bay_platform_dependencies.module

<?php

/**
 * @file
 * Primary module hooks for bay-platform-dependencies module.
 */

use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Render\BubbleableMetadata;

// phpcs:disable
const BAY_PLATFORM_DEPENDENCIES_ENV_SMTP_ALLOWLIST = "SMTP_FROM_WHITELIST";
const BAY_PLATFORM_DEPENDENCIES_K8S_SERVICE_ACCOUNT_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token";
// phpcs:enable

/**
 * Implements hook_mail_alter().
 */
function bay_platform_dependencies_mail_alter(&$message) {
  // Ensures that the Reply-To header points to a no-reply address if it is
  // using the default value. This is to ensure the SES verified address
  // doesn't get spammed. The second check ensures that modules which change
  // the reply-to (such as webform) still function correctly.
  //
  // The SMTP_REPLYTO environment variable is set in lagoon.
  $reply_to = getenv("SMTP_REPLYTO") ?: '';
  if ($reply_to && ($message['from'] == $message['reply-to'])) {
    $message['reply-to'] = $reply_to;
    $message['headers']['Reply-to'] = $reply_to;
  }
}

/**
 * Implements hook_form_FORM_ID_alter().
 */
function bay_platform_dependencies_form_webform_handler_form_alter(&$form, FormStateInterface $form_state) {
  $smtp_allowlist = _bay_platform_dependencies_smtp_allowlist();
  if (!$smtp_allowlist) {
    return;
  }

  _bay_platform_dependencies_form_webform_handler_form_options($form["settings"]["from"]["from_mail"]["from_mail"], $smtp_allowlist);
  _bay_platform_dependencies_form_webform_handler_form_options($form["settings"]["additional"]["return_path"]["return_path"], $smtp_allowlist);
  _bay_platform_dependencies_form_webform_handler_form_options($form["settings"]["additional"]["sender_mail"]["sender_mail"], $smtp_allowlist);
}

/**
 * Helper to alter form elements related to webform email handlers.
 */
function _bay_platform_dependencies_form_webform_handler_form_options(&$element, array $smtp_allowlist) {
  // Remove ability to choose element values.
  unset($element['#options']["Elements"]);
  unset($element['#options']["Options"]);

  // Remove ability to choose contextual values.
  $element['#options']["Other"] = [];
  foreach ($smtp_allowlist as $email) {
    $element['#options']["Other"][$email] = $email;
  }

  // Add validation to ensure "other" values meet allowlist.
  $element["#element_validate"][] = "bay_platform_dependencies_form_webform_handler_form_element_validate";
}

/**
 * Validation handler for email options elements.
 */
function bay_platform_dependencies_form_webform_handler_form_element_validate($element, &$form_state) {
  $value = $form_state->getValue($element['#parents']);
  if (empty($value) || $value == "_default") {
    return;
  }

  if (!in_array($value, _bay_platform_dependencies_smtp_allowlist())) {
    $error = \Drupal::translation()->translate("Disallowed email address submitted - %email", ["%email" => $value]);
    $form_state->setErrorByName(implode("][", $element['#parents']), $error);
  }
}

/**
 * Helper function which returns the permitted email addresses.
 *
 * @returns array|bool
 *  Array of allowed emails, or
 *  FALSE is not configured.
 */
function _bay_platform_dependencies_smtp_allowlist() {
  $list = getenv(BAY_PLATFORM_DEPENDENCIES_ENV_SMTP_ALLOWLIST);
  if (empty($list)) {
    return FALSE;
  }
  return explode(",", $list);
}

/**
 * Implements hook_token_info().
 */
function bay_platform_dependencies_token_info() {
  $info = [];

  $info['tokens']['bay_platform_dependencies']['k8s-service-account-token'] = [
    'name' => t('Kubernetes Service Account Token'),
    'description' => t('A token which retrieves the current value from /var/run/secrets/kubernetes.io/serviceaccount/token.'),
  ];

  return $info;
}

/**
 * Implements hook_tokens().
 */
function bay_platform_dependencies_tokens($type, $tokens, array $data, array $options, BubbleableMetadata $bubbleable_metadata) {
  $replacements = [];
  if ($type == 'bay_platform_dependencies') {
    foreach ($tokens as $name => $original) {
      switch ($name) {
        case 'k8s-service-account-token':
          if (file_exists(BAY_PLATFORM_DEPENDENCIES_K8S_SERVICE_ACCOUNT_PATH)) {
            $token = file_get_contents(BAY_PLATFORM_DEPENDENCIES_K8S_SERVICE_ACCOUNT_PATH);
            if ($token === FALSE) {
              throw new \Exception(sprintf("Failed to read service account token at %s", BAY_PLATFORM_DEPENDENCIES_K8S_SERVICE_ACCOUNT_PATH));
            }
            $replacements[$original] = $token;
          }
          else {
            $replacements[$original] = '';
          }
          break;
      }
    }
  }
  return $replacements;
}