Skip to content

Commit e9f23f5

Browse files
schebscheb
committed
Remove deprecated "window" option
1 parent e8f84a4 commit e9f23f5

File tree

15 files changed

+42
-213
lines changed

15 files changed

+42
-213
lines changed

‎UPGRADE.md

+16-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,22 @@ Here's an overview if you have to do any work when upgrading.
66
6.x to 7.x
77
----------
88

9-
Nothing to be done. Upgrade and enjoy :)
9+
### `scheb/2fa-google-authenticator` and `scheb/2fa-totp` Packages
10+
11+
The configuration options `scheb_two_factor.google.window` and `scheb_two_factor.totp.window` have been removed. If you
12+
used these, please use `leeway` instead.
13+
14+
```yaml
15+
# config/packages/scheb_2fa.yaml
16+
scheb_two_factor:
17+
google:
18+
leeway: 10 # Acceptable time drift in seconds, must be less or equal than 30 seconds
19+
20+
# TOTP authentication config
21+
totp:
22+
leeway: 10 # Acceptable time drift in seconds, must be less or equal than the TOTP period
23+
```
24+
1025
1126
5.x to 6.x
1227
----------

‎app/config/packages/scheb_2fa.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -26,16 +26,14 @@ scheb_two_factor:
2626
enabled: true # If Google Authenticator should be enabled, default false
2727
server_name: Server Name # Server name used in QR code
2828
issuer: Issuer Name # Issuer name used in QR code
29-
window: 1 # How many codes before/after the current one would be accepted as valid
30-
# leeway: 30
29+
leeway: 15 # Acceptable time drift in seconds
3130
template: security/2fa.html.twig # Template used to render the authentication form
3231

3332
totp:
3433
enabled: true # If TOTP authentication should be enabled, default false
3534
server_name: Server Name # Server name used in QR code
3635
issuer: Issuer Name # Issuer name used in QR code
37-
window: 1 # How many codes before/after the current one would be accepted as valid
38-
# leeway: 30
36+
leeway: 15 # Acceptable time drift in seconds
3937
parameters: # Additional parameters added in the QR code
4038
image: 'https://my-service/img/logo.png'
4139
template: security/2fa.html.twig # Template used to render the authentication form

‎doc/configuration.rst

+2-14
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,7 @@ Bundle Configuration
4747
server_name: Server Name # Server name used in QR code
4848
issuer: Issuer Name # Issuer name used in QR code
4949
digits: 6 # Number of digits in authentication code
50-
window: 1 # [DEPRECATED since v6.11, will be removed in v7] Use "leeway", if possible
51-
# Behavior depends on the version of Spomky-Labs/otphp used:
52-
# - Until v10: How many codes before/after the current one would be accepted
53-
# - From v11: Acceptable time drift in seconds
54-
leeway: 0 # Acceptable time drift in seconds, requires Spomky-Labs/otphp v11 to be used
55-
# Must be less or equal than 30 seconds
56-
# If configured, takes precedence over the "window" option
50+
leeway: 0 # Acceptable time drift in seconds, must be less or equal than 30 seconds
5751
template: security/2fa_form.html.twig # Template used to render the authentication form
5852
form_renderer: acme.custom_form_renderer # Use a custom form renderer service
5953
@@ -62,13 +56,7 @@ Bundle Configuration
6256
enabled: true # If TOTP authentication should be enabled, default false
6357
server_name: Server Name # Server name used in QR code
6458
issuer: Issuer Name # Issuer name used in QR code
65-
window: 1 # [DEPRECATED since v6.11, will be removed in v7] Use "leeway", if possible
66-
# Behavior depends on the version of Spomky-Labs/otphp used:
67-
# - Until v10: How many codes before/after the current one would be accepted
68-
# - From v11: Acceptable time drift in seconds
69-
leeway: 0 # Acceptable time drift in seconds, requires Spomky-Labs/otphp v11 to be used
70-
# Must be less or equal than the TOTP code's period
71-
# If configured, takes precedence over the "window" option
59+
leeway: 0 # Acceptable time drift in seconds, must be less or equal than the TOTP period
7260
parameters: # Additional parameters added in the QR code
7361
image: 'https://my-service/img/logo.png'
7462
template: security/2fa_form.html.twig # Template used to render the authentication form

‎doc/providers/google.rst

+1-7
Original file line numberDiff line numberDiff line change
@@ -142,13 +142,7 @@ Configuration Reference
142142
server_name: Server Name # Server name used in QR code
143143
issuer: Issuer Name # Issuer name used in QR code
144144
digits: 6 # Number of digits in authentication code
145-
window: 1 # [DEPRECATED since v6.11, will be removed in v7] Use "leeway", if possible
146-
# Behavior depends on the version of Spomky-Labs/otphp used:
147-
# - Until v10: How many codes before/after the current one would be accepted
148-
# - From v11: Acceptable time drift in seconds
149-
leeway: 0 # Acceptable time drift in seconds, requires Spomky-Labs/otphp v11 to be used
150-
# Must be less or equal than 30 seconds
151-
# If configured, takes precedence over the "window" option
145+
leeway: 0 # Acceptable time drift in seconds, must be less or equal than 30 seconds
152146
template: security/2fa_form.html.twig # Template used to render the authentication form
153147
154148
Custom Authentication Form Template

‎doc/providers/totp.rst

+1-7
Original file line numberDiff line numberDiff line change
@@ -143,13 +143,7 @@ Configuration Options
143143
enabled: true # If TOTP authentication should be enabled, default false
144144
server_name: Server Name # Server name used in QR code
145145
issuer: Issuer Name # Issuer name used in QR code
146-
window: 1 # [DEPRECATED since v6.11, will be removed in v7] Use "leeway", if possible
147-
# Behavior depends on the version of Spomky-Labs/otphp used:
148-
# - Until v10: How many codes before/after the current one would be accepted
149-
# - From v11: Acceptable time drift in seconds
150-
leeway: 0 # Acceptable time drift in seconds, requires Spomky-Labs/otphp v11 to be used
151-
# Must be less or equal than the TOTP code's period
152-
# If configured, takes precedence over the "window" option
146+
leeway: 0 # Acceptable time drift in seconds, must be less or equal than the TOTP period
153147
parameters: # Additional parameters added in the QR code
154148
image: 'https://my-service/img/logo.png'
155149
template: security/2fa_form.html.twig # Template used to render the authentication form

‎doc/troubleshooting.rst

+6-16
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ it depends on your configuration). The bigger the time difference between server
2020
window, the higher the chance that the codes generated on server and from the app don't match up. When the time
2121
difference becomes larger than the time window, it becomes impossible to provide the right code.
2222

23-
To counteract the issue of time differences you could increase the ``leeway`` or ``window`` (deprecated) setting,
24-
then more codes around the current time window will be accepted:
23+
To counteract the issue of time differences you could increase the ``leeway`` setting, then more codes around the
24+
current time window will be accepted:
2525

2626
.. code-block:: yaml
2727
@@ -30,23 +30,13 @@ then more codes around the current time window will be accepted:
3030
3131
# For TOTP
3232
totp:
33-
window: 1 # [DEPRECATED since v6.11, will be removed in v7] Use "leeway", if possible
34-
# Behavior depends on the version of Spomky-Labs/otphp used:
35-
# - Until v10: How many codes before/after the current one would be accepted
36-
# - From v11: Acceptable time drift in seconds
37-
leeway: 0 # Acceptable time drift in seconds, requires Spomky-Labs/otphp v11 to be used
38-
# Must be less or equal than the TOTP code's period
39-
# If configured, takes precedence over the "window" option
33+
leeway: 0 # Acceptable time drift in seconds, must be less or equal than the TOTP period
34+
4035
4136
# For Google Authenticator
4237
google:
43-
window: 1 # [DEPRECATED since v6.11, will be removed in v7] Use "leeway", if possible
44-
# Behavior depends on the version of Spomky-Labs/otphp used:
45-
# - Until v10: How many codes before/after the current one would be accepted
46-
# - From v11: Acceptable time drift in seconds
47-
leeway: 0 # Acceptable time drift in seconds, requires Spomky-Labs/otphp v11 to be used
48-
# Must be less or equal than 30 seconds
49-
# If configured, takes precedence over the "window" option
38+
leeway: 0 # Acceptable time drift in seconds, must be less or equal than 30 seconds
39+
5040
5141
You might want to configure a time synchronization service, such as ``ntpdate`` on your server to make sure your server
5242
time is always in sync with UTC.

‎src/bundle/DependencyInjection/Configuration.php

+2-10
Original file line numberDiff line numberDiff line change
@@ -174,11 +174,7 @@ private function addTotpConfiguration(ArrayNodeDefinition $rootNode): void
174174
->scalarNode('form_renderer')->defaultNull()->end()
175175
->scalarNode('issuer')->defaultNull()->end()
176176
->scalarNode('server_name')->defaultNull()->end()
177-
->integerNode('window')
178-
->defaultValue(1)->min(0)
179-
->setDeprecated('scheb/2fa-totp', '6.11', 'The "%path%.%node%" option is deprecated. Use "leeway" instead, which requires spomky-labs/otphp v11 to be used.')
180-
->end()
181-
->integerNode('leeway')->defaultNull()->min(0)->end()
177+
->integerNode('leeway')->defaultValue(0)->min(0)->end()
182178
->arrayNode('parameters')
183179
->scalarPrototype()->end()
184180
->end()
@@ -210,11 +206,7 @@ private function addGoogleAuthenticatorConfiguration(ArrayNodeDefinition $rootNo
210206
->scalarNode('server_name')->defaultNull()->end()
211207
->scalarNode('template')->defaultValue('@SchebTwoFactor/Authentication/form.html.twig')->end()
212208
->integerNode('digits')->defaultValue(6)->min(1)->end()
213-
->integerNode('window')
214-
->defaultValue(1)->min(0)
215-
->setDeprecated('scheb/2fa-google-authenticator', '6.11', 'The "%path%.%node%" option is deprecated. Use "leeway" instead, which requires spomky-labs/otphp v11 to be used.')
216-
->end()
217-
->integerNode('leeway')->defaultNull()->min(0)->end()
209+
->integerNode('leeway')->defaultValue(0)->min(0)->end()
218210
->end()
219211
->end()
220212
->end();

‎src/bundle/DependencyInjection/SchebTwoFactorExtension.php

-29
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,13 @@
44

55
namespace Scheb\TwoFactorBundle\DependencyInjection;
66

7-
use OTPHP\TOTP;
8-
use ReflectionMethod;
9-
use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
107
use Symfony\Component\Config\FileLocator;
118
use Symfony\Component\DependencyInjection\Argument\IteratorArgument;
129
use Symfony\Component\DependencyInjection\ContainerBuilder;
1310
use Symfony\Component\DependencyInjection\Loader;
1411
use Symfony\Component\DependencyInjection\Reference;
1512
use Symfony\Component\HttpKernel\DependencyInjection\Extension;
1613
use function assert;
17-
use function class_exists;
18-
use function count;
1914
use function is_bool;
2015
use function is_string;
2116
use function trim;
@@ -193,19 +188,13 @@ private function configureEmailAuthenticationProvider(ContainerBuilder $containe
193188
*/
194189
private function configureGoogleAuthenticationProvider(ContainerBuilder $container, array $config): void
195190
{
196-
// Migration path for the "leeway" option, to be fully migrated in bundle version 7
197-
if (null !== $config['google']['leeway'] && !$this->isSpomkyOtphpVersion11Used()) {
198-
throw new InvalidConfigurationException('The "leeway" option can only be set when spomky-labs/otphp v11 is used.');
199-
}
200-
201191
$loader = new Loader\PhpFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
202192
$loader->load('two_factor_provider_google.php');
203193

204194
$container->setParameter('scheb_two_factor.google.server_name', $config['google']['server_name']);
205195
$container->setParameter('scheb_two_factor.google.issuer', $config['google']['issuer']);
206196
$container->setParameter('scheb_two_factor.google.template', $config['google']['template']);
207197
$container->setParameter('scheb_two_factor.google.digits', $config['google']['digits']);
208-
$container->setParameter('scheb_two_factor.google.window', $config['google']['window']);
209198
$container->setParameter('scheb_two_factor.google.leeway', $config['google']['leeway']);
210199

211200
if (null === $config['google']['form_renderer']) {
@@ -220,17 +209,11 @@ private function configureGoogleAuthenticationProvider(ContainerBuilder $contain
220209
*/
221210
private function configureTotpAuthenticationProvider(ContainerBuilder $container, array $config): void
222211
{
223-
// Migration path for the "leeway" option, to be fully migrated in bundle version 7
224-
if (null !== $config['totp']['leeway'] && !$this->isSpomkyOtphpVersion11Used()) {
225-
throw new InvalidConfigurationException('The "leeway" option can only be set when spomky-labs/otphp v11 is used.');
226-
}
227-
228212
$loader = new Loader\PhpFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
229213
$loader->load('two_factor_provider_totp.php');
230214

231215
$container->setParameter('scheb_two_factor.totp.issuer', $config['totp']['issuer']);
232216
$container->setParameter('scheb_two_factor.totp.server_name', $config['totp']['server_name']);
233-
$container->setParameter('scheb_two_factor.totp.window', $config['totp']['window']);
234217
$container->setParameter('scheb_two_factor.totp.parameters', $config['totp']['parameters']);
235218
$container->setParameter('scheb_two_factor.totp.template', $config['totp']['template']);
236219
$container->setParameter('scheb_two_factor.totp.leeway', $config['totp']['leeway']);
@@ -242,18 +225,6 @@ private function configureTotpAuthenticationProvider(ContainerBuilder $container
242225
$container->setAlias('scheb_two_factor.security.totp.form_renderer', $config['totp']['form_renderer']);
243226
}
244227

245-
private function isSpomkyOtphpVersion11Used(): bool
246-
{
247-
if (!class_exists(TOTP::class)) {
248-
return false;
249-
}
250-
251-
$parameters = (new ReflectionMethod(TOTP::class, 'verify'))->getParameters();
252-
253-
// Third parameter must be named "leeway"
254-
return count($parameters) >= 3 && 'leeway' === $parameters[2]->getName();
255-
}
256-
257228
private function resolveFeatureFlag(ContainerBuilder $container, bool|string $value): bool
258229
{
259230
$retValue = $container->resolveEnvPlaceholders($value, true);

‎src/bundle/Resources/config/two_factor_provider_google.php

-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
->public()
2525
->args([
2626
service('scheb_two_factor.security.google_totp_factory'),
27-
'%scheb_two_factor.google.window%',
2827
'%scheb_two_factor.google.leeway%',
2928
])
3029

‎src/bundle/Resources/config/two_factor_provider_totp.php

-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
->public()
2626
->args([
2727
service('scheb_two_factor.security.totp_factory'),
28-
'%scheb_two_factor.totp.window%',
2928
'%scheb_two_factor.totp.leeway%',
3029
])
3130

‎src/google-authenticator/Security/TwoFactor/Provider/Google/GoogleAuthenticator.php

+2-4
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,7 @@ class GoogleAuthenticator implements GoogleAuthenticatorInterface
1818
public function __construct(
1919
private readonly GoogleTotpFactory $totpFactory,
2020
/** @var 0|positive-int */
21-
private readonly int $window,
22-
/** @var 0|positive-int|null */
23-
private readonly null|int $leeway,
21+
private readonly int $leeway,
2422
) {
2523
}
2624

@@ -33,7 +31,7 @@ public function checkCode(TwoFactorInterface $user, string $code): bool
3331
}
3432

3533
/** @var non-empty-string $code */
36-
return $this->totpFactory->createTotpForUser($user)->verify($code, null, $this->leeway ?? $this->window);
34+
return $this->totpFactory->createTotpForUser($user)->verify($code, null, $this->leeway);
3735
}
3836

3937
public function getQRContent(TwoFactorInterface $user): string

‎src/totp/Security/TwoFactor/Provider/Totp/TotpAuthenticator.php

+2-4
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,7 @@ class TotpAuthenticator implements TotpAuthenticatorInterface
1818
public function __construct(
1919
private readonly TotpFactory $totpFactory,
2020
/** @var 0|positive-int */
21-
private readonly int $window,
22-
/** @var 0|positive-int|null */
23-
private readonly null|int $leeway,
21+
private readonly int $leeway,
2422
) {
2523
}
2624

@@ -33,7 +31,7 @@ public function checkCode(TwoFactorInterface $user, string $code): bool
3331
}
3432

3533
/** @var non-empty-string $code */
36-
return $this->totpFactory->createTotpForUser($user)->verify($code, null, $this->leeway ?? $this->window);
34+
return $this->totpFactory->createTotpForUser($user)->verify($code, null, $this->leeway);
3735
}
3836

3937
public function getQRContent(TwoFactorInterface $user): string

0 commit comments

Comments
 (0)