Make provider deactivatable by admin

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

lib/Activity/Provider.php

@@ -75,6 +75,9 @@ class Provider implements IProvider {
 			case 'u2f_device_removed':
 				$event->setSubject($l->t('You removed an U2F hardware token'));
 				break;
+			case 'u2f_disabled_by_admin':
+				$event->setSubject($l->t('U2F disabled by an admin'));
+				break;
 		}
 		return $event;
 	}

lib/AppInfo/Application.php

@@ -14,6 +14,7 @@ declare(strict_types=1);
 
 namespace OCA\TwoFactorU2F\AppInfo;
 
+use OCA\TwoFactorU2F\Event\DisabledByAdmin;
 use OCA\TwoFactorU2F\Event\StateChanged;
 use OCA\TwoFactorU2F\Listener\IListener;
 use OCA\TwoFactorU2F\Listener\StateChangeActivity;
@@ -36,6 +37,16 @@ class Application extends App {
 				$container->query(StateChangeRegistryUpdater::class),
 			];
 
+			foreach ($listeners as $listener) {
+				$listener->handle($event);
+			}
+		});
+		$eventDispatcher->addListener(DisabledByAdmin::class, function (DisabledByAdmin $event) use ($container) {
+			/** @var IListener[] $listeners */
+			$listeners = [
+				$container->query(StateChangeActivity::class),
+			];
+
 			foreach ($listeners as $listener) {
 				$listener->handle($event);
 			}

lib/Event/DisabledByAdmin.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\TwoFactorU2F\Event;
+
+use OCP\IUser;
+
+class DisabledByAdmin extends StateChanged {
+
+	public function __construct(IUser $user) {
+		parent::__construct($user, false);
+	}
+
+}

lib/Listener/StateChangeActivity.php

@@ -14,6 +14,7 @@ declare(strict_types=1);
 
 namespace OCA\TwoFactorU2F\Listener;
 
+use OCA\TwoFactorU2F\Event\DisabledByAdmin;
 use OCA\TwoFactorU2F\Event\StateChanged;
 use OCP\Activity\IManager;
 use Symfony\Component\EventDispatcher\Event;
@@ -29,7 +30,11 @@ class StateChangeActivity implements IListener {
 
 	public function handle(Event $event) {
 		if ($event instanceof StateChanged) {
-			$subject = $event->isEnabled() ? 'u2f_device_added' : 'u2f_device_removed';
+			if ($event instanceof DisabledByAdmin) {
+				$subject = 'u2f_disabled_by_admin';
+			} else {
+				$subject = $event->isEnabled() ? 'u2f_device_added' : 'u2f_device_removed';
+			}
 
 			$activity = $this->activityManager->generateEvent();
 			$activity->setApp('twofactor_u2f')

lib/Provider/U2FProvider.php

@@ -16,6 +16,7 @@ namespace OCA\TwoFactorU2F\Provider;
 
 use OCA\TwoFactorU2F\Service\U2FManager;
 use OCA\TwoFactorU2F\Settings\Personal;
+use OCP\Authentication\TwoFactorAuth\IDeactivatableByAdmin;
 use OCP\Authentication\TwoFactorAuth\IPersonalProviderSettings;
 use OCP\Authentication\TwoFactorAuth\IProvider;
 use OCP\Authentication\TwoFactorAuth\IProvidesIcons;
@@ -24,7 +25,7 @@ use OCP\IL10N;
 use OCP\IUser;
 use OCP\Template;
 
-class U2FProvider implements IProvider, IProvidesIcons, IProvidesPersonalSettings {
+class U2FProvider implements IProvider, IProvidesIcons, IProvidesPersonalSettings, IDeactivatableByAdmin {
 
 	/** @var IL10N */
 	private $l10n;
@@ -94,4 +95,14 @@ class U2FProvider implements IProvider, IProvidesIcons, IProvidesPersonalSetting
 	public function getDarkIcon(): String {
 		return image_path('twofactor_u2f', 'app-dark.svg');;
 	}
+
+	/**
+	 * Disable this provider for the given user.
+	 *
+	 * @param IUser $user the user to deactivate this provider for
+	 */
+	public function disableFor(IUser $user) {
+		$this->manager->removeAllDevices($user);
+	}
+
 }

lib/Service/U2FManager.php

@@ -19,6 +19,7 @@ require_once(__DIR__ . '/../../vendor/yubico/u2flib-server/src/u2flib_server/U2F
 use InvalidArgumentException;
 use OCA\TwoFactorU2F\Db\Registration;
 use OCA\TwoFactorU2F\Db\RegistrationMapper;
+use OCA\TwoFactorU2F\Event\DisabledByAdmin;
 use OCA\TwoFactorU2F\Event\StateChanged;
 use OCP\ILogger;
 use OCP\IRequest;
@@ -86,6 +87,13 @@ class U2FManager {
 		$this->eventDispatcher->dispatch(StateChanged::class, new StateChanged($user, false));
 	}
 
+	public function removeAllDevices(IUser $user) {
+		foreach ($this->mapper->findRegistrations($user) as $registration) {
+			$this->mapper->delete($registration);
+		}
+		$this->eventDispatcher->dispatch(DisabledByAdmin::class, new DisabledByAdmin($user));
+	}
+
 	public function startRegistration(IUser $user): array {
 		$u2f = $this->getU2f();
 		$data = $u2f->getRegisterData($this->getRegistrations($user));

tests/Unit/Activity/ProviderTest.php

@@ -63,8 +63,9 @@ class ProviderTest extends TestCase {
 
 	public function subjectData() {
 		return [
-				['u2f_device_added'],
-				['u2f_device_removed'],
+			['u2f_device_added'],
+			['u2f_device_removed'],
+			['u2f_disabled_by_admin'],
 		];
 	}
 

tests/Unit/Listener/StateChangeActivityTest.php

@@ -8,6 +8,7 @@
 
 namespace OCA\TwoFactorU2F\Tests\Unit\Listener;
 
+use OCA\TwoFactorU2F\Event\DisabledByAdmin;
 use OCA\TwoFactorU2F\Event\StateChanged;
 use OCA\TwoFactorU2F\Listener\StateChangeActivity;
 use OCP\Activity\IEvent;
@@ -114,4 +115,40 @@ class StateChangeActivityTest extends TestCase {
 
 		$this->listener->handle($event);
 	}
+
+	public function testHandleDisabledByAdminEvent() {
+		$uid = 'user234';
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn($uid);
+		$event = new DisabledByAdmin($user);
+		$activityEvent = $this->createMock(IEvent::class);
+		$this->activityManager->expects($this->once())
+			->method('generateEvent')
+			->willReturn($activityEvent);
+		$activityEvent->expects($this->once())
+			->method('setApp')
+			->with('twofactor_u2f')
+			->willReturnSelf();
+		$activityEvent->expects($this->once())
+			->method('setType')
+			->with('security')
+			->willReturnSelf();
+		$activityEvent->expects($this->once())
+			->method('setAuthor')
+			->with($uid)
+			->willReturnSelf();
+		$activityEvent->expects($this->once())
+			->method('setAffectedUser')
+			->with($uid)
+			->willReturnSelf();
+		$activityEvent->expects($this->once())
+			->method('setSubject')
+			->with($this->equalTo('u2f_disabled_by_admin'))
+			->willReturnSelf();
+		$this->activityManager->expects($this->once())
+			->method('publish')
+			->with($activityEvent);
+
+		$this->listener->handle($event);
+	}
 }

tests/Unit/Provider/U2FProviderTest.php

@@ -132,4 +132,13 @@ class U2FProviderTest extends TestCase {
 		$this->assertEquals($expected, $settings);
 	}
 
+	public function testDisable() {
+		$user = $this->createMock(IUser::class);
+		$this->manager->expects($this->once())
+			->method('removeAllDevices')
+			->with($user);
+
+		$this->provider->disableFor($user);
+	}
+
 }

tests/Unit/Service/U2FManagerTest.php

@@ -14,6 +14,7 @@ namespace OCA\TwoFactorU2F\Tests\Unit\Service;
 
 use OCA\TwoFactorU2F\Db\Registration;
 use OCA\TwoFactorU2F\Db\RegistrationMapper;
+use OCA\TwoFactorU2F\Event\DisabledByAdmin;
 use OCA\TwoFactorU2F\Event\StateChanged;
 use OCA\TwoFactorU2F\Service\U2FManager;
 use OCP\Activity\IEvent;
@@ -107,6 +108,26 @@ class U2FManagerTest extends TestCase {
 		$this->manager->removeDevice($user, 13);
 	}
 
+	public function testRemoveAllDevices() {
+		$user = $this->createMock(IUser::class);
+		$regs = [$this->createMock(Registration::class)];
+		$this->mapper->expects($this->once())
+			->method('findRegistrations')
+			->with($user)
+			->willReturn($regs);
+		$this->mapper->expects($this->once())
+			->method('delete')
+			->with($regs[0]);
+		$this->eventDispatcher->expects($this->once())
+			->method('dispatch')
+			->with(
+				$this->equalTo(DisabledByAdmin::class),
+				$this->equalTo(new DisabledByAdmin($user))
+			);
+
+		$this->manager->removeAllDevices($user);
+	}
+
 	public function testStartRegistrationFirstDevice() {
 		$user = $this->createMock(IUser::class);
 		$this->mockRegistrations($user, 0);