ElyBy-Mirror/accounts
1
0
Fork 0
mirror of https://github.com/elyby/accounts.git synced 2025-01-10 22:12:03 +05:30
Code Issues Packages Projects Releases Wiki Activity

fix: use custom Redirect URI validation logic in RefreshTokenGrant (#42)

Browse Source 
Co-authored-by: ErickSkrauch <erickskrauch@yandex.ru>
This commit is contained in:
Octol1ttle 2025-01-09 05:23:41 +05:00 committed by GitHub
parent 7b626507bc
commit 3bba99a757
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 66 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
common/components/OAuth2/Grants/AuthCodeGrant.php
View File

@ -4,19 +4,15 @@ declare(strict_types=1);
namespace common\components\OAuth2\Grants;
use common\components\OAuth2\CryptTrait;
use common\components\OAuth2\Events\RequestedRefreshToken;
use common\components\OAuth2\Repositories\PublicScopeRepository;
use DateInterval;
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\Grant\AuthCodeGrant as BaseAuthCodeGrant;
use League\OAuth2\Server\RequestEvent;
use Psr\Http\Message\ServerRequestInterface;
use yii\helpers\StringHelper;
final class AuthCodeGrant extends BaseAuthCodeGrant {
use CryptTrait;
use CheckOfflineAccessScopeTrait;
use ValidateRedirectUriTrait;
protected function issueAccessToken(
DateInterval $accessTokenTTL,
@ -24,30 +20,8 @@ final class AuthCodeGrant extends BaseAuthCodeGrant {
?string $userIdentifier,
array $scopes = [],
): AccessTokenEntityInterface {
foreach ($scopes as $i => $scope) {
if ($scope->getIdentifier() === PublicScopeRepository::OFFLINE_ACCESS) {
unset($scopes[$i]);
$this->getEmitter()->emit(new RequestedRefreshToken('refresh_token_requested'));
}
}
$this->checkOfflineAccessScope($scopes);
return parent::issueAccessToken($accessTokenTTL, $client, $userIdentifier, $scopes);
}
protected function validateRedirectUri(
string $redirectUri,
ClientEntityInterface $client,
ServerRequestInterface $request,
): void {
$allowedRedirectUris = (array)$client->getRedirectUri();
foreach ($allowedRedirectUris as $allowedRedirectUri) {
if (StringHelper::startsWith($redirectUri, $allowedRedirectUri)) {
return;
}
}
$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
throw OAuthServerException::invalidClient($request);
}
}

26
common/components/OAuth2/Grants/CheckOfflineAccessScopeTrait.php Normal file
View File

@ -0,0 +1,26 @@
<?php
declare(strict_types=1);
namespace common\components\OAuth2\Grants;
use common\components\OAuth2\Events\RequestedRefreshToken;
use common\components\OAuth2\Repositories\PublicScopeRepository;
use League\OAuth2\Server\EventEmitting\EventEmitter;
trait CheckOfflineAccessScopeTrait {
abstract public function getEmitter(): EventEmitter;
/**
* @param \League\OAuth2\Server\Entities\ScopeEntityInterface[] $scopes
*/
protected function checkOfflineAccessScope(array $scopes = []): void {
foreach ($scopes as $i => $scope) {
if ($scope->getIdentifier() === PublicScopeRepository::OFFLINE_ACCESS) {
unset($scopes[$i]);
$this->getEmitter()->emit(new RequestedRefreshToken('refresh_token_requested'));
}
}
}
}

10
common/components/OAuth2/Grants/DeviceCodeGrant.php
View File

@ -3,9 +3,7 @@ declare(strict_types=1);
namespace common\components\OAuth2\Grants;
use common\components\OAuth2\Events\RequestedRefreshToken;
use common\components\OAuth2\Repositories\ExtendedDeviceCodeRepositoryInterface;
use common\components\OAuth2\Repositories\PublicScopeRepository;
use common\components\OAuth2\ResponseTypes\EmptyResponse;
use DateInterval;
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
@ -22,6 +20,7 @@ use Psr\Http\Message\ServerRequestInterface;
* @property ExtendedDeviceCodeRepositoryInterface $deviceCodeRepository
*/
final class DeviceCodeGrant extends BaseDeviceCodeGrant {
use CheckOfflineAccessScopeTrait;
public function __construct(
ExtendedDeviceCodeRepositoryInterface $deviceCodeRepository,
@ -95,12 +94,7 @@ final class DeviceCodeGrant extends BaseDeviceCodeGrant {
?string $userIdentifier,
array $scopes = [],
): AccessTokenEntityInterface {
foreach ($scopes as $i => $scope) {
if ($scope->getIdentifier() === PublicScopeRepository::OFFLINE_ACCESS) {
unset($scopes[$i]);
$this->getEmitter()->emit(new RequestedRefreshToken('refresh_token_requested'));
}
}
$this->checkOfflineAccessScope($scopes);
return parent::issueAccessToken($accessTokenTTL, $client, $userIdentifier, $scopes);
}

1
common/components/OAuth2/Grants/RefreshTokenGrant.php
View File

@ -20,6 +20,7 @@ use Yii;
final class RefreshTokenGrant extends BaseRefreshTokenGrant {
use CryptTrait;
use ValidateRedirectUriTrait;
/**
* Previously, refresh tokens were stored in Redis.

34
common/components/OAuth2/Grants/ValidateRedirectUriTrait.php Normal file
View File

@ -0,0 +1,34 @@
<?php
declare(strict_types=1);
namespace common\components\OAuth2\Grants;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\EventEmitting\EventEmitter;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\RequestEvent;
use Psr\Http\Message\ServerRequestInterface;
use yii\helpers\StringHelper;
trait ValidateRedirectUriTrait {
abstract public function getEmitter(): EventEmitter;
protected function validateRedirectUri(
string $redirectUri,
ClientEntityInterface $client,
ServerRequestInterface $request,
): void {
$allowedRedirectUris = (array)$client->getRedirectUri();
foreach ($allowedRedirectUris as $allowedRedirectUri) {
if (StringHelper::startsWith($redirectUri, $allowedRedirectUri)) {
return;
}
}
$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
throw OAuthServerException::invalidClient($request);
}
}