clef.module

<?php

/**
 * @file
 *   Provides the ability to log in with Clef.
 *
 * TODO: Associate the Clef ID with a user so that if they change their email
 *   address they can still log in
 */

define('CLEF_DEFAULT_PASSWORD_LENGTH', 32);

/**
* Implements hook_init().
*/
function clef_init() {
  _initialize_state();
}

/**
 * Implements hook_menu().
 */
function clef_menu() {
  $items = array();
  $items['admin/people/clef'] = array(
    'title' => 'Clef',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('clef_admin'),
    'access arguments' => array('administer site configuration'),
    'description' => 'Allows administrators to configure settings for the Clef module.',
  );
  $items['clef/verify'] = array(
    'title' => 'Clef',
    'description' => 'Clef verification page',
    'page callback' => 'clef_verify_callback',
    'access callback' => TRUE,
    'type' => MENU_CALLBACK,
  );
  return $items;
}

/**
 * Implements hook_block_info().
 */
function clef_block_info() {
  return array(
    'login' => array(
      'info' => t('Log in with Clef'),
    ),
  );
}

/**
 * Implements hook_block_view().
 */
function clef_block_view($delta = '') {
  if ($delta == 'login' && !user_is_logged_in()) {
    return array(
      'subject' => t('Log in'),
      'content' => clef_login_button(),
    );
  }
}

/**
 * Implements hook_form_FORM_ID_alter().
 */
function clef_form_user_login_alter(&$form, $form_state) {
  if (variable_get('clef_login_form', 1)) {
    $form['actions']['clef'] = array(
      '#markup' => clef_login_button(),
    );
  }
}

/**
 * Implements hook_form_FORM_ID_alter().
 */
function clef_form_user_login_block_alter(&$form, $form_state) {
  clef_form_user_login_alter($form, $form_state);
}

/**
 * Implements hook_form_FORM_ID_alter().
 */
function clef_form_user_register_form_alter(&$form, $form_state) {
  if (!empty($_GET['email'])) {
    $form['account']['name']['#default_value'] = _clef_get_name($_GET);
    // user_validate_mail() has the opposite return value you'd expect
    if (!user_validate_mail($_GET['email'])) {
      $form['account']['mail'] = array(
        '#type' => 'value',
        '#value' => $_GET['email'],
      );
      $form['account']['mail_info'] = array(
        '#type' => 'item',
        '#title' => t('E-mail address'),
        '#markup' => '<p>' . check_plain($_GET['email']) . '</p>',
        '#required' => TRUE,
        '#weight' => -1,
      );
    }
    if (!variable_get('user_email_verification', TRUE)) {
      $form['account']['pass'] = array(
        '#type' => 'value',
        '#value' => user_password(CLEF_DEFAULT_PASSWORD_LENGTH),
      );
    }
  }
}

/**
 * Returns the HTML script tag for the "Log in with Clef" button.
 */
function clef_login_button() {
  return '<div class="clef-wrapper"><script data-redirect-url="' . variable_get('clef_url', url('clef/verify', array('absolute' => TRUE))) .
    '" data-style="' . variable_get('clef_button_type', 'button') .
    '" data-color="' . variable_get('clef_color', 'blue') .
    '" data-app-id="' . variable_get('clef_app_id', '') .
    '" data-state="' . _get_state() .
    '" class="clef-button" src="https://clef.io/v3/clef.js" type="text/javascript"></script></div>';
}

/**
 * The callback for the Clef verify page.
 */
function clef_verify_callback() {
  if ($info = clef_verify()) {
    // Clef is authorized to log into accounts using this email address
    if ($account = user_load_by_mail($info['email'])) {
      $form_state = array('uid' => $account->uid);
      user_login_submit(array(), $form_state);
      drupal_goto('user/' . $account->uid);
    }
    // If we're not auto-registering, go to the registration form
    elseif (!variable_get('clef_auto_register', 0)) {
      unset($info['id'], $info['phone_number']);
      drupal_goto('user/register', array('query' => $info));
    }
    // Error 403 if only admins can create accounts
    elseif (variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_ADMINISTRATORS_ONLY) {
      drupal_set_message('Your Clef email address is not associated with any user accounts on this site, and only administrators may create new accounts.', 'error');
      return MENU_ACCESS_DENIED;
    }
    // Register the user
    else {
      $form = $form_state = array();
      $form['#user'] = drupal_anonymous_user();
      $form['#user_category'] = 'register';
      $form_state['values']['administer_users'] = FALSE;
      $form_state['values']['name'] = _clef_get_name($info);
      $form_state['values']['mail'] = $info['email'];
      $form_state['values']['pass'] = user_password(CLEF_DEFAULT_PASSWORD_LENGTH);
      user_register_submit($form, $form_state);
      drupal_goto();
    }
  }
  else {
    drupal_set_message(t('Drupal was unable to authenticate with Clef.'), 'error');
    return MENU_ACCESS_DENIED;
  }
}

/**
 * Verifies a user who is attempting to log in with Clef.
 *
 * @param $code
 *   (Optional) The verification code. Defaults to $_REQUEST['code'].
 *
 * @return
 *   FALSE if the verification failed or an associative array containing the
 *   following keys if it succeeded:
 *   - id
 *   - first_name
 *   - last_name
 *   - phone_number
 *   - email
 *   "id" is guaranteed to appear but the other values must be authorized in
 *   the app's settings.
 */
function clef_verify($code = '') {
  if (!_verify_state()) return FALSE;

  if (empty($code)) {
    $code = isset($_REQUEST['code']) ? $_REQUEST['code'] : '';
    if (empty($code)) {
      return FALSE;
    }
  }

  $postdata = http_build_query(array(
    'code' => $code,
    'app_id' => variable_get('clef_app_id', ''),
    'app_secret' => variable_get('clef_app_secret', ''),
  ));

  $response = json_decode(drupal_http_request('https://clef.io/api/v1/authorize', array(
    'method'  => 'POST',
    'headers' => array('Content-Type' => 'application/x-www-form-urlencoded'),
    'data' => $postdata,
  ))->data, TRUE);

  if ($response && !empty($response['access_token'])) {
    $url = 'https://clef.io/api/v1/info?access_token=' . $response['access_token'];
    $response = json_decode(drupal_http_request($url)->data, TRUE);

    if ($response && !empty($response['info']) && !empty($response['success'])) {
      return $response['info'];
    }
    watchdog('clef', 'Clef information retrieval failed with error: %error', array('%error' => isset($response['error']) ? $response['error'] : 'Unknown'), WATCHDOG_WARNING);
  }
  else {
    watchdog('clef', 'Clef authorization failed with error: %error', array('%error' => isset($response['error']) ? $response['error'] : 'Unknown'), WATCHDOG_WARNING);
  }
  return FALSE;
}

/**
 * The administrative settings form.
 */
function clef_admin($form, $form_state) {
  if (variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_ADMINISTRATORS_ONLY) {
    drupal_set_message(t('Currently, only administrators can create user accounts.') . ' ' .
      t('As a result, people logging in with Clef who use an email address not already associated with a Drupal user will encounter an access denied error.') . ' ' .
      t('If this is not the desired behavior, you should <a href="!url">change the registration setting</a>.',
        array('!url' => url('admin/config/people/accounts', array('fragment' => 'edit-user-register')))
      ), 'warning');
  }
  if (!variable_get('clef_app_id', '')) {
    drupal_set_message(t('Before allowing users to log in with Clef, you must <a href="@create">create a Clef application</a>.', array(
        '@create' => 'https://getclef.com/developer',
      )) . ' ' .
      t('You must give the app at least the "Email" permission, and the name-related permissions are recommended.') . ' ' .
      t('Use <a href="@url">@url</a> for the "Application domain."', array('@url' => url())) . ' ' .
      t('Clef will then give you an Application ID and Application Secret which you must copy-paste below.'),
      'warning');
  }
  $form['clef_app_id'] = array(
    '#type' => 'textfield',
    '#title' => t('Application ID'),
    '#description' => t('You can find this in your Clef developer dashboard. You must first register an application.'),
    '#default_value' => variable_get('clef_app_id', ''),
    '#required' => TRUE,
  );
  $form['clef_app_secret'] = array(
    '#type' => 'textfield',
    '#title' => t('Application Secret'),
    '#description' => t('You can find this in your Clef developer dashboard. You must first register an application.'),
    '#default_value' => variable_get('clef_app_secret', ''),
    '#required' => TRUE,
  );
  $form['clef_button_type'] = array(
    '#type' => 'radios',
    '#title' => t('Button type'),
    '#default_value' => variable_get('clef_button_type', 'button'),
    '#required' => TRUE,
    '#options' => array(
      'button' => t('Rounded'),
      'flat' => t('Flat'),
    ),
  );
  $form['clef_color'] = array(
    '#type' => 'radios',
    '#title' => t('Button color'),
    '#default_value' => variable_get('clef_color', 'blue'),
    '#required' => TRUE,
    '#options' => array(
      'blue' => t('Blue'),
      'white' => t('White'),
    ),
  );
  $form['clef_login_form'] = array(
    '#type' => 'checkbox',
    '#title' => t('Add a "Log in with your phone" button to the normal user login form'),
    '#default_value' => variable_get('clef_login_form', 1),
  );
  $form['clef_auto_register'] = array(
    '#type' => 'checkbox',
    '#title' => t('Automatically register users who attempt to log in with Clef but are not registered'),
    '#description' => t('If enabled, this setting bypasses non-default fields added to the registration form.'),
    '#default_value' => variable_get('clef_auto_register', 0),
  );
  return system_settings_form($form);
}

/**
 * Get a username for the user.
 *
 * Tries to use the name if available, then tries the email.
 */
function _clef_get_name($info) {
  if (!empty($info['first_name'])) {
    return $info['first_name'] . (empty($info['last_name']) ? '' : ' ' . $info['last_name']);
  }
  elseif (!empty($info['last_name'])) {
    return $info['last_name'];
  }
  elseif (!empty($info['email'])) {
    return drupal_ucfirst(drupal_substr($info['email'], 0, strpos($info['email'], '@')));
  }
  return '';
}

function _get_state() {
  if (!isset($_COOKIE['_clef_state']) || !$_COOKIE['_clef_state']) {
    return _initialize_state();
  } else {
    return $_COOKIE['_clef_state'];
  }
}

function _verify_state() {
  $request_state = $code = isset($_REQUEST['state']) ? $_REQUEST['state'] : '';
  $correct_state = _get_state();

  if ($request_state && $correct_state && $correct_state == $request_state) {
    _initialize_state(true);
    return true;
  } else {
    return false;
  }
}

function _initialize_state($override=false) {
  if (!$override && isset($_COOKIE['_clef_state']) && $_COOKIE['_clef_state']) return;

  $state = md5(uniqid(rand(), true));
  @setcookie('_clef_state', $state, (time() + 60 * 60 * 24), '/', '', isset($_SERVER['HTTPS']), true);
  $_COOKIE['state'] = $state;

  return $state;
}