mirror of
https://github.com/elyby/accounts.git
synced 2025-05-31 14:11:46 +05:30
Все реализации Grant'ов для oAuth перенесены в проект. Форк league/oauth2-client больше не используется
This commit is contained in:
ErickSkrauch
@ -1,67 +1,40 @@
|
||||
<?php
|
||||
namespace api\components\OAuth2;
|
||||
|
||||
use api\components\OAuth2\Storage\AuthCodeStorage;
|
||||
use api\components\OAuth2\Storage\RefreshTokenStorage;
|
||||
use api\components\OAuth2\Storage\AccessTokenStorage;
|
||||
use api\components\OAuth2\Storage\ClientStorage;
|
||||
use api\components\OAuth2\Storage\ScopeStorage;
|
||||
use api\components\OAuth2\Storage\SessionStorage;
|
||||
use api\components\OAuth2\Storage;
|
||||
use api\components\OAuth2\Utils\KeyAlgorithm\UuidAlgorithm;
|
||||
use League\OAuth2\Server\AuthorizationServer;
|
||||
use League\OAuth2\Server\Grant;
|
||||
use League\OAuth2\Server\Util\SecureKey;
|
||||
use yii\base\InvalidConfigException;
|
||||
use yii\base\Component as BaseComponent;
|
||||
|
||||
/**
|
||||
* @property AuthorizationServer $authServer
|
||||
*/
|
||||
class Component extends \yii\base\Component {
|
||||
class Component extends BaseComponent {
|
||||
|
||||
/**
|
||||
* @var AuthorizationServer
|
||||
*/
|
||||
private $_authServer;
|
||||
|
||||
/**
|
||||
* @var string[]
|
||||
*/
|
||||
public $grantTypes = [];
|
||||
|
||||
/**
|
||||
* @var array grant type => class
|
||||
*/
|
||||
public $grantMap = [
|
||||
'authorization_code' => Grant\AuthCodeGrant::class,
|
||||
'client_credentials' => Grant\ClientCredentialsGrant::class,
|
||||
'password' => Grant\PasswordGrant::class,
|
||||
'refresh_token' => Grant\RefreshTokenGrant::class,
|
||||
];
|
||||
|
||||
public function getAuthServer() {
|
||||
public function getAuthServer(): AuthorizationServer {
|
||||
if ($this->_authServer === null) {
|
||||
$authServer = new AuthorizationServer();
|
||||
$authServer->setAccessTokenStorage(new AccessTokenStorage());
|
||||
$authServer->setClientStorage(new ClientStorage());
|
||||
$authServer->setScopeStorage(new ScopeStorage());
|
||||
$authServer->setSessionStorage(new SessionStorage());
|
||||
$authServer->setAuthCodeStorage(new AuthCodeStorage());
|
||||
$authServer->setRefreshTokenStorage(new RefreshTokenStorage());
|
||||
$authServer->setAccessTokenStorage(new Storage\AccessTokenStorage());
|
||||
$authServer->setClientStorage(new Storage\ClientStorage());
|
||||
$authServer->setScopeStorage(new Storage\ScopeStorage());
|
||||
$authServer->setSessionStorage(new Storage\SessionStorage());
|
||||
$authServer->setAuthCodeStorage(new Storage\AuthCodeStorage());
|
||||
$authServer->setRefreshTokenStorage(new Storage\RefreshTokenStorage());
|
||||
$authServer->setScopeDelimiter(',');
|
||||
$authServer->setAccessTokenTTL(86400); // 1d
|
||||
|
||||
$authServer->addGrantType(new Grants\AuthCodeGrant());
|
||||
$authServer->addGrantType(new Grants\RefreshTokenGrant());
|
||||
$authServer->addGrantType(new Grants\ClientCredentialsGrant());
|
||||
|
||||
$this->_authServer = $authServer;
|
||||
|
||||
foreach ($this->grantTypes as $grantType) {
|
||||
if (!isset($this->grantMap[$grantType])) {
|
||||
throw new InvalidConfigException('Invalid grant type');
|
||||
}
|
||||
|
||||
/** @var Grant\GrantTypeInterface $grant */
|
||||
$grant = new $this->grantMap[$grantType]();
|
||||
$this->_authServer->addGrantType($grant);
|
||||
}
|
||||
|
||||
SecureKey::setAlgorithm(new UuidAlgorithm());
|
||||
}
|
||||
|
||||
|
||||
@ -1,21 +1,221 @@
|
||||
<?php
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\Entities;
|
||||
use League\OAuth2\Server\Entity\ClientEntity;
|
||||
use api\components\OAuth2\Entities\AccessTokenEntity;
|
||||
use api\components\OAuth2\Entities\AuthCodeEntity;
|
||||
use api\components\OAuth2\Entities\ClientEntity;
|
||||
use api\components\OAuth2\Entities\RefreshTokenEntity;
|
||||
use api\components\OAuth2\Entities\SessionEntity;
|
||||
use common\models\OauthScope;
|
||||
use League\OAuth2\Server\Entity\AuthCodeEntity as BaseAuthCodeEntity;
|
||||
use League\OAuth2\Server\Entity\ClientEntity as BaseClientEntity;
|
||||
use League\OAuth2\Server\Event\ClientAuthenticationFailedEvent;
|
||||
use League\OAuth2\Server\Exception;
|
||||
use League\OAuth2\Server\Grant\AbstractGrant;
|
||||
use League\OAuth2\Server\Util\SecureKey;
|
||||
|
||||
class AuthCodeGrant extends \League\OAuth2\Server\Grant\AuthCodeGrant {
|
||||
class AuthCodeGrant extends AbstractGrant {
|
||||
|
||||
protected function createAccessTokenEntity() {
|
||||
return new Entities\AccessTokenEntity($this->server);
|
||||
protected $identifier = 'authorization_code';
|
||||
|
||||
protected $responseType = 'code';
|
||||
|
||||
protected $authTokenTTL = 600;
|
||||
|
||||
protected $requireClientSecret = true;
|
||||
|
||||
public function setAuthTokenTTL(int $authTokenTTL): void {
|
||||
$this->authTokenTTL = $authTokenTTL;
|
||||
}
|
||||
|
||||
protected function createRefreshTokenEntity() {
|
||||
return new Entities\RefreshTokenEntity($this->server);
|
||||
public function setRequireClientSecret(bool $required): void {
|
||||
$this->requireClientSecret = $required;
|
||||
}
|
||||
|
||||
protected function createSessionEntity() {
|
||||
return new Entities\SessionEntity($this->server);
|
||||
public function shouldRequireClientSecret(): bool {
|
||||
return $this->requireClientSecret;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check authorize parameters
|
||||
*
|
||||
* @return AuthorizeParams Authorize request parameters
|
||||
* @throws Exception\OAuthException
|
||||
*
|
||||
* @throws
|
||||
*/
|
||||
public function checkAuthorizeParams(): AuthorizeParams {
|
||||
// Get required params
|
||||
$clientId = $this->server->getRequest()->query->get('client_id');
|
||||
if ($clientId === null) {
|
||||
throw new Exception\InvalidRequestException('client_id');
|
||||
}
|
||||
|
||||
$redirectUri = $this->server->getRequest()->query->get('redirect_uri');
|
||||
if ($redirectUri === null) {
|
||||
throw new Exception\InvalidRequestException('redirect_uri');
|
||||
}
|
||||
|
||||
// Validate client ID and redirect URI
|
||||
$client = $this->server->getClientStorage()->get($clientId, null, $redirectUri, $this->getIdentifier());
|
||||
if (!$client instanceof ClientEntity) {
|
||||
$this->server->getEventEmitter()->emit(new ClientAuthenticationFailedEvent($this->server->getRequest()));
|
||||
throw new Exception\InvalidClientException();
|
||||
}
|
||||
|
||||
$state = $this->server->getRequest()->query->get('state');
|
||||
if ($state === null && $this->server->stateParamRequired()) {
|
||||
throw new Exception\InvalidRequestException('state', $redirectUri);
|
||||
}
|
||||
|
||||
$responseType = $this->server->getRequest()->query->get('response_type');
|
||||
if ($responseType === null) {
|
||||
throw new Exception\InvalidRequestException('response_type', $redirectUri);
|
||||
}
|
||||
|
||||
// Ensure response type is one that is recognised
|
||||
if (!in_array($responseType, $this->server->getResponseTypes(), true)) {
|
||||
throw new Exception\UnsupportedResponseTypeException($responseType, $redirectUri);
|
||||
}
|
||||
|
||||
// Validate any scopes that are in the request
|
||||
$scopeParam = $this->server->getRequest()->query->get('scope', '');
|
||||
$scopes = $this->validateScopes($scopeParam, $client, $redirectUri);
|
||||
|
||||
return new AuthorizeParams($client, $redirectUri, $state, $responseType, $scopes);
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse a new authorize request
|
||||
*
|
||||
* @param string $type The session owner's type
|
||||
* @param string $typeId The session owner's ID
|
||||
* @param AuthorizeParams $authParams The authorize request $_GET parameters
|
||||
*
|
||||
* @return string An authorisation code
|
||||
*/
|
||||
public function newAuthorizeRequest(string $type, string $typeId, AuthorizeParams $authParams): string {
|
||||
// Create a new session
|
||||
$session = new SessionEntity($this->server);
|
||||
$session->setOwner($type, $typeId);
|
||||
$session->associateClient($authParams->getClient());
|
||||
|
||||
// Create a new auth code
|
||||
$authCode = new AuthCodeEntity($this->server);
|
||||
$authCode->setId(SecureKey::generate());
|
||||
$authCode->setRedirectUri($authParams->getRedirectUri());
|
||||
$authCode->setExpireTime(time() + $this->authTokenTTL);
|
||||
|
||||
foreach ($authParams->getScopes() as $scope) {
|
||||
$authCode->associateScope($scope);
|
||||
$session->associateScope($scope);
|
||||
}
|
||||
|
||||
$session->save();
|
||||
$authCode->setSession($session);
|
||||
$authCode->save();
|
||||
|
||||
return $authCode->generateRedirectUri($authParams->getState());
|
||||
}
|
||||
|
||||
/**
|
||||
* Complete the auth code grant
|
||||
*
|
||||
* @return array
|
||||
*
|
||||
* @throws Exception\OAuthException
|
||||
*/
|
||||
public function completeFlow(): array {
|
||||
// Get the required params
|
||||
$clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
|
||||
if ($clientId === null) {
|
||||
throw new Exception\InvalidRequestException('client_id');
|
||||
}
|
||||
|
||||
$clientSecret = $this->server->getRequest()->request->get('client_secret',
|
||||
$this->server->getRequest()->getPassword());
|
||||
if ($clientSecret === null && $this->shouldRequireClientSecret()) {
|
||||
throw new Exception\InvalidRequestException('client_secret');
|
||||
}
|
||||
|
||||
$redirectUri = $this->server->getRequest()->request->get('redirect_uri');
|
||||
if ($redirectUri === null) {
|
||||
throw new Exception\InvalidRequestException('redirect_uri');
|
||||
}
|
||||
|
||||
// Validate client ID and client secret
|
||||
$client = $this->server->getClientStorage()->get($clientId, $clientSecret, $redirectUri, $this->getIdentifier());
|
||||
if (!$client instanceof BaseClientEntity) {
|
||||
$this->server->getEventEmitter()->emit(new ClientAuthenticationFailedEvent($this->server->getRequest()));
|
||||
throw new Exception\InvalidClientException();
|
||||
}
|
||||
|
||||
// Validate the auth code
|
||||
$authCode = $this->server->getRequest()->request->get('code');
|
||||
if ($authCode === null) {
|
||||
throw new Exception\InvalidRequestException('code');
|
||||
}
|
||||
|
||||
$code = $this->server->getAuthCodeStorage()->get($authCode);
|
||||
if (($code instanceof BaseAuthCodeEntity) === false) {
|
||||
throw new Exception\InvalidRequestException('code');
|
||||
}
|
||||
|
||||
// Ensure the auth code hasn't expired
|
||||
if ($code->isExpired()) {
|
||||
throw new Exception\InvalidRequestException('code');
|
||||
}
|
||||
|
||||
// Check redirect URI presented matches redirect URI originally used in authorize request
|
||||
if ($code->getRedirectUri() !== $redirectUri) {
|
||||
throw new Exception\InvalidRequestException('redirect_uri');
|
||||
}
|
||||
|
||||
$session = $code->getSession();
|
||||
$session->associateClient($client);
|
||||
|
||||
$authCodeScopes = $code->getScopes();
|
||||
|
||||
// Generate the access token
|
||||
$accessToken = new AccessTokenEntity($this->server);
|
||||
$accessToken->setId(SecureKey::generate()); // TODO: generate code based on permissions
|
||||
$accessToken->setExpireTime($this->getAccessTokenTTL() + time());
|
||||
|
||||
foreach ($authCodeScopes as $authCodeScope) {
|
||||
$session->associateScope($authCodeScope);
|
||||
}
|
||||
|
||||
foreach ($session->getScopes() as $scope) {
|
||||
$accessToken->associateScope($scope);
|
||||
}
|
||||
|
||||
$this->server->getTokenType()->setSession($session);
|
||||
$this->server->getTokenType()->setParam('access_token', $accessToken->getId());
|
||||
$this->server->getTokenType()->setParam('expires_in', $this->getAccessTokenTTL());
|
||||
|
||||
// Выдаём refresh_token, если запрошен offline_access
|
||||
if (isset($accessToken->getScopes()[OauthScope::OFFLINE_ACCESS])) {
|
||||
/** @var RefreshTokenGrant $refreshTokenGrant */
|
||||
$refreshTokenGrant = $this->server->getGrantType('refresh_token');
|
||||
$refreshToken = new RefreshTokenEntity($this->server);
|
||||
$refreshToken->setId(SecureKey::generate());
|
||||
$refreshToken->setExpireTime($refreshTokenGrant->getRefreshTokenTTL() + time());
|
||||
$this->server->getTokenType()->setParam('refresh_token', $refreshToken->getId());
|
||||
}
|
||||
|
||||
// Expire the auth code
|
||||
$code->expire();
|
||||
|
||||
// Save all the things
|
||||
$accessToken->setSession($session);
|
||||
$accessToken->save();
|
||||
|
||||
if (isset($refreshToken)) {
|
||||
$refreshToken->setAccessToken($accessToken);
|
||||
$refreshToken->save();
|
||||
}
|
||||
|
||||
return $this->server->getTokenType()->generateResponse();
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
58
api/components/OAuth2/Grants/AuthorizeParams.php
Normal file
58
api/components/OAuth2/Grants/AuthorizeParams.php
Normal file
@ -0,0 +1,58 @@
|
||||
<?php
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\Entities\ClientEntity;
|
||||
|
||||
class AuthorizeParams {
|
||||
|
||||
private $client;
|
||||
|
||||
private $redirectUri;
|
||||
|
||||
private $state;
|
||||
|
||||
private $responseType;
|
||||
|
||||
/**
|
||||
* @var \api\components\OAuth2\Entities\ScopeEntity[]
|
||||
*/
|
||||
private $scopes;
|
||||
|
||||
public function __construct(
|
||||
ClientEntity $client,
|
||||
string $redirectUri,
|
||||
?string $state,
|
||||
string $responseType,
|
||||
array $scopes
|
||||
) {
|
||||
$this->client = $client;
|
||||
$this->redirectUri = $redirectUri;
|
||||
$this->state = $state;
|
||||
$this->responseType = $responseType;
|
||||
$this->scopes = $scopes;
|
||||
}
|
||||
|
||||
public function getClient(): ClientEntity {
|
||||
return $this->client;
|
||||
}
|
||||
|
||||
public function getRedirectUri(): string {
|
||||
return $this->redirectUri;
|
||||
}
|
||||
|
||||
public function getState(): ?string {
|
||||
return $this->state;
|
||||
}
|
||||
|
||||
public function getResponseType(): string {
|
||||
return $this->responseType;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return \api\components\OAuth2\Entities\ScopeEntity[]
|
||||
*/
|
||||
public function getScopes(): array {
|
||||
return $this->scopes ?? [];
|
||||
}
|
||||
|
||||
}
|
||||
@ -1,21 +1,72 @@
|
||||
<?php
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\Entities;
|
||||
use League\OAuth2\Server\Entity\ClientEntity;
|
||||
use api\components\OAuth2\Entities\AccessTokenEntity;
|
||||
use api\components\OAuth2\Entities\SessionEntity;
|
||||
use League\OAuth2\Server\Entity\ClientEntity as BaseClientEntity;
|
||||
use League\OAuth2\Server\Event;
|
||||
use League\OAuth2\Server\Exception;
|
||||
use League\OAuth2\Server\Grant\AbstractGrant;
|
||||
use League\OAuth2\Server\Util\SecureKey;
|
||||
|
||||
class ClientCredentialsGrant extends \League\OAuth2\Server\Grant\ClientCredentialsGrant {
|
||||
class ClientCredentialsGrant extends AbstractGrant {
|
||||
|
||||
protected function createAccessTokenEntity() {
|
||||
return new Entities\AccessTokenEntity($this->server);
|
||||
}
|
||||
protected $identifier = 'client_credentials';
|
||||
|
||||
protected function createRefreshTokenEntity() {
|
||||
return new Entities\RefreshTokenEntity($this->server);
|
||||
}
|
||||
/**
|
||||
* @return array
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthException
|
||||
*/
|
||||
public function completeFlow(): array {
|
||||
// Get the required params
|
||||
$clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
|
||||
if ($clientId === null) {
|
||||
throw new Exception\InvalidRequestException('client_id');
|
||||
}
|
||||
|
||||
protected function createSessionEntity() {
|
||||
return new Entities\SessionEntity($this->server);
|
||||
$clientSecret = $this->server->getRequest()->request->get('client_secret',
|
||||
$this->server->getRequest()->getPassword());
|
||||
if ($clientSecret === null) {
|
||||
throw new Exception\InvalidRequestException('client_secret');
|
||||
}
|
||||
|
||||
// Validate client ID and client secret
|
||||
$client = $this->server->getClientStorage()->get($clientId, $clientSecret, null, $this->getIdentifier());
|
||||
if (!$client instanceof BaseClientEntity) {
|
||||
$this->server->getEventEmitter()->emit(new Event\ClientAuthenticationFailedEvent($this->server->getRequest()));
|
||||
throw new Exception\InvalidClientException();
|
||||
}
|
||||
|
||||
// Validate any scopes that are in the request
|
||||
$scopeParam = $this->server->getRequest()->request->get('scope', '');
|
||||
$scopes = $this->validateScopes($scopeParam, $client);
|
||||
|
||||
// Create a new session
|
||||
$session = new SessionEntity($this->server);
|
||||
$session->setOwner('client', $client->getId());
|
||||
$session->associateClient($client);
|
||||
|
||||
// Generate an access token
|
||||
$accessToken = new AccessTokenEntity($this->server);
|
||||
$accessToken->setId(SecureKey::generate());
|
||||
$accessToken->setExpireTime($this->getAccessTokenTTL() + time());
|
||||
|
||||
// Associate scopes with the session and access token
|
||||
foreach ($scopes as $scope) {
|
||||
$session->associateScope($scope);
|
||||
$accessToken->associateScope($scope);
|
||||
}
|
||||
|
||||
// Save everything
|
||||
$session->save();
|
||||
$accessToken->setSession($session);
|
||||
$accessToken->save();
|
||||
|
||||
$this->server->getTokenType()->setSession($session);
|
||||
$this->server->getTokenType()->setParam('access_token', $accessToken->getId());
|
||||
$this->server->getTokenType()->setParam('expires_in', $this->getAccessTokenTTL());
|
||||
|
||||
return $this->server->getTokenType()->generateResponse();
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@ -1,29 +1,49 @@
|
||||
<?php
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\Entities;
|
||||
use api\components\OAuth2\Entities\AccessTokenEntity;
|
||||
use api\components\OAuth2\Entities\RefreshTokenEntity;
|
||||
use ErrorException;
|
||||
use League\OAuth2\Server\Entity\ClientEntity as OriginalClientEntity;
|
||||
use League\OAuth2\Server\Entity\ClientEntity;
|
||||
use League\OAuth2\Server\Entity\RefreshTokenEntity as OriginalRefreshTokenEntity;
|
||||
use League\OAuth2\Server\Event;
|
||||
use League\OAuth2\Server\Entity\AccessTokenEntity as BaseAccessTokenEntity;
|
||||
use League\OAuth2\Server\Entity\ClientEntity as BaseClientEntity;
|
||||
use League\OAuth2\Server\Entity\RefreshTokenEntity as BaseRefreshTokenEntity;
|
||||
use League\OAuth2\Server\Event\ClientAuthenticationFailedEvent;
|
||||
use League\OAuth2\Server\Exception;
|
||||
use League\OAuth2\Server\Grant\AbstractGrant;
|
||||
use League\OAuth2\Server\Util\SecureKey;
|
||||
|
||||
class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
class RefreshTokenGrant extends AbstractGrant {
|
||||
|
||||
public $refreshTokenRotate = false;
|
||||
protected $identifier = 'refresh_token';
|
||||
|
||||
protected function createAccessTokenEntity() {
|
||||
return new Entities\AccessTokenEntity($this->server);
|
||||
protected $refreshTokenTTL = 604800;
|
||||
|
||||
protected $refreshTokenRotate = false;
|
||||
|
||||
protected $requireClientSecret = true;
|
||||
|
||||
public function setRefreshTokenTTL($refreshTokenTTL): void {
|
||||
$this->refreshTokenTTL = $refreshTokenTTL;
|
||||
}
|
||||
|
||||
protected function createRefreshTokenEntity() {
|
||||
return new Entities\RefreshTokenEntity($this->server);
|
||||
public function getRefreshTokenTTL(): int {
|
||||
return $this->refreshTokenTTL;
|
||||
}
|
||||
|
||||
protected function createSessionEntity() {
|
||||
return new Entities\SessionEntity($this->server);
|
||||
public function setRefreshTokenRotation(bool $refreshTokenRotate = true): void {
|
||||
$this->refreshTokenRotate = $refreshTokenRotate;
|
||||
}
|
||||
|
||||
public function shouldRotateRefreshTokens(): bool {
|
||||
return $this->refreshTokenRotate;
|
||||
}
|
||||
|
||||
public function setRequireClientSecret(string $required): void {
|
||||
$this->requireClientSecret = $required;
|
||||
}
|
||||
|
||||
public function shouldRequireClientSecret(): bool {
|
||||
return $this->requireClientSecret;
|
||||
}
|
||||
|
||||
/**
|
||||
@ -47,10 +67,11 @@ class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
* Поэтому мы расширили логику RefreshTokenEntity и она теперь знает о сессии, в рамках которой была создана
|
||||
*
|
||||
* @inheritdoc
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthException
|
||||
*/
|
||||
public function completeFlow() {
|
||||
public function completeFlow(): array {
|
||||
$clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
|
||||
if (is_null($clientId)) {
|
||||
if ($clientId === null) {
|
||||
throw new Exception\InvalidRequestException('client_id');
|
||||
}
|
||||
|
||||
@ -58,31 +79,25 @@ class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
'client_secret',
|
||||
$this->server->getRequest()->getPassword()
|
||||
);
|
||||
if ($this->shouldRequireClientSecret() && is_null($clientSecret)) {
|
||||
if ($clientSecret === null && $this->shouldRequireClientSecret()) {
|
||||
throw new Exception\InvalidRequestException('client_secret');
|
||||
}
|
||||
|
||||
// Validate client ID and client secret
|
||||
$client = $this->server->getClientStorage()->get(
|
||||
$clientId,
|
||||
$clientSecret,
|
||||
null,
|
||||
$this->getIdentifier()
|
||||
);
|
||||
|
||||
if (($client instanceof OriginalClientEntity) === false) {
|
||||
$this->server->getEventEmitter()->emit(new Event\ClientAuthenticationFailedEvent($this->server->getRequest()));
|
||||
$client = $this->server->getClientStorage()->get($clientId, $clientSecret, null, $this->getIdentifier());
|
||||
if (($client instanceof BaseClientEntity) === false) {
|
||||
$this->server->getEventEmitter()->emit(new ClientAuthenticationFailedEvent($this->server->getRequest()));
|
||||
throw new Exception\InvalidClientException();
|
||||
}
|
||||
|
||||
$oldRefreshTokenParam = $this->server->getRequest()->request->get('refresh_token', null);
|
||||
$oldRefreshTokenParam = $this->server->getRequest()->request->get('refresh_token');
|
||||
if ($oldRefreshTokenParam === null) {
|
||||
throw new Exception\InvalidRequestException('refresh_token');
|
||||
}
|
||||
|
||||
// Validate refresh token
|
||||
$oldRefreshToken = $this->server->getRefreshTokenStorage()->get($oldRefreshTokenParam);
|
||||
if (($oldRefreshToken instanceof OriginalRefreshTokenEntity) === false) {
|
||||
if (($oldRefreshToken instanceof BaseRefreshTokenEntity) === false) {
|
||||
throw new Exception\InvalidRefreshException();
|
||||
}
|
||||
|
||||
@ -91,14 +106,15 @@ class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
throw new Exception\InvalidRefreshException();
|
||||
}
|
||||
|
||||
/** @var Entities\AccessTokenEntity|null $oldAccessToken */
|
||||
/** @var AccessTokenEntity|null $oldAccessToken */
|
||||
$oldAccessToken = $oldRefreshToken->getAccessToken();
|
||||
if ($oldAccessToken instanceof Entities\AccessTokenEntity) {
|
||||
if ($oldAccessToken instanceof AccessTokenEntity) {
|
||||
// Get the scopes for the original session
|
||||
$session = $oldAccessToken->getSession();
|
||||
} else {
|
||||
if (!$oldRefreshToken instanceof Entities\RefreshTokenEntity) {
|
||||
throw new ErrorException('oldRefreshToken must be instance of ' . Entities\RefreshTokenEntity::class);
|
||||
if (!$oldRefreshToken instanceof RefreshTokenEntity) {
|
||||
/** @noinspection ExceptionsAnnotatingAndHandlingInspection */
|
||||
throw new ErrorException('oldRefreshToken must be instance of ' . RefreshTokenEntity::class);
|
||||
}
|
||||
|
||||
$session = $oldRefreshToken->getSession();
|
||||
@ -126,8 +142,8 @@ class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
}
|
||||
|
||||
// Generate a new access token and assign it the correct sessions
|
||||
$newAccessToken = $this->createAccessTokenEntity();
|
||||
$newAccessToken->setId(SecureKey::generate());
|
||||
$newAccessToken = new AccessTokenEntity($this->server);
|
||||
$newAccessToken->setId(SecureKey::generate()); // TODO: generate based on permissions
|
||||
$newAccessToken->setExpireTime($this->getAccessTokenTTL() + time());
|
||||
$newAccessToken->setSession($session);
|
||||
|
||||
@ -136,7 +152,7 @@ class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
}
|
||||
|
||||
// Expire the old token and save the new one
|
||||
($oldAccessToken instanceof Entities\AccessTokenEntity) && $oldAccessToken->expire();
|
||||
$oldAccessToken instanceof BaseAccessTokenEntity && $oldAccessToken->expire();
|
||||
$newAccessToken->save();
|
||||
|
||||
$this->server->getTokenType()->setSession($session);
|
||||
@ -148,7 +164,7 @@ class RefreshTokenGrant extends \League\OAuth2\Server\Grant\RefreshTokenGrant {
|
||||
$oldRefreshToken->expire();
|
||||
|
||||
// Generate a new refresh token
|
||||
$newRefreshToken = $this->createRefreshTokenEntity();
|
||||
$newRefreshToken = new RefreshTokenEntity($this->server);
|
||||
$newRefreshToken->setId(SecureKey::generate());
|
||||
$newRefreshToken->setExpireTime($this->getRefreshTokenTTL() + time());
|
||||
$newRefreshToken->setAccessToken($newAccessToken);
|
||||
|
||||
Reference in New Issue
Block a user