2016-11-30 01:45:56 +05:30
|
|
|
<?php
|
|
|
|
namespace api\components\OAuth2\Grants;
|
|
|
|
|
2017-06-17 23:35:36 +05:30
|
|
|
use api\components\OAuth2\Entities\AccessTokenEntity;
|
|
|
|
use api\components\OAuth2\Entities\AuthCodeEntity;
|
|
|
|
use api\components\OAuth2\Entities\ClientEntity;
|
|
|
|
use api\components\OAuth2\Entities\RefreshTokenEntity;
|
|
|
|
use api\components\OAuth2\Entities\SessionEntity;
|
2017-09-19 22:36:16 +05:30
|
|
|
use api\components\OAuth2\Storage\ScopeStorage;
|
2017-10-04 17:12:48 +05:30
|
|
|
use api\components\OAuth2\Utils\Scopes;
|
2017-06-17 23:35:36 +05:30
|
|
|
use League\OAuth2\Server\Entity\AuthCodeEntity as BaseAuthCodeEntity;
|
|
|
|
use League\OAuth2\Server\Entity\ClientEntity as BaseClientEntity;
|
|
|
|
use League\OAuth2\Server\Event\ClientAuthenticationFailedEvent;
|
|
|
|
use League\OAuth2\Server\Exception;
|
|
|
|
use League\OAuth2\Server\Grant\AbstractGrant;
|
|
|
|
use League\OAuth2\Server\Util\SecureKey;
|
2016-11-30 01:45:56 +05:30
|
|
|
|
2017-06-17 23:35:36 +05:30
|
|
|
class AuthCodeGrant extends AbstractGrant {
|
2016-11-30 01:45:56 +05:30
|
|
|
|
2017-06-17 23:35:36 +05:30
|
|
|
protected $identifier = 'authorization_code';
|
|
|
|
|
|
|
|
protected $responseType = 'code';
|
|
|
|
|
|
|
|
protected $authTokenTTL = 600;
|
|
|
|
|
|
|
|
protected $requireClientSecret = true;
|
|
|
|
|
|
|
|
public function setAuthTokenTTL(int $authTokenTTL): void {
|
|
|
|
$this->authTokenTTL = $authTokenTTL;
|
2016-11-30 01:45:56 +05:30
|
|
|
}
|
|
|
|
|
2017-06-17 23:35:36 +05:30
|
|
|
public function setRequireClientSecret(bool $required): void {
|
|
|
|
$this->requireClientSecret = $required;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function shouldRequireClientSecret(): bool {
|
|
|
|
return $this->requireClientSecret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Check authorize parameters
|
|
|
|
*
|
|
|
|
* @return AuthorizeParams Authorize request parameters
|
|
|
|
* @throws Exception\OAuthException
|
|
|
|
*
|
|
|
|
* @throws
|
|
|
|
*/
|
|
|
|
public function checkAuthorizeParams(): AuthorizeParams {
|
|
|
|
// Get required params
|
|
|
|
$clientId = $this->server->getRequest()->query->get('client_id');
|
|
|
|
if ($clientId === null) {
|
|
|
|
throw new Exception\InvalidRequestException('client_id');
|
|
|
|
}
|
|
|
|
|
|
|
|
$redirectUri = $this->server->getRequest()->query->get('redirect_uri');
|
|
|
|
if ($redirectUri === null) {
|
|
|
|
throw new Exception\InvalidRequestException('redirect_uri');
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate client ID and redirect URI
|
|
|
|
$client = $this->server->getClientStorage()->get($clientId, null, $redirectUri, $this->getIdentifier());
|
|
|
|
if (!$client instanceof ClientEntity) {
|
|
|
|
$this->server->getEventEmitter()->emit(new ClientAuthenticationFailedEvent($this->server->getRequest()));
|
|
|
|
throw new Exception\InvalidClientException();
|
|
|
|
}
|
|
|
|
|
|
|
|
$state = $this->server->getRequest()->query->get('state');
|
|
|
|
if ($state === null && $this->server->stateParamRequired()) {
|
|
|
|
throw new Exception\InvalidRequestException('state', $redirectUri);
|
|
|
|
}
|
|
|
|
|
|
|
|
$responseType = $this->server->getRequest()->query->get('response_type');
|
|
|
|
if ($responseType === null) {
|
|
|
|
throw new Exception\InvalidRequestException('response_type', $redirectUri);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure response type is one that is recognised
|
|
|
|
if (!in_array($responseType, $this->server->getResponseTypes(), true)) {
|
|
|
|
throw new Exception\UnsupportedResponseTypeException($responseType, $redirectUri);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate any scopes that are in the request
|
|
|
|
$scopeParam = $this->server->getRequest()->query->get('scope', '');
|
|
|
|
$scopes = $this->validateScopes($scopeParam, $client, $redirectUri);
|
|
|
|
|
|
|
|
return new AuthorizeParams($client, $redirectUri, $state, $responseType, $scopes);
|
2016-11-30 01:45:56 +05:30
|
|
|
}
|
|
|
|
|
2017-06-17 23:35:36 +05:30
|
|
|
/**
|
|
|
|
* Parse a new authorize request
|
|
|
|
*
|
|
|
|
* @param string $type The session owner's type
|
|
|
|
* @param string $typeId The session owner's ID
|
|
|
|
* @param AuthorizeParams $authParams The authorize request $_GET parameters
|
|
|
|
*
|
|
|
|
* @return string An authorisation code
|
|
|
|
*/
|
|
|
|
public function newAuthorizeRequest(string $type, string $typeId, AuthorizeParams $authParams): string {
|
|
|
|
// Create a new session
|
|
|
|
$session = new SessionEntity($this->server);
|
|
|
|
$session->setOwner($type, $typeId);
|
|
|
|
$session->associateClient($authParams->getClient());
|
|
|
|
|
|
|
|
// Create a new auth code
|
|
|
|
$authCode = new AuthCodeEntity($this->server);
|
|
|
|
$authCode->setId(SecureKey::generate());
|
|
|
|
$authCode->setRedirectUri($authParams->getRedirectUri());
|
|
|
|
$authCode->setExpireTime(time() + $this->authTokenTTL);
|
|
|
|
|
|
|
|
foreach ($authParams->getScopes() as $scope) {
|
|
|
|
$authCode->associateScope($scope);
|
|
|
|
$session->associateScope($scope);
|
|
|
|
}
|
|
|
|
|
|
|
|
$session->save();
|
|
|
|
$authCode->setSession($session);
|
|
|
|
$authCode->save();
|
|
|
|
|
|
|
|
return $authCode->generateRedirectUri($authParams->getState());
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Complete the auth code grant
|
|
|
|
*
|
|
|
|
* @return array
|
|
|
|
*
|
|
|
|
* @throws Exception\OAuthException
|
|
|
|
*/
|
|
|
|
public function completeFlow(): array {
|
|
|
|
// Get the required params
|
|
|
|
$clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
|
|
|
|
if ($clientId === null) {
|
|
|
|
throw new Exception\InvalidRequestException('client_id');
|
|
|
|
}
|
|
|
|
|
2018-04-18 02:17:25 +05:30
|
|
|
$clientSecret = $this->server->getRequest()->request->get(
|
|
|
|
'client_secret',
|
|
|
|
$this->server->getRequest()->getPassword()
|
|
|
|
);
|
2017-06-17 23:35:36 +05:30
|
|
|
if ($clientSecret === null && $this->shouldRequireClientSecret()) {
|
|
|
|
throw new Exception\InvalidRequestException('client_secret');
|
|
|
|
}
|
|
|
|
|
|
|
|
$redirectUri = $this->server->getRequest()->request->get('redirect_uri');
|
|
|
|
if ($redirectUri === null) {
|
|
|
|
throw new Exception\InvalidRequestException('redirect_uri');
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate client ID and client secret
|
|
|
|
$client = $this->server->getClientStorage()->get($clientId, $clientSecret, $redirectUri, $this->getIdentifier());
|
|
|
|
if (!$client instanceof BaseClientEntity) {
|
|
|
|
$this->server->getEventEmitter()->emit(new ClientAuthenticationFailedEvent($this->server->getRequest()));
|
|
|
|
throw new Exception\InvalidClientException();
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate the auth code
|
|
|
|
$authCode = $this->server->getRequest()->request->get('code');
|
|
|
|
if ($authCode === null) {
|
|
|
|
throw new Exception\InvalidRequestException('code');
|
|
|
|
}
|
|
|
|
|
|
|
|
$code = $this->server->getAuthCodeStorage()->get($authCode);
|
|
|
|
if (($code instanceof BaseAuthCodeEntity) === false) {
|
|
|
|
throw new Exception\InvalidRequestException('code');
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure the auth code hasn't expired
|
|
|
|
if ($code->isExpired()) {
|
|
|
|
throw new Exception\InvalidRequestException('code');
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check redirect URI presented matches redirect URI originally used in authorize request
|
|
|
|
if ($code->getRedirectUri() !== $redirectUri) {
|
|
|
|
throw new Exception\InvalidRequestException('redirect_uri');
|
|
|
|
}
|
|
|
|
|
|
|
|
$session = $code->getSession();
|
|
|
|
$session->associateClient($client);
|
|
|
|
|
|
|
|
$authCodeScopes = $code->getScopes();
|
|
|
|
|
|
|
|
// Generate the access token
|
|
|
|
$accessToken = new AccessTokenEntity($this->server);
|
2017-09-19 22:36:16 +05:30
|
|
|
$accessToken->setId(SecureKey::generate());
|
2017-06-17 23:35:36 +05:30
|
|
|
$accessToken->setExpireTime($this->getAccessTokenTTL() + time());
|
|
|
|
|
|
|
|
foreach ($authCodeScopes as $authCodeScope) {
|
|
|
|
$session->associateScope($authCodeScope);
|
|
|
|
}
|
|
|
|
|
|
|
|
foreach ($session->getScopes() as $scope) {
|
|
|
|
$accessToken->associateScope($scope);
|
|
|
|
}
|
|
|
|
|
|
|
|
$this->server->getTokenType()->setSession($session);
|
|
|
|
$this->server->getTokenType()->setParam('access_token', $accessToken->getId());
|
|
|
|
$this->server->getTokenType()->setParam('expires_in', $this->getAccessTokenTTL());
|
|
|
|
|
2019-07-15 04:29:56 +05:30
|
|
|
// Set refresh_token param only in case when offline_access requested
|
2017-09-19 22:36:16 +05:30
|
|
|
if (isset($accessToken->getScopes()[ScopeStorage::OFFLINE_ACCESS])) {
|
2017-06-17 23:35:36 +05:30
|
|
|
/** @var RefreshTokenGrant $refreshTokenGrant */
|
|
|
|
$refreshTokenGrant = $this->server->getGrantType('refresh_token');
|
|
|
|
$refreshToken = new RefreshTokenEntity($this->server);
|
|
|
|
$refreshToken->setId(SecureKey::generate());
|
|
|
|
$refreshToken->setExpireTime($refreshTokenGrant->getRefreshTokenTTL() + time());
|
|
|
|
$this->server->getTokenType()->setParam('refresh_token', $refreshToken->getId());
|
|
|
|
}
|
|
|
|
|
|
|
|
// Expire the auth code
|
|
|
|
$code->expire();
|
|
|
|
|
|
|
|
// Save all the things
|
|
|
|
$accessToken->setSession($session);
|
|
|
|
$accessToken->save();
|
|
|
|
|
|
|
|
if (isset($refreshToken)) {
|
|
|
|
$refreshToken->setAccessToken($accessToken);
|
|
|
|
$refreshToken->save();
|
|
|
|
}
|
|
|
|
|
|
|
|
return $this->server->getTokenType()->generateResponse();
|
2016-11-30 01:45:56 +05:30
|
|
|
}
|
|
|
|
|
2017-07-13 16:14:06 +05:30
|
|
|
/**
|
2019-07-15 04:29:56 +05:30
|
|
|
* In the earlier versions of Accounts Ely.by backend we had a comma-separated scopes
|
|
|
|
* list, while by OAuth2 standard it they should be separated by a space. Shit happens :)
|
|
|
|
* So override scopes validation function to reformat passed value.
|
2017-07-13 16:14:06 +05:30
|
|
|
*
|
|
|
|
* @param string $scopeParam
|
2017-09-19 22:36:16 +05:30
|
|
|
* @param BaseClientEntity $client
|
2017-07-13 16:14:06 +05:30
|
|
|
* @param string $redirectUri
|
|
|
|
*
|
|
|
|
* @return \League\OAuth2\Server\Entity\ScopeEntity[]
|
|
|
|
*/
|
2017-09-19 22:36:16 +05:30
|
|
|
public function validateScopes($scopeParam = '', BaseClientEntity $client, $redirectUri = null) {
|
2017-10-04 17:12:48 +05:30
|
|
|
return parent::validateScopes(Scopes::format($scopeParam), $client, $redirectUri);
|
2017-07-13 16:14:06 +05:30
|
|
|
}
|
|
|
|
|
2016-11-30 01:45:56 +05:30
|
|
|
}
|