PlatformAdminRecoveryService
in package
Table of Contents
Constants
- DEFAULT_SESSION_MINUTES : mixed = 15
- RECOVERY_CODE_BYTES : mixed = 9
- RECOVERY_CODE_COUNT : mixed = 10
- SESSION_SELECTOR_BYTES : mixed = 18
- SESSION_VERIFIER_BYTES : mixed = 32
Properties
- $auditService : PlatformAuditService|null
- $connection : Connection
- $secretStore : SecretStoreInterface
- $totpVerifier : PlatformTotpVerifierInterface
Methods
- __construct() : mixed
- Constructor.
- bootstrapFirstAdmin() : PlatformAdminBootstrapResult
- Create the first platform admin and one-time recovery material.
- emergencyLogin() : PlatformEmergencyLoginResult
- Create a one-time session with TOTP plus a valid recovery code.
- resetMfa() : void
- Fail closed until multi-admin TOTP approval is available.
- resetPassword() : SensitiveString
- Generate a replacement platform admin password and store only its hash.
- rotateRecoveryCodes() : array<int, SensitiveString>
- Rotate unused recovery codes after a valid admin TOTP challenge.
- audit() : void
- base32Secret() : string
- Generate a base32 TOTP-compatible secret.
- countPlatformUsers() : int
- Count existing platform users.
- fetchUserByEmail() : array<string, mixed>|null
- findUsableRecoveryCodeId() : string|null
- Find the matching unused recovery code row.
- formatTime() : string
- Format timestamps consistently for the platform database.
- generateRecoveryCodes() : array<int, SensitiveString>
- normalizeEmail() : string
- Normalize and validate an email address.
- now() : string
- Return the current timestamp for persistence.
- randomToken() : string
- Generate a URL-safe random token.
- uuid() : string
- Generate a UUIDv4 without requiring database extensions.
Constants
DEFAULT_SESSION_MINUTES
private
mixed
DEFAULT_SESSION_MINUTES
= 15
RECOVERY_CODE_BYTES
private
mixed
RECOVERY_CODE_BYTES
= 9
RECOVERY_CODE_COUNT
private
mixed
RECOVERY_CODE_COUNT
= 10
SESSION_SELECTOR_BYTES
private
mixed
SESSION_SELECTOR_BYTES
= 18
SESSION_VERIFIER_BYTES
private
mixed
SESSION_VERIFIER_BYTES
= 32
Properties
$auditService read-only
private
PlatformAuditService|null
$auditService
= null
$connection read-only
private
Connection
$connection
$secretStore read-only
private
SecretStoreInterface
$secretStore
$totpVerifier read-only
private
PlatformTotpVerifierInterface
$totpVerifier
= new UnavailablePlatformTotpVerifier()
Methods
__construct()
Constructor.
public
__construct(Connection $connection, SecretStoreInterface $secretStore[, PlatformTotpVerifierInterface $totpVerifier = new UnavailablePlatformTotpVerifier() ][, PlatformAuditService|null $auditService = null ]) : mixed
Parameters
- $connection : Connection
- $secretStore : SecretStoreInterface
- $totpVerifier : PlatformTotpVerifierInterface = new UnavailablePlatformTotpVerifier()
- $auditService : PlatformAuditService|null = null
bootstrapFirstAdmin()
Create the first platform admin and one-time recovery material.
public
bootstrapFirstAdmin(string $email) : PlatformAdminBootstrapResult
Parameters
- $email : string
Return values
PlatformAdminBootstrapResultemergencyLogin()
Create a one-time session with TOTP plus a valid recovery code.
public
emergencyLogin(string $email, string $totpCode, string $recoveryCode[, int $sessionMinutes = self::DEFAULT_SESSION_MINUTES ]) : PlatformEmergencyLoginResult
Parameters
- $email : string
- $totpCode : string
- $recoveryCode : string
- $sessionMinutes : int = self::DEFAULT_SESSION_MINUTES
Return values
PlatformEmergencyLoginResultresetMfa()
Fail closed until multi-admin TOTP approval is available.
public
resetMfa(string $email, string $reason) : void
Parameters
- $email : string
- $reason : string
resetPassword()
Generate a replacement platform admin password and store only its hash.
public
resetPassword(string $email, string $reason) : SensitiveString
Parameters
- $email : string
- $reason : string
Return values
SensitiveStringrotateRecoveryCodes()
Rotate unused recovery codes after a valid admin TOTP challenge.
public
rotateRecoveryCodes(string $email, string $totpCode, string $reason) : array<int, SensitiveString>
Parameters
- $email : string
- $totpCode : string
- $reason : string
Return values
array<int, SensitiveString>audit()
private
audit(string $action, string|null $platformUserId, string|null $subjectType, string|null $subjectId, string|null $reason, array<string, mixed> $metadata[, bool $withTransaction = true ]) : void
Parameters
- $action : string
- $platformUserId : string|null
- $subjectType : string|null
- $subjectId : string|null
- $reason : string|null
- $metadata : array<string, mixed>
- $withTransaction : bool = true
base32Secret()
Generate a base32 TOTP-compatible secret.
private
base32Secret(int $bytes) : string
Parameters
- $bytes : int
Return values
stringcountPlatformUsers()
Count existing platform users.
private
countPlatformUsers() : int
Return values
intfetchUserByEmail()
private
fetchUserByEmail(string $email) : array<string, mixed>|null
Parameters
- $email : string
Return values
array<string, mixed>|nullfindUsableRecoveryCodeId()
Find the matching unused recovery code row.
private
findUsableRecoveryCodeId(string $userId, string $recoveryCode) : string|null
Parameters
- $userId : string
- $recoveryCode : string
Return values
string|nullformatTime()
Format timestamps consistently for the platform database.
private
formatTime(DateTimeImmutable $time) : string
Parameters
- $time : DateTimeImmutable
Return values
stringgenerateRecoveryCodes()
private
generateRecoveryCodes() : array<int, SensitiveString>
Return values
array<int, SensitiveString>normalizeEmail()
Normalize and validate an email address.
private
normalizeEmail(string $email) : string
Parameters
- $email : string
Return values
stringnow()
Return the current timestamp for persistence.
private
now() : string
Return values
stringrandomToken()
Generate a URL-safe random token.
private
randomToken(int $bytes) : string
Parameters
- $bytes : int
Return values
stringuuid()
Generate a UUIDv4 without requiring database extensions.
private
uuid() : string