Add a mechanism to remind users to rotate personal auth tokens

config/global.ini.php

@@ -561,6 +561,11 @@
 ; Recommended for best security.
 only_allow_secure_auth_tokens = 0
 
+; Number of days after which a personal auth token is recommended to be rotated and an email notification will be sent to the user.
+; If set to 0 days, notifications won't be sent.
+; Recommended to keep enabled for best security.
+auth_token_rotation_notification_days = 180
+
 ; language cookie name for session
 language_cookie_name = matomo_lang
 

core/Db/Schema/Mysql.php

@@ -74,6 +74,7 @@ public function getTablesCreateSql()
                           date_created DATETIME NOT NULL,
                           date_expired DATETIME NULL,
                           secure_only TINYINT(2) unsigned NOT NULL DEFAULT '0',
+                          ts_rotation_notified DATETIME NULL,
                             PRIMARY KEY(idusertokenauth),
                             UNIQUE KEY uniq_password(password)
                           ) $tableOptions

core/Plugin/Tasks.php

@@ -103,7 +103,7 @@ protected function monthly($methodName, $methodParameter = null, $priority = sel
     }
 
     /**
-     * Schedules the given tasks/method to run depending at the given scheduled time. Unlike the convenient methods
+     * Schedules the given tasks/method to run depending on the given scheduled time. Unlike the convenient methods
      * such as {@link hourly()} you need to specify the object on which the given method should be called. This can be
      * either an instance of a class or a class name. For more information about these parameters see {@link hourly()}
      *

core/Updates/5.4.0-b1.php

@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * Matomo - free/libre analytics platform
+ *
+ * @link    https://matomo.org
+ * @license https://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
+ */
+
+namespace Piwik\Updates;
+
+use Piwik\Updater;
+use Piwik\Updater\Migration\Factory as MigrationFactory;
+use Piwik\Updates;
+
+class Updates_5_4_0_b1 extends Updates
+{
+    /**
+     * @var MigrationFactory
+     */
+    private $migration;
+
+    public function __construct(MigrationFactory $factory)
+    {
+        $this->migration = $factory;
+    }
+
+    public function getMigrations(Updater $updater)
+    {
+        return [
+            $this->migration->db->addColumn('user_token_auth', 'ts_rotation_notified', 'DATETIME NULL'),
+        ];
+    }
+
+    public function doUpdate(Updater $updater)
+    {
+        $updater->executeMigrations(__FILE__, $this->getMigrations($updater));
+    }
+}

core/Version.php

@@ -22,7 +22,7 @@ final class Version
      * The current Matomo version.
      * @var string
      */
-    public const VERSION = '5.4.0-alpha';
+    public const VERSION = '5.4.0-b1';
 
     public const MAJOR_VERSION = 5;
 

plugins/UsersManager/AuthTokenEmailNotification.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Matomo - free/libre analytics platform
+ *
+ * @link https://matomo.org
+ * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
+ */
+
+namespace Piwik\Plugins\UsersManager;
+
+use Piwik\Plugins\UsersManager\Emails\AuthTokenNotificationEmail;
+use Piwik\Plugins\UsersManager\TokenNotifications\TokenEmailNotification;
+
+final class AuthTokenEmailNotification extends TokenEmailNotification
+{
+    public function getEmailClass(): string
+    {
+        return AuthTokenNotificationEmail::class;
+    }
+}

plugins/UsersManager/Emails/AuthTokenNotificationEmail.php

@@ -0,0 +1,104 @@
+<?php
+
+/**
+ * Matomo - free/libre analytics platform
+ *
+ * @link    https://matomo.org
+ * @license https://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
+ */
+
+namespace Piwik\Plugins\UsersManager\Emails;
+
+use Piwik\Config;
+use Piwik\Mail;
+use Piwik\Piwik;
+use Piwik\Plugins\UsersManager\TokenNotifications\TokenNotification;
+use Piwik\SettingsPiwik;
+use Piwik\Url;
+use Piwik\View;
+
+class AuthTokenNotificationEmail extends Mail
+{
+    /**
+     * @var TokenNotification
+     */
+    private $notification;
+
+    /** @var string */
+    private $recipient;
+
+    /** @var array */
+    private $emailData;
+
+    public function __construct(TokenNotification $notification, string $recipient, array $emailData)
+    {
+        parent::__construct();
+
+        $this->notification = $notification;
+        $this->recipient = $recipient;
+        $this->emailData = $emailData;
+
+        $this->setUpEmail();
+    }
+
+    private function setUpEmail(): void
+    {
+        $this->setDefaultFromPiwik();
+        $this->addTo($this->recipient);
+        $this->setSubject($this->getDefaultSubject());
+        $this->addReplyTo($this->getFrom(), $this->getFromName());
+        $this->setBodyText($this->getDefaultBodyText());
+        $this->setWrappedHtmlBody($this->getDefaultBodyView());
+    }
+
+    private function getRotationPeriodPretty(): string
+    {
+        $rotationPeriodDays = Config::getInstance()->General['auth_token_rotation_notification_days'];
+
+        return Piwik::translate('Intl_PeriodDay' . ($rotationPeriodDays === 1 ? '' : 's'));
+    }
+
+    protected function getManageAuthTokensLink(): string
+    {
+        return SettingsPiwik::getPiwikUrl()
+            . 'index.php?'
+            . Url::getQueryStringFromParameters(['module' => 'UsersManager', 'action' => 'userSecurity'])
+            . '#authtokens';
+    }
+    protected function getDefaultSubject(): string
+    {
+        return Piwik::translate('UsersManager_AuthTokenNotificationEmailSubject');
+    }
+
+    protected function getDefaultBodyText(): string
+    {
+        $view = new View('@UsersManager/_authTokenNotificationTextEmail.twig');
+        $view->setContentType('text/plain');
+
+        $this->assignCommonParameters($view);
+
+        return $view->render();
+    }
+
+    protected function getDefaultBodyView(): View
+    {
+        $view = new View('@UsersManager/_authTokenNotificationHtmlEmail.twig');
+
+        $this->assignCommonParameters($view);
+
+        return $view;
+    }
+
+    protected function assignCommonParameters(View $view): void
+    {
+        $view->tokenName = $this->notification->getTokenName();
+        $view->tokenCreationDate = $this->notification->getTokenCreationDate();
+
+        $view->rotationPeriod = $this->getRotationPeriodPretty();
+        $view->manageAuthTokensLink = $this->getManageAuthTokensLink();
+
+        foreach ($this->emailData as $item => $value) {
+            $view->assign($item, $value);
+        }
+    }
+}

plugins/UsersManager/Model.php

@@ -536,6 +536,11 @@ public function setTokenAuthWasUsed($tokenAuth, $dateLastUsed)
         }
     }
 
+    public function setRotationNotificationWasSentForToken(string $tokenId, string $tsRotation)
+    {
+        $this->updateTokenAuthTable($tokenId, ['ts_rotation_notified' => $tsRotation]);
+    }
+
     private function updateTokenAuthTable($idTokenAuth, $fields)
     {
         $set = array();

plugins/UsersManager/Tasks.php

@@ -11,6 +11,7 @@
 
 use Piwik\Access;
 use Piwik\Date;
+use Piwik\Plugins\UsersManager\TokenNotifications\TokenNotifierTask;
 
 class Tasks extends \Piwik\Plugin\Tasks
 {
@@ -35,6 +36,8 @@ public function schedule()
         $this->daily("cleanupExpiredTokens");
         $this->daily("setUserDefaultReportPreference");
         $this->daily("cleanUpExpiredInvites");
+
+        $this->scheduleTask(new TokenNotifierTask());
     }
 
     public function cleanupExpiredTokens()

plugins/UsersManager/TokenNotificationProvider.php

@@ -0,0 +1,82 @@
+<?php
+
+/**
+ * Matomo - free/libre analytics platform
+ *
+ * @link https://matomo.org
+ * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
+ */
+
+namespace Piwik\Plugins\UsersManager;
+
+use Piwik\Common;
+use Piwik\Config;
+use Piwik\Date;
+use Piwik\Db;
+use Piwik\Plugins\UsersManager\TokenNotifications\TokenNotificationProviderInterface;
+use Piwik\Plugins\UsersManager\Model as UserModel;
+
+class TokenNotificationProvider implements TokenNotificationProviderInterface
+{
+    /** @var Model */
+    private $userModel;
+
+    /** @var string */
+    private $today;
+
+    public function __construct()
+    {
+        $this->userModel = new UserModel();
+        $this->today = Date::factory('today')->getDatetime();
+    }
+
+    private function getRotationPeriodThreshold(): ?string
+    {
+        $periodDays = (int) Config::getInstance()->General['auth_token_rotation_notification_days'];
+        return $periodDays ? Date::factory('today')->subDay($periodDays)->getDateTime() : null;
+    }
+
+    public function getTokenNotificationsForDispatch(): array
+    {
+        $rotationThreshold = $this->getRotationPeriodThreshold();
+        if (null === $rotationThreshold) {
+            return [];
+        }
+
+        $db = Db::get();
+        $sql = "SELECT * FROM " . Common::prefixTable('user_token_auth')
+            . " WHERE (date_expired is null or date_expired > ?)"
+            . " AND (date_created <= ?)"
+            . " AND ts_rotation_notified is null"
+            . " AND system_token = 0"
+            . " AND login != ?";
+
+        $tokensToNotify = $db->fetchAll($sql, [
+            $this->today,
+            $rotationThreshold,
+            'anonymous'
+        ]);
+
+        $notifications = [];
+
+        foreach ($tokensToNotify as $t) {
+            $user = $this->userModel->getUser($t['login']);
+            $email = $user['email'];
+
+            $notifications[] = new AuthTokenEmailNotification(
+                $t['idusertokenauth'],
+                $t['description'],
+                $t['date_created'],
+                [$email],
+                [$email => ['login' => $t['login']]]
+            );
+        }
+
+        return $notifications;
+    }
+
+    public function setTokenNotificationDispatched(string $tokenId): void
+    {
+        $this->userModel->setRotationNotificationWasSentForToken($tokenId, Date::factory('now')->getDatetime());
+    }
+}

plugins/UsersManager/TokenNotifications/TokenEmailNotification.php

@@ -0,0 +1,61 @@
+<?php
+
+/**
+ * Matomo - free/libre analytics platform
+ *
+ * @link https://matomo.org
+ * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
+ */
+
+namespace Piwik\Plugins\UsersManager\TokenNotifications;
+
+use Piwik\Container\StaticContainer;
+
+abstract class TokenEmailNotification extends TokenNotification
+{
+    /**
+     * A list of recipient emails
+     *
+     * @var array
+     */
+    private $recipients;
+
+    /**
+     * Data in the format of ['[email protected]' => ['item1' => 'value1'], ...] that will be passed to the email class
+     *
+     * @var array
+     */
+    private $emailData;
+
+    public function __construct(
+        string $tokenId,
+        string $tokenName,
+        string $tokenCreationDate,
+        array $recipients,
+        array $emailData
+    ) {
+        parent::__construct($tokenId, $tokenName, $tokenCreationDate);
+
+        $this->recipients = $recipients;
+        $this->emailData = $emailData;
+    }
+
+    abstract public function getEmailClass(): string;
+
+    public function dispatch(): bool
+    {
+        foreach ($this->recipients as $recipient) {
+            $email = StaticContainer::getContainer()->make(
+                $this->getEmailClass(),
+                [
+                    'notification' => $this,
+                    'recipient' => $recipient,
+                    'emailData' => $this->emailData[$recipient] ?? [],
+                ]
+            );
+            $email->safeSend();
+        }
+
+        return true;
+    }
+}