mirror of
https://github.com/elyby/oauth2-server.git
synced 2025-05-31 14:12:07 +05:30
Merge branch 'V5-WIP' into secure_body_params_access
This commit is contained in:
Julián Gutiérrez
@@ -3,6 +3,7 @@
|
||||
namespace League\OAuth2\Server\Grant;
|
||||
|
||||
use DateInterval;
|
||||
use League\Event\Event;
|
||||
use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
|
||||
use League\OAuth2\Server\Entities\Interfaces\UserEntityInterface;
|
||||
use League\OAuth2\Server\Exception\OAuthServerException;
|
||||
@@ -12,7 +13,6 @@ use League\OAuth2\Server\Repositories\UserRepositoryInterface;
|
||||
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
|
||||
use League\OAuth2\Server\Utils\KeyCrypt;
|
||||
use League\Plates\Engine;
|
||||
use League\Event\Event;
|
||||
use Psr\Http\Message\ServerRequestInterface;
|
||||
use Zend\Diactoros\Response;
|
||||
use Zend\Diactoros\Uri;
|
||||
@@ -23,10 +23,6 @@ class AuthCodeGrant extends AbstractGrant
|
||||
* @var \DateInterval
|
||||
*/
|
||||
private $authCodeTTL;
|
||||
/**
|
||||
* @var \League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface
|
||||
*/
|
||||
private $authCodeRepository;
|
||||
|
||||
/**
|
||||
* @var \League\OAuth2\Server\Repositories\UserRepositoryInterface
|
||||
@@ -43,11 +39,6 @@ class AuthCodeGrant extends AbstractGrant
|
||||
*/
|
||||
private $pathToAuthorizeTemplate;
|
||||
|
||||
/**
|
||||
* @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface
|
||||
*/
|
||||
private $refreshTokenRepository;
|
||||
|
||||
/**
|
||||
* @param \League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface $authCodeRepository
|
||||
* @param \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface $refreshTokenRepository
|
||||
@@ -64,27 +55,35 @@ class AuthCodeGrant extends AbstractGrant
|
||||
$pathToLoginTemplate = null,
|
||||
$pathToAuthorizeTemplate = null
|
||||
) {
|
||||
$this->authCodeRepository = $authCodeRepository;
|
||||
$this->refreshTokenRepository = $refreshTokenRepository;
|
||||
$this->setAuthCodeRepository($authCodeRepository);
|
||||
$this->setRefreshTokenRepository($refreshTokenRepository);
|
||||
$this->userRepository = $userRepository;
|
||||
$this->authCodeTTL = $authCodeTTL;
|
||||
$this->pathToLoginTemplate = ($pathToLoginTemplate === null)
|
||||
? __DIR__ . '/../ResponseTypes/DefaultTemplates/login_user.php'
|
||||
: $this->pathToLoginTemplate;
|
||||
$this->pathToAuthorizeTemplate = ($pathToLoginTemplate === null)
|
||||
? __DIR__ . '/../ResponseTypes/DefaultTemplates/authorize_client.php'
|
||||
: $this->pathToAuthorizeTemplate;
|
||||
$this->refreshTokenTTL = new \DateInterval('P1M');
|
||||
|
||||
$this->pathToLoginTemplate = __DIR__ . '/../ResponseTypes/DefaultTemplates/login_user';
|
||||
if ($pathToLoginTemplate !== null) {
|
||||
$this->pathToLoginTemplate = (substr($pathToLoginTemplate, -4) === '.php')
|
||||
? substr($pathToLoginTemplate, 0, -4)
|
||||
: $pathToLoginTemplate;
|
||||
}
|
||||
|
||||
$this->pathToAuthorizeTemplate = __DIR__ . '/../ResponseTypes/DefaultTemplates/authorize_client';
|
||||
if ($pathToAuthorizeTemplate !== null) {
|
||||
$this->pathToAuthorizeTemplate = (substr($pathToAuthorizeTemplate, -4) === '.php')
|
||||
? substr($pathToAuthorizeTemplate, 0, -4)
|
||||
: $pathToAuthorizeTemplate;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Respond to an authorization request
|
||||
* Respond to an authorization request.
|
||||
*
|
||||
* @param \Psr\Http\Message\ServerRequestInterface $request
|
||||
*
|
||||
* @return \Psr\Http\Message\ResponseInterface
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthServerException
|
||||
*
|
||||
* @return \Psr\Http\Message\ResponseInterface
|
||||
*/
|
||||
protected function respondToAuthorizationRequest(
|
||||
ServerRequestInterface $request
|
||||
@@ -95,28 +94,26 @@ class AuthCodeGrant extends AbstractGrant
|
||||
$this->getServerParameter('PHP_AUTH_USER', $request)
|
||||
);
|
||||
if (is_null($clientId)) {
|
||||
throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$redirectUri = $this->getQueryStringParameter('redirect_uri', $request, null);
|
||||
if (is_null($redirectUri)) {
|
||||
throw OAuthServerException::invalidRequest('redirect_uri', null, '`%s` parameter is missing');
|
||||
throw OAuthServerException::invalidRequest('client_id');
|
||||
}
|
||||
|
||||
$client = $this->clientRepository->getClientEntity(
|
||||
$clientId,
|
||||
null,
|
||||
$redirectUri,
|
||||
$this->getIdentifier()
|
||||
);
|
||||
|
||||
if ($client instanceof ClientEntityInterface === false) {
|
||||
$this->emitter->emit(new Event('client.authentication.failed', $request));
|
||||
$this->getEmitter()->emit(new Event('client.authentication.failed', $request));
|
||||
|
||||
throw OAuthServerException::invalidClient();
|
||||
}
|
||||
|
||||
$scopes = $this->validateScopes($request, $client, $redirectUri);
|
||||
$redirectUriParameter = $this->getQueryStringParameter('redirect_uri', $request, $client->getRedirectUri());
|
||||
if ($redirectUriParameter !== $client->getRedirectUri()) {
|
||||
throw OAuthServerException::invalidClient();
|
||||
}
|
||||
|
||||
$scopes = $this->validateScopes($request, $client, $client->getRedirectUri());
|
||||
$queryString = http_build_query($request->getQueryParams());
|
||||
$postbackUri = new Uri(
|
||||
sprintf(
|
||||
@@ -168,8 +165,9 @@ class AuthCodeGrant extends AbstractGrant
|
||||
// The user hasn't logged in yet so show a login form
|
||||
if ($userId === null) {
|
||||
$engine = new Engine(dirname($this->pathToLoginTemplate));
|
||||
$pathParts = explode(DIRECTORY_SEPARATOR, $this->pathToLoginTemplate);
|
||||
$html = $engine->render(
|
||||
'login_user',
|
||||
end($pathParts),
|
||||
[
|
||||
'error' => $loginError,
|
||||
'postback_uri' => (string) $postbackUri->withQuery($queryString),
|
||||
@@ -179,12 +177,12 @@ class AuthCodeGrant extends AbstractGrant
|
||||
return new Response\HtmlResponse($html);
|
||||
}
|
||||
|
||||
|
||||
// The user hasn't approved the client yet so show an authorize form
|
||||
if ($userId !== null && $userHasApprovedClient === null) {
|
||||
$engine = new Engine(dirname($this->pathToAuthorizeTemplate));
|
||||
$pathParts = explode(DIRECTORY_SEPARATOR, $this->pathToAuthorizeTemplate);
|
||||
$html = $engine->render(
|
||||
'authorize_client',
|
||||
end($pathParts),
|
||||
[
|
||||
'client' => $client,
|
||||
'scopes' => $scopes,
|
||||
@@ -210,14 +208,16 @@ class AuthCodeGrant extends AbstractGrant
|
||||
);
|
||||
}
|
||||
|
||||
$stateParameter = $this->getQueryStringParameter('state', $request);
|
||||
|
||||
$redirectUri = new Uri($redirectUri);
|
||||
// The user has either approved or denied the client, so redirect them back
|
||||
$redirectUri = new Uri($client->getRedirectUri());
|
||||
parse_str($redirectUri->getQuery(), $redirectPayload);
|
||||
|
||||
$stateParameter = $this->getQueryStringParameter('state', $request);
|
||||
if ($stateParameter !== null) {
|
||||
$redirectPayload['state'] = $stateParameter;
|
||||
}
|
||||
|
||||
// THe user approved the client, redirect them back with an auth code
|
||||
if ($userHasApprovedClient === true) {
|
||||
$authCode = $this->issueAuthCode(
|
||||
$this->authCodeTTL,
|
||||
@@ -226,12 +226,12 @@ class AuthCodeGrant extends AbstractGrant
|
||||
$redirectUri,
|
||||
$scopes
|
||||
);
|
||||
$this->authCodeRepository->persistNewAuthCode($authCode);
|
||||
|
||||
$redirectPayload['code'] = KeyCrypt::encrypt(
|
||||
json_encode(
|
||||
[
|
||||
'client_id' => $authCode->getClient()->getIdentifier(),
|
||||
'redirect_uri' => $authCode->getRedirectUri(),
|
||||
'auth_code_id' => $authCode->getIdentifier(),
|
||||
'scopes' => $authCode->getScopes(),
|
||||
'user_id' => $authCode->getUserIdentifier(),
|
||||
@@ -244,25 +244,34 @@ class AuthCodeGrant extends AbstractGrant
|
||||
return new Response\RedirectResponse($redirectUri->withQuery(http_build_query($redirectPayload)));
|
||||
}
|
||||
|
||||
// The user denied the client, redirect them back with an error
|
||||
$exception = OAuthServerException::accessDenied('The user denied the request', (string) $redirectUri);
|
||||
|
||||
return $exception->generateHttpResponse();
|
||||
}
|
||||
|
||||
/**
|
||||
* Respond to an access token request
|
||||
* Respond to an access token request.
|
||||
*
|
||||
* @param \Psr\Http\Message\ServerRequestInterface $request
|
||||
* @param \League\OAuth2\Server\ResponseTypes\ResponseTypeInterface $responseType
|
||||
* @param \DateInterval $accessTokenTTL
|
||||
*
|
||||
* @return \League\OAuth2\Server\ResponseTypes\ResponseTypeInterface
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthServerException
|
||||
*
|
||||
* @return \League\OAuth2\Server\ResponseTypes\ResponseTypeInterface
|
||||
*/
|
||||
protected function respondToAccessTokenRequest(
|
||||
ServerRequestInterface $request,
|
||||
ResponseTypeInterface $responseType,
|
||||
DateInterval $accessTokenTTL
|
||||
) {
|
||||
// The redirect URI is required in this request
|
||||
$redirectUri = $this->getRequestParameter('redirect_uri', $request, null);
|
||||
if (is_null($redirectUri)) {
|
||||
throw OAuthServerException::invalidRequest('redirect_uri');
|
||||
}
|
||||
|
||||
// Validate request
|
||||
$client = $this->validateClient($request);
|
||||
$encryptedAuthCode = $this->getRequestParameter('code', $request, null);
|
||||
@@ -278,15 +287,19 @@ class AuthCodeGrant extends AbstractGrant
|
||||
throw OAuthServerException::invalidRequest('code', 'Authorization code has expired');
|
||||
}
|
||||
|
||||
if ($this->authCodeRepository->isAuthCodeRevoked($authCodePayload->auth_code_id) === true) {
|
||||
if ($this->getAuthCodeRepository()->isAuthCodeRevoked($authCodePayload->auth_code_id) === true) {
|
||||
throw OAuthServerException::invalidRequest('code', 'Authorization code has been revoked');
|
||||
}
|
||||
|
||||
if ($authCodePayload->client_id !== $client->getIdentifier()) {
|
||||
throw OAuthServerException::invalidRequest('code', 'Authorization code was not issued to this client');
|
||||
}
|
||||
|
||||
if ($authCodePayload->redirect_uri !== $redirectUri) {
|
||||
throw OAuthServerException::invalidRequest('redirect_uri', 'Invalid redirect URI');
|
||||
}
|
||||
} catch (\LogicException $e) {
|
||||
throw OAuthServerException::invalidRequest('code', null, 'Cannot decrypt the authorization code');
|
||||
throw OAuthServerException::invalidRequest('code', 'Cannot decrypt the authorization code');
|
||||
}
|
||||
|
||||
// Issue and persist access + refresh tokens
|
||||
@@ -297,8 +310,6 @@ class AuthCodeGrant extends AbstractGrant
|
||||
$authCodePayload->scopes
|
||||
);
|
||||
$refreshToken = $this->issueRefreshToken($accessToken);
|
||||
$this->accessTokenRepository->persistNewAccessToken($accessToken);
|
||||
$this->refreshTokenRepository->persistNewRefreshToken($refreshToken);
|
||||
|
||||
// Inject tokens into response type
|
||||
$responseType->setAccessToken($accessToken);
|
||||
@@ -308,23 +319,21 @@ class AuthCodeGrant extends AbstractGrant
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc
|
||||
* {@inheritdoc}
|
||||
*/
|
||||
public function respondToRequest(
|
||||
ServerRequestInterface $request,
|
||||
ResponseTypeInterface $responseType,
|
||||
\DateInterval $accessTokenTTL
|
||||
) {
|
||||
if (array_key_exists('response_type', $request->getQueryParams())
|
||||
if (
|
||||
array_key_exists('response_type', $request->getQueryParams())
|
||||
&& $request->getQueryParams()['response_type'] === 'code'
|
||||
&& array_key_exists('client_id', $request->getQueryParams())
|
||||
) {
|
||||
return $this->respondToAuthorizationRequest($request);
|
||||
} elseif (parent::canRespondToRequest($request)) {
|
||||
return $this->respondToAccessTokenRequest($request, $responseType, $accessTokenTTL);
|
||||
} else {
|
||||
throw OAuthServerException::serverError('respondToRequest() should not have been called');
|
||||
}
|
||||
|
||||
return $this->respondToAccessTokenRequest($request, $responseType, $accessTokenTTL);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -332,18 +341,17 @@ class AuthCodeGrant extends AbstractGrant
|
||||
*/
|
||||
public function canRespondToRequest(ServerRequestInterface $request)
|
||||
{
|
||||
return (
|
||||
return
|
||||
(
|
||||
array_key_exists('response_type', $request->getQueryParams())
|
||||
&& $request->getQueryParams()['response_type'] === 'code'
|
||||
&& isset($request->getQueryParams()['client_id'])
|
||||
)
|
||||
|| parent::canRespondToRequest($request)
|
||||
);
|
||||
|| parent::canRespondToRequest($request);
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the grant identifier that can be used in matching up requests
|
||||
* Return the grant identifier that can be used in matching up requests.
|
||||
*
|
||||
* @return string
|
||||
*/
|
||||
|
||||
Reference in New Issue
Block a user