From 738cfb7aea63a87cb0559bd8109bd5ac3af66dd8 Mon Sep 17 00:00:00 2001
From: Vincent BRIDIER <vincent.bridier@ldc.fr>
Date: Fri, 26 Jul 2024 15:05:16 +0200
Subject: [PATCH 1/2] PHPCS

---
 routes/web-bo.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/routes/web-bo.php b/routes/web-bo.php
index 878c254..fd29849 100644
--- a/routes/web-bo.php
+++ b/routes/web-bo.php
@@ -89,7 +89,10 @@ Route::middleware('admin-secure')
                                 // * TICKETS
                                 Route::get('/tickets/json/paginate', [TicketController::class, 'jsonPaginate'])
                                     ->name('tickets.json-paginate');
-                                Route::post('/ticket/{ticket}/create-issue', [TicketController::class, 'createGitlabIssue'])
+                                Route::post(
+                                    '/ticket/{ticket}/create-issue',
+                                    [TicketController::class, 'createGitlabIssue']
+                                )
                                     ->middleware('can:createGitlabIssue,ticket')
                                     ->name('ticket.create-issue');
                             });

From 889ee1e7f41ad001a065132c5ef732e990545881 Mon Sep 17 00:00:00 2001
From: Vincent BRIDIER <vincent.bridier@ldc.fr>
Date: Fri, 26 Jul 2024 15:06:30 +0200
Subject: [PATCH 2/2] Update SP management for SAML

---
 .env.example                          |  6 ----
 app/Interfaces/SpsConfigInterface.php | 42 ++++++++++++++++++++++
 app/Traits/Enums/SpsConfigTrait.php   | 52 +++++++++++++++++++++++++++
 config/samlidp.php                    | 14 +++++---
 manifest.yaml                         |  2 --
 storage/samlidp/config.php            | 25 +++++++++++++
 6 files changed, 129 insertions(+), 12 deletions(-)
 create mode 100644 app/Interfaces/SpsConfigInterface.php
 create mode 100644 app/Traits/Enums/SpsConfigTrait.php
 create mode 100644 storage/samlidp/config.php

diff --git a/.env.example b/.env.example
index 35eb445..0152884 100644
--- a/.env.example
+++ b/.env.example
@@ -47,9 +47,3 @@ LDC_WEB_CIDR_MANUAL_ALLOWED_LIST=
 # GITLAB API
 GITLAB_URL=
 GITLAB_TOKEN=
-
-# SAML IDP
-## URL list separated by comma
-SAML_SP_URL_LIST=""
-## json sp config
-SAML_SP_CONFIG=''
diff --git a/app/Interfaces/SpsConfigInterface.php b/app/Interfaces/SpsConfigInterface.php
new file mode 100644
index 0000000..1e87835
--- /dev/null
+++ b/app/Interfaces/SpsConfigInterface.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Interfaces;
+
+interface SpsConfigInterface
+{
+    /**
+     * URL method
+     *  Website (SP) url ex: https://le-gaulois-pro.s-web.test
+     *
+     * @return string
+     */
+    public function url(): string;
+    /**
+     * acsBase64 method
+     * Return destination url base64 encoded
+     *
+     * @return string
+     */
+    public function acsBase64(): string;
+    /**
+     * destination method
+     * Return acs url concatenated with url
+     *
+     * @return string
+     */
+    public function destination(): string;
+    /**
+     * logout method
+     * Return sls url concatenated with url
+     *
+     * @return string
+     */
+    public function logout(): string;
+    /**
+     * certificate method
+     * Return certificate (.pem) file from kebab case of Enum name
+     *
+     * @return string
+     */
+    public function certificate(): string;
+}
diff --git a/app/Traits/Enums/SpsConfigTrait.php b/app/Traits/Enums/SpsConfigTrait.php
new file mode 100644
index 0000000..1d376cd
--- /dev/null
+++ b/app/Traits/Enums/SpsConfigTrait.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Traits\Enums;
+
+trait SpsConfigTrait
+{
+    /**
+     * acsBase64 method
+     * Return destination url base64 encoded
+     *
+     * @return string
+     */
+    public function acsBase64(): string
+    {
+        return base64_encode($this->destination());
+    }
+    /**
+     * destination method
+     * Return acs url concatenated with url
+     *
+     * @return string
+     */
+    public function destination(): string
+    {
+        return $this->url() . "/saml2/support/acs";
+    }
+    /**
+     * logout method
+     * Return sls url concatenated with url
+     *
+     * @return string
+     */
+    public function logout(): string
+    {
+        return $this->url() . "/saml2/support/sls";
+    }
+    /**
+     * certificate method
+     * Return certificate (.pem) file from kebab case of Enum name
+     *
+     * @return string
+     */
+    public function certificate(): string
+    {
+        return 'file://' . storage_path(
+            sprintf(
+                'samlidp/%s.pem',
+                str()->kebab($this->name)
+            )
+        );
+    }
+}
diff --git a/config/samlidp.php b/config/samlidp.php
index dacd96b..b26958d 100644
--- a/config/samlidp.php
+++ b/config/samlidp.php
@@ -1,8 +1,14 @@
 <?php
 
-$saml_sp_list = explode(",", env('SAML_SP_URL_LIST', []));
-foreach ($saml_sp_list as $sp) {
-    $sp_slo_redirects[$sp] = $sp;
+$config = require_once(storage_path('samlidp/config.php'));
+
+foreach (SpsEnum::cases() as $sp) {
+    $sp_slo_redirects[$sp->url()] = $sp->url();
+    $sp_configs[$sp->acsBase64()] = [
+        'destination' => $sp->destination(),
+        'logout' => $sp->logout(),
+        'certificate' => $sp->certificate()
+    ];
 }
 
 return [
@@ -55,7 +61,7 @@ return [
     // 'encrypt_assertion' => false
     // ].
     // ],.
-    'sp' => json_decode(env('SAML_SP_CONFIG', "{}"), true),
+    'sp' => $sp_configs,
 
     // If you need to redirect after SLO depending on SLO initiator
     // Key is beginning of HTTP_REFERER value from SERVER, value is redirect path.
diff --git a/manifest.yaml b/manifest.yaml
index 0a1b774..e5ce0be 100644
--- a/manifest.yaml
+++ b/manifest.yaml
@@ -25,8 +25,6 @@ data:
   SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}"
   GITLAB_URL: "https://${CI_SERVER_HOST}"
   GITLAB_TOKEN: "${APP_GITLAB_TOKEN}"
-  SAML_SP_URL_LIST: "${APP_SAML_SP_URL_LIST}"
-  SAML_SP_CONFIG: "${APP_SAML_SP_CONFIG}"
 
 ---
 apiVersion: v1
diff --git a/storage/samlidp/config.php b/storage/samlidp/config.php
new file mode 100644
index 0000000..c30ac2d
--- /dev/null
+++ b/storage/samlidp/config.php
@@ -0,0 +1,25 @@
+<?php
+
+use App\Interfaces\SpsConfigInterface;
+use App\Traits\Enums\SpsConfigTrait;
+
+// phpcs:ignore PSR1.Classes.ClassDeclaration.MissingNamespace
+enum SpsEnum implements SpsConfigInterface
+{
+    use SpsConfigTrait;
+
+    case LeGauloisPro;
+
+    /**
+     * URL method
+     * Website url ex: https://le-gaulois-pro.s-web.test
+     *
+     * @return string
+     */
+    public function url(): string
+    {
+        return match ($this) {
+            SpsEnum::LeGauloisPro => 'https://le-gaulois-pro.s-web.test'
+        };
+    }
+}