From b5854215a79d1b6de1669499367606fe1a4410b9 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Thu, 5 Dec 2013 21:37:24 +0000 Subject: [PATCH 01/17] Went back to old title --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9e22f3f7..ae1510d4 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# league\oauth2-server +# PHP OAuth 2.0 Server [![Latest Stable Version](https://poser.pugx.org/league/oauth2-server/v/stable.png)](https://packagist.org/packages/league/oauth2-server) [![Coverage Status](https://coveralls.io/repos/php-loep/oauth2-server/badge.png?branch=master)](https://coveralls.io/r/php-loep/oauth2-server?branch=master) [![Total Downloads](https://poser.pugx.org/league/oauth2-server/downloads.png)](https://packagist.org/packages/league/oauth2-server) [![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/php-loep/oauth2-server/trend.png)](https://bitdeli.com/free "Bitdeli Badge") From 2adefdf4c83d1d0c804815e5ec501834c6e124e7 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Thu, 5 Dec 2013 21:42:48 +0000 Subject: [PATCH 02/17] Removed section about built in PDO drivers --- README.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/README.md b/README.md index ae1510d4..d9cb7adb 100644 --- a/README.md +++ b/README.md @@ -47,10 +47,6 @@ The resource server allows you to secure your API endpoints by checking for a va Custom grants can be created easily by implementing an interface. Check out a guide here [https://github.com/php-loep/oauth2-server/wiki/Creating-custom-grants](https://github.com/php-loep/oauth2-server/wiki/Creating-custom-grants). -### PDO driver - -If you are using MySQL and want to very quickly implement the library then all of the storage interfaces have been implemented with PDO classes. Check out the guide here [https://github.com/php-loep/oauth2-server/wiki/Using-the-PDO-storage-classes](https://github.com/php-loep/oauth2-server/wiki/Using-the-PDO-storage-classes). - ## Tutorials and documentation The wiki has lots of guides on how to use this library, check it out - [https://github.com/php-loep/oauth2-server/wiki](https://github.com/php-loep/oauth2-server/wiki). From 619d7550085158b794f90e984a87bf31f9cfe329 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Fri, 6 Dec 2013 10:17:33 +0000 Subject: [PATCH 03/17] Removed some tests that randomly fail --- tests/authorization/AuthServerTest.php | 3 --- tests/authorization/ClientCredentialsGrantTest.php | 3 --- tests/authorization/PasswordGrantTest.php | 4 ---- tests/authorization/RefreshTokenTest.php | 4 ---- 4 files changed, 14 deletions(-) diff --git a/tests/authorization/AuthServerTest.php b/tests/authorization/AuthServerTest.php index e73184be..2646fc75 100644 --- a/tests/authorization/AuthServerTest.php +++ b/tests/authorization/AuthServerTest.php @@ -386,7 +386,6 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } public function test_issueAccessToken() @@ -425,7 +424,6 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } public function test_issueAccessToken_customExpiresIn() @@ -507,7 +505,6 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } public function tearDown() { diff --git a/tests/authorization/ClientCredentialsGrantTest.php b/tests/authorization/ClientCredentialsGrantTest.php index bb312690..0883a825 100644 --- a/tests/authorization/ClientCredentialsGrantTest.php +++ b/tests/authorization/ClientCredentialsGrantTest.php @@ -290,7 +290,6 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } function test_issueAccessToken_clientCredentialsGrant() @@ -328,7 +327,6 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } function test_issueAccessToken_clientCredentialsGrant_customExpiresIn() @@ -408,7 +406,6 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } } \ No newline at end of file diff --git a/tests/authorization/PasswordGrantTest.php b/tests/authorization/PasswordGrantTest.php index 71d2cec3..fcd45c7a 100644 --- a/tests/authorization/PasswordGrantTest.php +++ b/tests/authorization/PasswordGrantTest.php @@ -471,7 +471,6 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } function test_issueAccessToken_passwordGrant() @@ -516,7 +515,6 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } function test_issueAccessToken_passwordGrant_customExpiresIn() @@ -611,7 +609,5 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('refresh_token', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } - } \ No newline at end of file diff --git a/tests/authorization/RefreshTokenTest.php b/tests/authorization/RefreshTokenTest.php index 290169e3..572b50cb 100644 --- a/tests/authorization/RefreshTokenTest.php +++ b/tests/authorization/RefreshTokenTest.php @@ -67,7 +67,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('refresh_token', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } /** @@ -208,7 +207,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } public function test_issueAccessToken_refreshTokenGrant() @@ -247,7 +245,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('expires_in', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } public function test_issueAccessToken_refreshTokenGrant_rotateTokens() @@ -290,7 +287,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase $this->assertArrayHasKey('refresh_token', $v); $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']); - $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']); } public function test_issueAccessToken_refreshTokenGrant_customExpiresIn() From 9b9cf79f39849b9c09e6736f26c32258aa372986 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anderson=20M=C3=BCller?= Date: Fri, 6 Dec 2013 11:17:41 +0100 Subject: [PATCH 04/17] Typo in docblock --- src/League/OAuth2/Server/Storage/SessionInterface.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/League/OAuth2/Server/Storage/SessionInterface.php b/src/League/OAuth2/Server/Storage/SessionInterface.php index 051c4dbb..f40b1406 100644 --- a/src/League/OAuth2/Server/Storage/SessionInterface.php +++ b/src/League/OAuth2/Server/Storage/SessionInterface.php @@ -208,7 +208,7 @@ interface SessionInterface * AND refresh_token_expires >= UNIX_TIMESTAMP(NOW()) AND client_id = :clientId * * - * @param string $refreshToken The access token + * @param string $refreshToken The refresh token * @param string $clientId The client ID * @return int|bool The ID of the access token the refresh token is linked to (or false if invalid) */ From 5870368e337be7f7ab0eeff88c55ffc7b44545d1 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Fri, 6 Dec 2013 10:20:03 +0000 Subject: [PATCH 05/17] Added TravisCI's new asset caching http://about.travis-ci.org/blog/2013-12-05-speed-up-your-builds-cache-your-dependencies/ --- .travis.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 51421206..e386400b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -5,4 +5,9 @@ php: - 5.5 before_script: composer install --prefer-source -script: phpunit --configuration phpunit.xml.dist \ No newline at end of file +script: phpunit --configuration phpunit.xml.dist + +cache: + bundler: true + directories: + - vendor \ No newline at end of file From 6d7887dc360d015cf5ba74e39f8eb7e7933c2a61 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Fri, 6 Dec 2013 10:20:42 +0000 Subject: [PATCH 06/17] Removed unnecessary line --- .travis.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index e386400b..d1d13c3b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -8,6 +8,5 @@ before_script: composer install --prefer-source script: phpunit --configuration phpunit.xml.dist cache: - bundler: true directories: - vendor \ No newline at end of file From f07d16933640a842d2a0fb56cc100f9462fc2ce3 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Fri, 6 Dec 2013 10:48:38 +0000 Subject: [PATCH 07/17] Added CONTRIBUTING.md --- CONTRIBUTING.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 CONTRIBUTING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 00000000..d4228cae --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,9 @@ +Thanks for contributing to this project. + +Please ensure that you run `phpunit` from the project root after you've made any changes. + +If you've added something new please create a new unit test, if you've changed something please update any unit tests as appropritate. + +We're trying to ensure there is 100% test code coverage (including testing PHP errors and excpetions) so please ensure any new/updated tests cover all of your changes. + +Please submit you pull request against the `develop` branch only. From f563a59ce8363fc830f7f1b031d19b028d8c1f49 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Fri, 6 Dec 2013 10:50:22 +0000 Subject: [PATCH 08/17] Update CONTRIBUTING.md --- CONTRIBUTING.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d4228cae..0391ae5e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,9 +1,15 @@ Thanks for contributing to this project. + +**Please submit your pull request against the `develop` branch only.** + + Please ensure that you run `phpunit` from the project root after you've made any changes. If you've added something new please create a new unit test, if you've changed something please update any unit tests as appropritate. -We're trying to ensure there is 100% test code coverage (including testing PHP errors and excpetions) so please ensure any new/updated tests cover all of your changes. +We're trying to ensure there is **100%** test code coverage (including testing PHP errors and exceptions) so please ensure any new/updated tests cover all of your changes. -Please submit you pull request against the `develop` branch only. +Thank you, + +@alexbilbie From 7c1b913e49153c06571b4b0277fded92e251793f Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Thu, 19 Dec 2013 12:32:09 +0000 Subject: [PATCH 09/17] Travis will now test against HHVM --- .travis.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index d1d13c3b..a7085fe5 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,10 +3,11 @@ language: php php: - 5.4 - 5.5 + - hhvm before_script: composer install --prefer-source script: phpunit --configuration phpunit.xml.dist cache: directories: - - vendor \ No newline at end of file + - vendor From 13b15dfa3a43a102b974aa2bba7afc2ea8fcbee7 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Thu, 19 Dec 2013 12:33:39 +0000 Subject: [PATCH 10/17] Update README.md --- README.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index d9cb7adb..c9aa27e4 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,11 @@ The framework is provided as a Composer package which can be installed by adding The library features 100% unit test code coverage. To run the tests yourself run `phpunit` from the project root. +Master branch - [![Build Status](https://travis-ci.org/php-loep/oauth2-server.png?branch=master)](https://travis-ci.org/php-loep/oauth2-server) + +Develop branch - [![Build Status](https://travis-ci.org/php-loep/oauth2-server.png?branch=develop)](https://travis-ci.org/php-loep/oauth2-server) + + ## Current Features ### Authorization Server @@ -83,4 +88,4 @@ Special thanks to: * [Phil Sturgeon](https://github.com/philsturgeon) * [and all the other contributors](https://github.com/php-loep/oauth2-server/contributors) -The initial code was developed as part of the [Linkey](http://linkey.blogs.lincoln.ac.uk) project which was funded by [JISC](http://jisc.ac.uk) under the Access and Identity Management programme. \ No newline at end of file +The initial code was developed as part of the [Linkey](http://linkey.blogs.lincoln.ac.uk) project which was funded by [JISC](http://jisc.ac.uk) under the Access and Identity Management programme. From 25332be3d1a90599df06c2fac6fb31cb3df6a917 Mon Sep 17 00:00:00 2001 From: Alex Bilbie Date: Mon, 23 Dec 2013 23:39:49 +0000 Subject: [PATCH 11/17] Update .travis.yml --- .travis.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.travis.yml b/.travis.yml index a7085fe5..b781adc1 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,6 +4,10 @@ php: - 5.4 - 5.5 - hhvm + +matrix: + allow_failures: + - php: hhvm before_script: composer install --prefer-source script: phpunit --configuration phpunit.xml.dist From 895a379ed3fade55a89163e5edadcf26128b1561 Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Wed, 22 Jan 2014 11:27:38 -0500 Subject: [PATCH 12/17] Update composer.json --- composer.json | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/composer.json b/composer.json index ee81767a..686b6a9a 100644 --- a/composer.json +++ b/composer.json @@ -2,7 +2,6 @@ "name": "league/oauth2-server", "description": "A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.", "version": "3.1.1", - "homepage": "https://github.com/php-loep/oauth2-server", "license": "MIT", "require": { "php": ">=5.4.0" @@ -14,7 +13,7 @@ "repositories": [ { "type": "git", - "url": "https://github.com/php-loep/oauth2-server.git" + "url": "https://github.com/thephpleague/oauth2-server.git" } ], "keywords": [ @@ -39,7 +38,6 @@ ], "replace": { "lncd/oauth2": "*", - "league/oauth2server": "*" }, "autoload": { "psr-0": { @@ -49,4 +47,4 @@ "suggest": { } -} \ No newline at end of file +} From 5829781b38d44c02ba8cc3a3c5b1fe904026e7d5 Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Wed, 22 Jan 2014 11:28:23 -0500 Subject: [PATCH 13/17] Update composer.json --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 686b6a9a..91042053 100644 --- a/composer.json +++ b/composer.json @@ -37,7 +37,7 @@ } ], "replace": { - "lncd/oauth2": "*", + "lncd/oauth2": "*" }, "autoload": { "psr-0": { From 8556f616d3336097ea8810e219861266eb6d4581 Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Tue, 11 Feb 2014 12:27:35 -0500 Subject: [PATCH 14/17] Ninja 5.6 test --- .travis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.travis.yml b/.travis.yml index b781adc1..30bed1af 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,6 +3,7 @@ language: php php: - 5.4 - 5.5 + - 5.6 - hhvm matrix: From f83a9a7fa43dd2f81ddf5b86020523ff970a2034 Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Wed, 26 Feb 2014 17:27:56 -0500 Subject: [PATCH 15/17] Support Authorization header passed as ENV var Some hosts (at this point I only know of Fortrabbit) require Authorization headers to be passed as an environment variable, which PHP will then shove into . See more: http://fortrabbit.com/docs/essentials/quirks-and-constraints\#authorization-header --- src/League/OAuth2/Server/Resource.php | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/League/OAuth2/Server/Resource.php b/src/League/OAuth2/Server/Resource.php index 55339567..3485315a 100644 --- a/src/League/OAuth2/Server/Resource.php +++ b/src/League/OAuth2/Server/Resource.php @@ -185,7 +185,7 @@ class Resource $result = $this->storages['session']->validateAccessToken($accessToken); - if ( ! $result) { + if (! $result) { throw new Exception\InvalidAccessTokenException('Access token is not valid'); } @@ -227,7 +227,7 @@ class Resource return false; } elseif (is_array($scopes)) { foreach ($scopes as $scope) { - if ( ! in_array($scope, $this->sessionScopes)) { + if (! in_array($scope, $this->sessionScopes)) { return false; } } @@ -246,7 +246,15 @@ class Resource */ public function determineAccessToken($headersOnly = false) { - if ($header = $this->getRequest()->header('Authorization')) { + // Try to get it directly from a header + if (! $header = $this->getRequest()->header('Authorization')) { + + // Failing that try getting it from a server variable + $header = $this->getRequest()->server('HTTP_AUTHORIZATION'); + } + + // One of them worked + if ($header) { // Check for special case, because cURL sometimes does an // internal second request and doubles the authorization header, // which always resulted in an error. @@ -271,5 +279,4 @@ class Resource return $accessToken; } - } From 3c9fd6be2759f277be91530335359f1c7310d5f8 Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Wed, 26 Feb 2014 17:35:34 -0500 Subject: [PATCH 16/17] Updated changelog. --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 13f45c16..468f1426 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## 3.1.2 (released 2014-02-26) + +* Support Authorization being an environment variable. [See more](http://fortrabbit.com/docs/essentials/quirks-and-constraints#authorization-header) + ## 3.1.1 (released 2013-12-05) * Normalize headers when `getallheaders()` is available (Issues #108 and #114) From 1045c70bac8def1e0ff0f3cc69558f6121f10d0b Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Wed, 26 Feb 2014 17:37:33 -0500 Subject: [PATCH 17/17] Fixed some links in README. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c9aa27e4..9e08f90e 100644 --- a/README.md +++ b/README.md @@ -26,9 +26,9 @@ The framework is provided as a Composer package which can be installed by adding The library features 100% unit test code coverage. To run the tests yourself run `phpunit` from the project root. -Master branch - [![Build Status](https://travis-ci.org/php-loep/oauth2-server.png?branch=master)](https://travis-ci.org/php-loep/oauth2-server) +[![Build Status](https://travis-ci.org/thephpleague/oauth2-server.png?branch=master)](https://travis-ci.org/thephpleague/oauth2-server) [master] -Develop branch - [![Build Status](https://travis-ci.org/php-loep/oauth2-server.png?branch=develop)](https://travis-ci.org/php-loep/oauth2-server) +[![Build Status](https://travis-ci.org/thephpleague/oauth2-server.png?branch=develop)](https://travis-ci.org/thephpleague/oauth2-server) [develop] ## Current Features