is mainly displayed by the
+     * Browser plugin.
+     *
+     * The description key in the returned array may contain html and will not
+     * be sanitized.
+     *
+     * @return array
+     */
+    public function getPluginInfo()
+    {
+        return [
+            'name' => $this->getPluginName(),
+            'description' => 'Generic authentication plugin',
+            'link' => 'http://sabre.io/dav/authentication/',
+        ];
+    }
+}