Merge pull request #64 from tito10047/altcha-lib-20

Altcha lib 20

Author: tito10047

.gitignore

@@ -7,5 +7,11 @@ tools/
 /tests/App/Webpack/node_modules/
 /tests/App/Webpack/public/build
 /tests/App/Webpack/yarn.lock
+/tests/App/AssetMapper/config/reference.php
+/tests/App/Floating/config/reference.php
+/tests/App/LiveComponent/config/reference.php
+/tests/App/Overlay/config/reference.php
+/tests/App/Twig/config/reference.php
+/tests/App/Webpack/config/reference.php
 var/cache
-/drivers
+/driver

MIGRATE.md

@@ -0,0 +1,57 @@
+# Migration Guide: 1.0 to 2.0
+
+This guide outlines the changes required to migrate from version 1.0 to 2.0 of the `altcha-bundle`.
+
+## JavaScript Changes
+
+The main JavaScript i18n file has been moved and updated.
+
+- **Old path:** `"altcha/dist/altcha.i18n.js": "^2.0.0"`
+- **New path:** `"altcha/dist/main/altcha.i18n.js": "^3.0.2"`
+
+### Webpack Encore Update
+If you are using a custom alias in `webpack.config.js`, update it as follows:
+
+```js
+// Before
+module.exports.resolve.alias["altcha/dist/altcha.i18n.js"] = 'altcha/i18n';
+
+// After
+module.exports.resolve.alias["altcha/dist/i18n/all.js"] = 'altcha/i18n';
+```
+
+## Configuration
+
+The configuration remains mostly backward compatible, but it is recommended to update to the new keys.
+
+| Old Key | New Key | Status |
+|---------|---------|--------|
+| `hmacKey` | `hmacSignature` | Deprecated (fallback exists) |
+| `max_number` | - | Deprecated (replaced by `cost` and `counter_max`) |
+
+### New Configuration Options
+- `hmacAlgorithm`: Specify the HMAC algorithm (default: `SHA-256`).
+- `hmacKeySignature`: Optional signature key.
+- `cost`: Challenge difficulty cost (default: `5000`).
+- `counter_min`: Minimum counter value (default: `5000`).
+- `counter_max`: Maximum counter value (default: `10000`).
+- `timeout`: Challenge timeout in seconds (default: `30.0`).
+
+## Code Structure Changes
+
+The internal architecture has been refactored to support version 2.0 of the `altcha-org/altcha` PHP library.
+
+### Core Changes in `src/`
+- **Dependency Injection:**
+    - `AltchaExtension` now handles `hmacSignature` instead of `hmacKey`.
+- **Services:**
+    - `ChallengeResolver`: Now requires `DriverKeyProviderInterface` and handles new configuration parameters (cost, counter, timeout).
+    - `AltchaValidator` and `AltchaSentinelValidator`: Refactored to use the new verification logic based on `Payload` and `VerifySolutionOptions`.
+- **New Services & Interfaces:**
+    - `DriverKeyProviderInterface` / `DriverKeyProvider`: Centralizes algorithm selection.
+    - `SolveChallengeResolverInterface` / `SolveChallengeResolver`: New service for verifying challenges.
+- **Form Type:**
+    - `AltchaType`: Added options for `cost`, `counter_min`, `counter_max`, and `timeout`. `max_number` is now deprecated.
+
+### Library Update
+The bundle now uses `altcha-org/altcha` v2. Key classes like `ChallengeOptions` have been replaced by `CreateChallengeOptions` or `VerifySolutionOptions`.

README.md

@@ -44,7 +44,12 @@ Add a config file:
 ```yml
 altcha:
     enable: true
-    hmacKey: '%env(APP_SECRET)%'
+    hmacSignature: '%env(APP_SECRET)%'
+    hmacAlgorithm: 'SHA-256'
+    cost: 5000
+    counter_min: 5000
+    counter_max: 10000
+    timeout: 30.0
     floating: true
     overlay: false
     use_stimulus: false
@@ -57,34 +62,6 @@ when@test:
         enable: false
 ```
 
-### PHP
-
-`config/packages/altcha.php`: 
-
-```php
-use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
-
-return static function (ContainerConfigurator $containerConfigurator): void {
-    $containerConfigurator->extension('altcha', [
-        'enable' => true,
-        'hmacKey' => 'RANDOM_SECRET_KEY',
-        'floating' => true,
-        'overlay' => true,
-        'use_stimulus' => false,
-        'include_script' => true,
-        'hide_logo' => false,
-        'hide_footer' => false
-    ]);
-
-    if ('test' === $containerConfigurator->env()) {
-        // Disable captcha in test environment
-        $containerConfigurator->extension('altcha', [
-            'enable' => false,
-        ]);
-    }
-};
-```
-
 Import bundle routes:
 
 ### YML
@@ -95,12 +72,6 @@ altcha:
     type: yaml
 ```
 
-### PHP
-
-```php
-$routingConfigurator->import('@AltchaBundle/config/routes.yml');
-```
-
 ⚠️ **Important – Security Configuration**
 
 If your application restricts access globally using a rule like:
@@ -171,7 +142,7 @@ class ContactType extends AbstractType
 ```js
 //webpack.config.js
 module.exports = Encore.getWebpackConfig();
-module.exports.resolve.alias["altcha/dist/altcha.i18n.js"]='altcha/i18n';
+module.exports.resolve.alias["altcha/dist/i18n/all.js"]='altcha/i18n';
 ```
 ```yaml
 #config/packages/altcha.yaml

assets/controllers/altcha_controller.js

@@ -1,16 +1,48 @@
 import {Controller} from '@hotwired/stimulus';
-import 'altcha/dist/altcha.i18n.js';
+import 'altcha/dist/main/altcha.i18n.js';
 
 export default class extends Controller {
 
-	static targets = ["input","altcha"]
+	static targets = ["input", "altcha"];
+	static values = {
+		hideLogo:       Boolean,
+		hideFooter:     Boolean,
+		useSentinel:    Boolean,
+		overlayContent: String,
+		challengeUrl:   String,
+	}
 
 	connect() {
 		this.altchaTarget.addEventListener('statechange', (ev) => {
 			if (ev.detail.state === 'verified') {
 				this.inputTarget.value = ev.detail.payload;
-				this.inputTarget.dispatchEvent(new Event('change', { bubbles: true }));
+				this.inputTarget.dispatchEvent(new Event('change', {bubbles: true}));
 			}
 		});
+
+		const config = {};
+
+		if (this.hasHideLogoValue) {
+			config.hideLogo = this.hideLogoValue;
+		}
+		if (this.hasHideFooterValue) {
+			config.hideFooter = this.hideFooterValue;
+		}
+		if (this.hasUseSentinelValue) {
+			config.useSentinel = this.useSentinelValue;
+			config.fetch = this.altchaChallengeFetchWithFallback.bind(this);
+		}
+		if (this.hasOverlayContentValue) {
+			config.overlayContent = this.overlayContentValue;
+		}
+		this.altchaTarget.configure(config);
+	}
+
+	async altchaChallengeFetchWithFallback(url, init) {
+		try {
+			return await fetch(url, init);
+		} catch (e) {
+			return await fetch(this.challengeUrlValue, init);
+		}
 	}
 }

assets/package.json

@@ -14,7 +14,7 @@
     },
     "importmap": {
       "@hotwired/stimulus": "^3.0.0",
-      "altcha/dist/altcha.i18n.js": "^2.0.0"
+      "altcha/dist/main/altcha.i18n.js": "^3.0.2"
     }
   },
   "peerDependencies": {

composer.json

@@ -28,15 +28,15 @@
   ],
   "require": {
     "php": ">=8.2",
-    "altcha-org/altcha": "^v1.3.1",
-    "symfony/console": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/form": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/framework-bundle": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/http-client": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/translation": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/twig-bundle": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/validator": "^6.4|^7.3|^7.4|^8.0",
-    "symfony/yaml": "^6.4|^7.3|^7.4|^8.0"
+    "altcha-org/altcha": "^v2.0",
+    "symfony/console": "^6.4|^7.4|^8.0",
+    "symfony/form": "^6.4|^7.4|^8.0",
+    "symfony/framework-bundle": "^6.4|^7.4|^8.0",
+    "symfony/http-client": "^6.4|^7.4|^8.0",
+    "symfony/translation": "^6.4|^7.4|^8.0",
+    "symfony/twig-bundle": "^6.4|^7.4|^8.0",
+    "symfony/validator": "^6.4|^7.4|^8.0",
+    "symfony/yaml": "^6.4|^7.4|^8.0"
   },
   "autoload": {
     "psr-4": {
@@ -65,7 +65,7 @@
     "twig/twig": "^2.12|^3.21.1",
     "symfony/panther": "^v2.4.0",
     "dbrekelmans/bdi": "^1.4",
-    "symfony/asset-mapper": "^6.4|^7.3|^7.4|^8.0"
+    "symfony/asset-mapper": "^6.4|^7.4|^8.0"
   },
   "scripts" : {
     "test": [

config/services.yml

@@ -15,14 +15,22 @@ services:
       $useSentinel: '%altcha.use_sentinel%'
       $challengeUrl: '%altcha.sentinel.challenge_url%'
       $includeScript: '%altcha.include_script%'
+      $cost: '%altcha.cost%'
+      $counterMin: '%altcha.counter_min%'
+      $counterMax: '%altcha.counter_max%'
+      $timeout: '%altcha.timeout%'
       $router: '@router'
   altcha.validator:
     class: Tito10047\AltchaBundle\Validator\AltchaValidator
     tags: ['validator.constraint_validator']
     arguments:
       $enable: '%altcha.enable%'
-      $hmacKey: '%altcha.hmacKey%'
+      $hmacSignature: '%altcha.hmacSignature%'
+      $hmacKeySignature: '%altcha.hmacKeySignature%'
       $requestStack: '@request_stack'
+      $driverKeyProvider: '@Tito10047\AltchaBundle\Service\DriverKeyProviderInterface'
+      $solveChallengeResolver: '@Tito10047\AltchaBundle\Service\SolveChallengeResolverInterface'
+      $challengeOptionResolver: '@Tito10047\AltchaBundle\Service\ChallengeResolverInterface'
   Tito10047\AltchaBundle\Controller\AltchaChallengeController:
     public: true
     autowire: true
@@ -32,6 +40,22 @@ services:
   Tito10047\AltchaBundle\Service\ChallengeResolverInterface:
     class: Tito10047\AltchaBundle\Service\ChallengeResolver
     arguments:
-      $hmacKey: '%altcha.hmacKey%'
-      $expires: '%altcha.expires%'
-      $maxNumber: '%altcha.max_number%'
+      $driverKeyProvider: '@Tito10047\AltchaBundle\Service\DriverKeyProviderInterface'
+      $hmacSignature: '%altcha.hmacSignature%'
+      $hmacKeySignature: '%altcha.hmacKeySignature%'
+      $cost: '%altcha.cost%'
+      $counterMin: '%altcha.counter_min%'
+      $counterMax: '%altcha.counter_max%'
+      $expiresAt: '%altcha.expires%'
+  Tito10047\AltchaBundle\Service\SolveChallengeResolverInterface:
+    class: Tito10047\AltchaBundle\Service\SolveChallengeResolver
+    arguments:
+      $challengeResolver: '@Tito10047\AltchaBundle\Service\ChallengeResolverInterface'
+      $hmacSignature: '%altcha.hmacSignature%'
+      $hmacKeySignature: '%altcha.hmacKeySignature%'
+      $timeout: '%altcha.timeout%'
+
+  Tito10047\AltchaBundle\Service\DriverKeyProviderInterface:
+    class: Tito10047\AltchaBundle\Service\DriverKeyProvider
+    arguments:
+      $hmacAlgorithm: '%altcha.hmacAlgorithm%'

src/DependencyInjection/AltchaExtension.php

@@ -45,7 +45,13 @@ private function registerAceEditorParameters(array $config, ContainerBuilder $co
         $container->setParameter('altcha.floating', $config['floating']);
         $container->setParameter('altcha.overlay', $config['overlay']['enabled']);
         $container->setParameter('altcha.overlay_content', $config['overlay']['content']);
-        $container->setParameter('altcha.hmacKey', $config['hmacKey']);
+        $container->setParameter('altcha.hmacSignature', $config['hmacSignature']);
+        $container->setParameter('altcha.hmacAlgorithm', $config['hmacAlgorithm']);
+        $container->setParameter('altcha.hmacKeySignature', $config['hmacKeySignature']);
+        $container->setParameter('altcha.cost', $config['cost']);
+        $container->setParameter('altcha.counter_min', $config['counter_min']);
+        $container->setParameter('altcha.counter_max', $config['counter_max']);
+        $container->setParameter('altcha.timeout', $config['timeout']);
         $container->setParameter('altcha.hide_logo', $config['hide_logo']);
         $container->setParameter('altcha.hide_footer', $config['hide_footer']);
         $container->setParameter('altcha.js_path', $config['altcha_js_path']);

src/DependencyInjection/Configuration.php

@@ -21,6 +21,13 @@ public function getConfigTreeBuilder(): TreeBuilder
 
 		// @phpstan-ignore-next-line
         $rootNode
+            ->beforeNormalization()
+                ->ifTrue(static fn($v): bool => \is_array($v) && isset($v['hmacKey']) && !isset($v['hmacSignature']))
+                ->then(static function ($v): array {
+                    $v['hmacSignature'] = $v['hmacKey'];
+                    return $v;
+                })
+            ->end()
             ->children()
             ->booleanNode('enable')->defaultTrue()->end()
             ->booleanNode('floating')->defaultFalse()->end()
@@ -41,7 +48,14 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->end()
                 ->end() // end arrayNode('overlay')
             ->booleanNode('use_stimulus')->defaultNull()->end()
-			->integerNode('max_number')->defaultValue(100000)->end()
+            ->integerNode('cost')->defaultValue(5000)->end()
+            ->integerNode('counter_min')->defaultValue(5000)->end()
+            ->integerNode('counter_max')->defaultValue(10000)->end()
+            ->floatNode('timeout')->defaultValue(30.0)->end()
+            ->integerNode('max_number')
+                ->setDeprecated('tito10047/altcha-bundle', '1.1', 'The "%node%" option is deprecated and will be removed.')
+                ->defaultValue(100000)
+            ->end()
 			->scalarNode('expires')
 				->defaultValue('+15 minute')
                 ->cannotBeEmpty()
@@ -53,9 +67,21 @@ public function getConfigTreeBuilder(): TreeBuilder
             ->booleanNode('include_script')->defaultNull()->end()
             ->booleanNode('hide_logo')->defaultFalse()->end()
             ->booleanNode('hide_footer')->defaultFalse()->end()
-            ->scalarNode('altcha_js_path')->defaultValue('https://eu.altcha.org/js/latest/altcha.min.js')->end()
-            ->scalarNode('altcha_js_i18n_path')->defaultValue('https://cdn.jsdelivr.net/gh/altcha-org/altcha/dist_i18n/all.min.js')->end()
-            ->scalarNode('hmacKey')->isRequired()->cannotBeEmpty()->end()
+            ->scalarNode('altcha_js_path')->defaultValue('https://cdn.jsdelivr.net/npm/altcha/dist/main/altcha.min.js')->end()
+            ->scalarNode('altcha_js_i18n_path')->defaultValue('https://cdn.jsdelivr.net/npm/altcha/dist/i18n/all.min.js')->end()
+            ->scalarNode('hmacKey')
+                ->setDeprecated('tito10047/altcha-bundle', '1.1', 'The "%node%" option is deprecated, use "hmacSignature" instead.')
+                ->defaultValue(null)
+            ->end()
+            ->scalarNode('hmacAlgorithm')
+                ->defaultValue('SHA-256')
+                ->validate()
+                    ->ifNotInArray(['SHA-256', 'SHA-384', 'SHA-512'])
+                    ->thenInvalid('Invalid HMAC algorithm "%s". Permitted values are SHA-256, SHA-384, SHA-512.')
+                ->end()
+            ->end()
+            ->scalarNode('hmacSignature')->isRequired()->cannotBeEmpty()->end()
+            ->scalarNode('hmacKeySignature')->defaultNull()->end()
             ->arrayNode('sentinel')->info(<<<TXT
                Enable usage of sentinel, if enabled:
                    - the widget will use the /v1/challenge endpoint to retrieve a new challenge instead of your app;