v1.0.0
This commit is contained in:
parent
3291a5f7d2
commit
212d64abfa
27 changed files with 8654 additions and 2 deletions
314
includes/class-compliance-report.php
Normal file
314
includes/class-compliance-report.php
Normal file
|
|
@ -0,0 +1,314 @@
|
|||
<?php
|
||||
/**
|
||||
* Compliance report class
|
||||
*
|
||||
* @package TwoFactorExtended
|
||||
* @since 0.1.0
|
||||
*/
|
||||
|
||||
// Prevent direct access.
|
||||
if ( ! defined( 'ABSPATH' ) ) {
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Class Two_Factor_Extended_Compliance_Report
|
||||
*
|
||||
* Generates compliance reports for 2FA usage.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*/
|
||||
class Two_Factor_Extended_Compliance_Report {
|
||||
|
||||
/**
|
||||
* Get compliance statistics.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param array $args Optional arguments (role, blog_id).
|
||||
*
|
||||
* @return array Compliance statistics.
|
||||
*/
|
||||
public function get_compliance_stats( array $args = array() ): array {
|
||||
$defaults = array(
|
||||
'role' => '',
|
||||
'blog_id' => get_current_blog_id(),
|
||||
);
|
||||
|
||||
$args = wp_parse_args( $args, $defaults );
|
||||
|
||||
// Get users.
|
||||
$user_args = array(
|
||||
'fields' => 'all',
|
||||
);
|
||||
|
||||
if ( ! empty( $args['role'] ) ) {
|
||||
$user_args['role'] = $args['role'];
|
||||
}
|
||||
|
||||
if ( is_multisite() && ! empty( $args['blog_id'] ) ) {
|
||||
$user_args['blog_id'] = $args['blog_id'];
|
||||
}
|
||||
|
||||
$users = get_users( $user_args );
|
||||
|
||||
$stats = array(
|
||||
'total_users' => count( $users ),
|
||||
'compliant_users' => 0,
|
||||
'non_compliant' => 0,
|
||||
'grace_period' => 0,
|
||||
'no_requirements' => 0,
|
||||
'by_role' => array(),
|
||||
);
|
||||
|
||||
$enforcement = two_factor_extended()->get_enforcement();
|
||||
|
||||
foreach ( $users as $user ) {
|
||||
$required = $enforcement->get_required_providers_for_user( $user->ID );
|
||||
|
||||
if ( empty( $required ) ) {
|
||||
$stats['no_requirements']++;
|
||||
continue;
|
||||
}
|
||||
|
||||
$compliant = $enforcement->user_meets_requirements( $user->ID, $required );
|
||||
$in_grace = $enforcement->is_in_grace_period( $user->ID );
|
||||
|
||||
if ( $compliant ) {
|
||||
$stats['compliant_users']++;
|
||||
} elseif ( $in_grace ) {
|
||||
$stats['grace_period']++;
|
||||
} else {
|
||||
$stats['non_compliant']++;
|
||||
}
|
||||
|
||||
// Count by role.
|
||||
$roles = Two_Factor_Extended_Role_Manager::get_user_roles( $user->ID );
|
||||
|
||||
foreach ( $roles as $role ) {
|
||||
if ( ! isset( $stats['by_role'][ $role ] ) ) {
|
||||
$stats['by_role'][ $role ] = array(
|
||||
'total' => 0,
|
||||
'compliant' => 0,
|
||||
'non_compliant' => 0,
|
||||
);
|
||||
}
|
||||
|
||||
$stats['by_role'][ $role ]['total']++;
|
||||
|
||||
if ( $compliant ) {
|
||||
$stats['by_role'][ $role ]['compliant']++;
|
||||
} else {
|
||||
$stats['by_role'][ $role ]['non_compliant']++;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return $stats;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get non-compliant users.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param array $args Optional arguments.
|
||||
*
|
||||
* @return array Array of non-compliant user data.
|
||||
*/
|
||||
public function get_non_compliant_users( array $args = array() ): array {
|
||||
$defaults = array(
|
||||
'role' => '',
|
||||
'blog_id' => get_current_blog_id(),
|
||||
);
|
||||
|
||||
$args = wp_parse_args( $args, $defaults );
|
||||
|
||||
$user_args = array(
|
||||
'fields' => 'all',
|
||||
);
|
||||
|
||||
if ( ! empty( $args['role'] ) ) {
|
||||
$user_args['role'] = $args['role'];
|
||||
}
|
||||
|
||||
if ( is_multisite() && ! empty( $args['blog_id'] ) ) {
|
||||
$user_args['blog_id'] = $args['blog_id'];
|
||||
}
|
||||
|
||||
$users = get_users( $user_args );
|
||||
$non_compliant = array();
|
||||
$enforcement = two_factor_extended()->get_enforcement();
|
||||
|
||||
foreach ( $users as $user ) {
|
||||
$required = $enforcement->get_required_providers_for_user( $user->ID );
|
||||
|
||||
if ( empty( $required ) ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$compliant = $enforcement->user_meets_requirements( $user->ID, $required );
|
||||
|
||||
if ( ! $compliant ) {
|
||||
$enabled = Two_Factor_Extended_Provider_Detector::get_user_enabled_providers( $user->ID );
|
||||
$missing = array_diff( $required, array_keys( $enabled ) );
|
||||
|
||||
$provider_names = Two_Factor_Extended_Provider_Detector::get_provider_names();
|
||||
$missing_names = array();
|
||||
|
||||
foreach ( $missing as $class ) {
|
||||
$missing_names[] = $provider_names[ $class ] ?? $class;
|
||||
}
|
||||
|
||||
$non_compliant[] = array(
|
||||
'user_id' => $user->ID,
|
||||
'user_login' => $user->user_login,
|
||||
'user_email' => $user->user_email,
|
||||
'roles' => Two_Factor_Extended_Role_Manager::get_user_roles( $user->ID ),
|
||||
'missing_providers' => $missing_names,
|
||||
'in_grace_period' => $enforcement->is_in_grace_period( $user->ID ),
|
||||
'grace_remaining' => $enforcement->get_grace_period_remaining_days( $user->ID ),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
return $non_compliant;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get network-wide compliance report (Multisite).
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @return array Network compliance report.
|
||||
*/
|
||||
public function get_network_report(): array {
|
||||
if ( ! is_multisite() ) {
|
||||
return array();
|
||||
}
|
||||
|
||||
$sites = get_sites( array( 'number' => 999 ) );
|
||||
$report = array(
|
||||
'total_sites' => count( $sites ),
|
||||
'total_users' => 0,
|
||||
'compliant' => 0,
|
||||
'non_compliant' => 0,
|
||||
'by_site' => array(),
|
||||
);
|
||||
|
||||
foreach ( $sites as $site ) {
|
||||
switch_to_blog( $site->blog_id );
|
||||
|
||||
$site_stats = $this->get_compliance_stats( array( 'blog_id' => $site->blog_id ) );
|
||||
|
||||
$report['by_site'][ $site->blog_id ] = array(
|
||||
'site_name' => get_bloginfo( 'name' ),
|
||||
'site_url' => get_bloginfo( 'url' ),
|
||||
'total_users' => $site_stats['total_users'],
|
||||
'compliant' => $site_stats['compliant_users'],
|
||||
'non_compliant' => $site_stats['non_compliant'],
|
||||
);
|
||||
|
||||
$report['total_users'] += $site_stats['total_users'];
|
||||
$report['compliant'] += $site_stats['compliant_users'];
|
||||
$report['non_compliant'] += $site_stats['non_compliant'];
|
||||
|
||||
restore_current_blog();
|
||||
}
|
||||
|
||||
return $report;
|
||||
}
|
||||
|
||||
/**
|
||||
* Export compliance report to CSV.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param array $args Optional arguments.
|
||||
*
|
||||
* @return string CSV content.
|
||||
*/
|
||||
public function export_to_csv( array $args = array() ): string {
|
||||
$non_compliant = $this->get_non_compliant_users( $args );
|
||||
|
||||
$csv = array();
|
||||
$csv[] = array( 'User ID', 'Username', 'Email', 'Roles', 'Missing Providers', 'Grace Period', 'Days Remaining' );
|
||||
|
||||
foreach ( $non_compliant as $user_data ) {
|
||||
$csv[] = array(
|
||||
$user_data['user_id'],
|
||||
$user_data['user_login'],
|
||||
$user_data['user_email'],
|
||||
implode( ', ', $user_data['roles'] ),
|
||||
implode( ', ', $user_data['missing_providers'] ),
|
||||
$user_data['in_grace_period'] ? 'Yes' : 'No',
|
||||
$user_data['grace_remaining'],
|
||||
);
|
||||
}
|
||||
|
||||
ob_start();
|
||||
$handle = fopen( 'php://output', 'w' );
|
||||
|
||||
foreach ( $csv as $row ) {
|
||||
fputcsv( $handle, $row );
|
||||
}
|
||||
|
||||
fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Simple CSV export
|
||||
|
||||
return ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Send compliance report via email.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param string $to Recipient email address.
|
||||
* @param array $args Optional arguments for report.
|
||||
*
|
||||
* @return bool True on success, false on failure.
|
||||
*/
|
||||
public function email_report( string $to, array $args = array() ): bool {
|
||||
$stats = $this->get_compliance_stats( $args );
|
||||
|
||||
$subject = __( 'Two Factor Extended - Compliance Report', 'two-factor-extended' );
|
||||
|
||||
$message = sprintf(
|
||||
/* translators: 1: Site name */
|
||||
__( 'Compliance Report for %s', 'two-factor-extended' ),
|
||||
get_bloginfo( 'name' )
|
||||
) . "\n\n";
|
||||
|
||||
$message .= __( 'Summary:', 'two-factor-extended' ) . "\n";
|
||||
/* translators: %d: Number of total users */
|
||||
$message .= sprintf( __( 'Total Users: %d', 'two-factor-extended' ), $stats['total_users'] ) . "\n";
|
||||
/* translators: %d: Number of compliant users */
|
||||
$message .= sprintf( __( 'Compliant: %d', 'two-factor-extended' ), $stats['compliant_users'] ) . "\n";
|
||||
/* translators: %d: Number of non-compliant users */
|
||||
$message .= sprintf( __( 'Non-Compliant: %d', 'two-factor-extended' ), $stats['non_compliant'] ) . "\n";
|
||||
/* translators: %d: Number of users in grace period */
|
||||
$message .= sprintf( __( 'In Grace Period: %d', 'two-factor-extended' ), $stats['grace_period'] ) . "\n";
|
||||
/* translators: %d: Number of users with no requirements */
|
||||
$message .= sprintf( __( 'No Requirements: %d', 'two-factor-extended' ), $stats['no_requirements'] ) . "\n\n";
|
||||
|
||||
if ( ! empty( $stats['by_role'] ) ) {
|
||||
$message .= __( 'By Role:', 'two-factor-extended' ) . "\n";
|
||||
|
||||
foreach ( $stats['by_role'] as $role => $role_stats ) {
|
||||
$role_name = Two_Factor_Extended_Role_Manager::get_role_display_name( $role );
|
||||
$message .= sprintf(
|
||||
' %s: %d/%d compliant',
|
||||
$role_name,
|
||||
$role_stats['compliant'],
|
||||
$role_stats['total']
|
||||
) . "\n";
|
||||
}
|
||||
}
|
||||
|
||||
$message .= "\n" . __( 'For detailed information, please log in to the WordPress admin.', 'two-factor-extended' );
|
||||
|
||||
$headers = array( 'Content-Type: text/plain; charset=UTF-8' );
|
||||
|
||||
return wp_mail( $to, $subject, $message, $headers );
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue