29 lines
1.3 KiB
PHP
29 lines
1.3 KiB
PHP
<?php
|
|
namespace App\Services\Licensing;
|
|
|
|
use RuntimeException;
|
|
|
|
final class LicenseTokenVerifier
|
|
{
|
|
public function verify(string $token): array
|
|
{
|
|
$parts = explode('.', trim($token));
|
|
if (count($parts) !== 3 || $parts[0] !== 'RS3') throw new RuntimeException('Invalid licence token.');
|
|
$payload = $this->decode($parts[1]);
|
|
$signature = $this->decode($parts[2]);
|
|
$public = base64_decode((string) config('rsync-studio.public_key'), true);
|
|
if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) throw new RuntimeException('Server licence public key is invalid.');
|
|
if (!sodium_crypto_sign_verify_detached($signature, $payload, $public)) throw new RuntimeException('Licence token signature is invalid.');
|
|
$decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);
|
|
return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
|
|
}
|
|
private function decode(string $value): string
|
|
{
|
|
$value = strtr($value, '-_', '+/');
|
|
$value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
|
|
$out = base64_decode($value, true);
|
|
if ($out === false) throw new RuntimeException('Invalid Base64URL value.');
|
|
return $out;
|
|
}
|
|
}
|