ElyBy-Mirror/accounts
1
0
Fork 0
mirror of https://github.com/elyby/accounts.git synced 2025-05-31 14:11:46 +05:30
Code Issues Packages Projects Releases Wiki Activity

Allow users to manually decline auth request even when an application was authenticated before

Browse Source
This commit is contained in:
ErickSkrauch
2021-03-29 04:47:27 +02:00
parent 65284727ba
commit e6b6f3f169
2 changed files with 17 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
api/modules/oauth/models/OauthProcess.php
View File

@@ -25,10 +25,7 @@ class OauthProcess {
P::OBTAIN_ACCOUNT_EMAIL => 'account_email',
];
/**
* @var AuthorizationServer
*/
private $server;
private AuthorizationServer $server;
public function __construct(AuthorizationServer $server) {
$this->server = $server;
@@ -96,19 +93,22 @@ class OauthProcess {
/** @var OauthClient $client */
$client = $this->findClient($authRequest->getClient()->getIdentifier());
$approved = $this->canAutoApprove($account, $client, $authRequest);
if (!$approved) {
Yii::$app->statsd->inc('oauth.complete.approve_required');
$canBeAutoApproved = $this->canBeAutoApproved($account, $client, $authRequest);
$acceptParam = ((array)$request->getParsedBody())['accept'] ?? null;
if ($acceptParam === null && !$canBeAutoApproved) {
throw $this->createAcceptRequiredException();
}
$acceptParam = ((array)$request->getParsedBody())['accept'] ?? null;
if ($acceptParam === null) {
throw $this->createAcceptRequiredException();
}
Yii::$app->statsd->inc('oauth.complete.approve_required');
if ($acceptParam === null && $canBeAutoApproved) {
$approved = true;
} else {
$approved = in_array($acceptParam, [1, '1', true, 'true'], true);
if ($approved) {
$this->storeOauthSession($account, $client, $authRequest);
}
}
if ($approved) {
$this->storeOauthSession($account, $client, $authRequest);
}
$authRequest->setUser(new UserEntity($account->id));
@@ -123,6 +123,7 @@ class OauthProcess {
Yii::$app->statsd->inc('oauth.complete.success');
} catch (OAuthServerException $e) {
if ($e->getErrorType() === 'accept_required') {
// TODO: revoke access if there previously was an oauth session?
Yii::$app->statsd->inc('oauth.complete.fail');
}
@@ -213,7 +214,7 @@ class OauthProcess {
*
* @return bool
*/
private function canAutoApprove(Account $account, OauthClient $client, AuthorizationRequest $request): bool {
private function canBeAutoApproved(Account $account, OauthClient $client, AuthorizationRequest $request): bool {
if ($client->is_trusted) {
return true;
}