From 44ff8692dcf1b6c34790c455251ba93641b2be93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juli=C3=A1n=20Guti=C3=A9rrez?= Date: Sun, 17 Jan 2016 00:41:55 +0100 Subject: [PATCH] abstract common grants tasks --- src/Grant/AbstractGrant.php | 111 ++++++++++++++++ src/Grant/ClientCredentialsGrant.php | 71 +---------- src/Grant/PasswordGrant.php | 137 ++++++-------------- src/Grant/RefreshTokenGrant.php | 182 ++++++++++----------------- 4 files changed, 223 insertions(+), 278 deletions(-) diff --git a/src/Grant/AbstractGrant.php b/src/Grant/AbstractGrant.php index a51d18e0..0753b792 100644 --- a/src/Grant/AbstractGrant.php +++ b/src/Grant/AbstractGrant.php @@ -12,12 +12,16 @@ namespace League\OAuth2\Server\Grant; use League\Event\EmitterInterface; +use League\Event\Event; +use League\OAuth2\Server\Entities\AccessTokenEntity; use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface; +use League\OAuth2\Server\Entities\RefreshTokenEntity; use League\OAuth2\Server\Entities\ScopeEntity; use League\OAuth2\Server\Exception\OAuthServerException; use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface; use League\OAuth2\Server\Repositories\ClientRepositoryInterface; use League\OAuth2\Server\Repositories\ScopeRepositoryInterface; +use League\OAuth2\Server\Utils\SecureKey; use Psr\Http\Message\ServerRequestInterface; /** @@ -95,6 +99,60 @@ abstract class AbstractGrant implements GrantTypeInterface return $this->respondsWith; } + /** + * @param \Psr\Http\Message\ServerRequestInterface $request + * + * @return \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface + * + * @throws \League\OAuth2\Server\Exception\OAuthServerException + */ + protected function validateClient(ServerRequestInterface $request) + { + $clientId = $this->getRequestParameter(['client_id', 'PHP_AUTH_USER'], $request); + if (is_null($clientId)) { + throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing'); + } + + $clientSecret = $this->getRequestParameter(['client_secret', 'PHP_AUTH_PW'], $request); + if (is_null($clientSecret)) { + throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing'); + } + + $client = $this->clientRepository->getClientEntity( + $clientId, + $clientSecret, + null, + $this->getIdentifier() + ); + + if (!$client instanceof ClientEntityInterface) { + $this->emitter->emit(new Event('client.authentication.failed', $request)); + + throw OAuthServerException::invalidClient(); + } + + return $client; + } + + /** + * Retrieve request parameter. + * + * @param string|array $parameter + * @param \Psr\Http\Message\ServerRequestInterface $request + * + * @return string|null + */ + protected function getRequestParameter($parameter, ServerRequestInterface $request) + { + foreach ((array) $parameter as $param) { + if (isset($request->getParsedBody()[$param])) { + return $request->getParsedBody()[$param]; + } + } + + return null; + } + /** * @param string $scopeParamValue A string containing a delimited set of scope identifiers * @param string $scopeDelimiterString The delimiter between the scopes in the value string @@ -142,4 +200,57 @@ abstract class AbstractGrant implements GrantTypeInterface { $this->emitter = $emitter; } + + /** + * @param \DateInterval $tokenTTL + * @param \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface $client + * @param string $userIdentifier + * @param array $scopes + * + * @return \League\OAuth2\Server\Entities\AccessTokenEntity + */ + protected function issueAccessToken( + \DateInterval $tokenTTL, + ClientEntityInterface $client, + $userIdentifier, + array $scopes = [] + ) { + $accessToken = new AccessTokenEntity(); + $accessToken->setIdentifier(SecureKey::generate()); + $accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL)); + $accessToken->setClient($client); + $accessToken->setUserIdentifier($userIdentifier); + + foreach ($scopes as $scope) { + $accessToken->addScope($scope); + } + + return $accessToken; + } + + /** + * @param \League\OAuth2\Server\Entities\AccessTokenEntity $accessToken + * + * @return \League\OAuth2\Server\Entities\RefreshTokenEntity + */ + protected function issueRefreshToken(AccessTokenEntity $accessToken) + { + $refreshToken = new RefreshTokenEntity(); + $refreshToken->setIdentifier(SecureKey::generate()); + $refreshToken->setExpiryDateTime((new \DateTime())->add(new \DateInterval('P1M'))); + $refreshToken->setAccessToken($accessToken); + + return $refreshToken; + } + + /** + * @inheritdoc + */ + public function canRespondToRequest(ServerRequestInterface $request) + { + return ( + isset($request->getParsedBody()['grant_type']) + && $request->getParsedBody()['grant_type'] === $this->identifier + ); + } } diff --git a/src/Grant/ClientCredentialsGrant.php b/src/Grant/ClientCredentialsGrant.php index 7ae88aa7..70f70a9c 100644 --- a/src/Grant/ClientCredentialsGrant.php +++ b/src/Grant/ClientCredentialsGrant.php @@ -11,13 +11,9 @@ namespace League\OAuth2\Server\Grant; -use DateInterval; -use League\Event\Event; -use League\OAuth2\Server\Entities\AccessTokenEntity; use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface; use League\OAuth2\Server\Exception\OAuthServerException; use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface; -use League\OAuth2\Server\Utils\SecureKey; use Psr\Http\Message\ServerRequestInterface; /** @@ -38,62 +34,14 @@ class ClientCredentialsGrant extends AbstractGrant public function respondToRequest( ServerRequestInterface $request, ResponseTypeInterface $responseType, - DateInterval $accessTokenTTL, + \DateInterval $tokenTTL, $scopeDelimiter = ' ' ) { - // Get the required params - $clientId = isset($request->getParsedBody()['client_id']) - ? $request->getParsedBody()['client_id'] // $_POST['client_id'] - : (isset($request->getServerParams()['PHP_AUTH_USER']) - ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER'] - : null); + $client = $this->validateClient($request); + $scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client); - if (is_null($clientId)) { - throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing'); - } + $accessToken = $this->issueAccessToken($tokenTTL, $client, $client->getIdentifier(), $scopes); - $clientSecret = isset($request->getParsedBody()['client_secret']) - ? $request->getParsedBody()['client_secret'] // $_POST['client_id'] - : (isset($request->getServerParams()['PHP_AUTH_PW']) - ? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER'] - : null); - - if (is_null($clientSecret)) { - throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing'); - } - - // Validate client ID and client secret - $client = $this->clientRepository->getClientEntity( - $clientId, - $clientSecret, - null, - $this->getIdentifier() - ); - - if (($client instanceof ClientEntityInterface) === false) { - $this->emitter->emit(new Event('client.authentication.failed', $request)); - throw OAuthServerException::invalidClient(); - } - - // Validate any scopes that are in the request - $scopeParam = isset($request->getParsedBody()['scope']) - ? $request->getParsedBody()['scope'] // $_POST['scope'] - : ''; - $scopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client); - - // Generate an access token - $accessToken = new AccessTokenEntity(); - $accessToken->setIdentifier(SecureKey::generate()); - $accessToken->setExpiryDateTime((new \DateTime())->add($accessTokenTTL)); - $accessToken->setClient($client); - $accessToken->setUserIdentifier($client->getIdentifier()); - - // Associate scopes with the session and access token - foreach ($scopes as $scope) { - $accessToken->addScope($scope); - } - - // Save the token $this->accessTokenRepository->persistNewAccessToken($accessToken); // Inject access token into token type @@ -101,15 +49,4 @@ class ClientCredentialsGrant extends AbstractGrant return $responseType; } - - /** - * @inheritdoc - */ - public function canRespondToRequest(ServerRequestInterface $request) - { - return ( - array_key_exists('grant_type', $request->getParsedBody()) - && $request->getParsedBody()['grant_type'] === 'client_credentials' - ); - } } diff --git a/src/Grant/PasswordGrant.php b/src/Grant/PasswordGrant.php index fee9d798..c948bc6d 100644 --- a/src/Grant/PasswordGrant.php +++ b/src/Grant/PasswordGrant.php @@ -11,12 +11,9 @@ namespace League\OAuth2\Server\Grant; -use DateInterval; use League\Event\Event; -use League\OAuth2\Server\Entities\AccessTokenEntity; use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface; use League\OAuth2\Server\Entities\Interfaces\UserEntityInterface; -use League\OAuth2\Server\Entities\RefreshTokenEntity; use League\OAuth2\Server\Exception\OAuthServerException; use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface; use League\OAuth2\Server\Repositories\ClientRepositoryInterface; @@ -24,7 +21,6 @@ use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface; use League\OAuth2\Server\Repositories\ScopeRepositoryInterface; use League\OAuth2\Server\Repositories\UserRepositoryInterface; use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface; -use League\OAuth2\Server\Utils\SecureKey; use Psr\Http\Message\ServerRequestInterface; /** @@ -32,6 +28,13 @@ use Psr\Http\Message\ServerRequestInterface; */ class PasswordGrant extends AbstractGrant { + /** + * Grant identifier + * + * @var string + */ + protected $identifier = 'password'; + /** * @var \League\OAuth2\Server\Repositories\UserRepositoryInterface */ @@ -56,9 +59,10 @@ class PasswordGrant extends AbstractGrant AccessTokenRepositoryInterface $accessTokenRepository, RefreshTokenRepositoryInterface $refreshTokenRepository ) { + parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository); + $this->userRepository = $userRepository; $this->refreshTokenRepository = $refreshTokenRepository; - parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository); } /** @@ -67,97 +71,16 @@ class PasswordGrant extends AbstractGrant public function respondToRequest( ServerRequestInterface $request, ResponseTypeInterface $responseType, - DateInterval $tokenTTL, + \DateInterval $tokenTTL, $scopeDelimiter = ' ' ) { - // Get the required params - $clientId = isset($request->getParsedBody()['client_id']) - ? $request->getParsedBody()['client_id'] // $_POST['client_id'] - : (isset($request->getServerParams()['PHP_AUTH_USER']) - ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER'] - : null); + $client = $this->validateClient($request); + $user = $this->validateUser($request); + $scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client); - if (is_null($clientId)) { - throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing'); - } + $accessToken = $this->issueAccessToken($tokenTTL, $client, $user->getIdentifier(), $scopes); + $refreshToken = $this->issueRefreshToken($accessToken); - $clientSecret = isset($request->getParsedBody()['client_secret']) - ? $request->getParsedBody()['client_secret'] // $_POST['client_id'] - : (isset($request->getServerParams()['PHP_AUTH_PW']) - ? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER'] - : null); - - if (is_null($clientSecret)) { - throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing'); - } - - // Validate client ID and client secret - $client = $this->clientRepository->getClientEntity( - $clientId, - $clientSecret, - null, - $this->getIdentifier() - ); - - if (($client instanceof ClientEntityInterface) === false) { - $this->emitter->emit(new Event('client.authentication.failed', $request)); - throw OAuthServerException::invalidClient(); - } - - // Username - $username = isset($request->getParsedBody()['username']) - ? $request->getParsedBody()['username'] // $_POST['username'] - : (isset($request->getServerParams()['PHP_AUTH_USER']) - ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER'] - : null); - - if (is_null($username)) { - throw OAuthServerException::invalidRequest('username', null, '`%s` parameter is missing'); - } - - // Password - $password = isset($request->getParsedBody()['password']) - ? $request->getParsedBody()['password'] // $_POST['password'] - : (isset($request->getServerParams()['PHP_AUTH_USER']) - ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER'] - : null); - - if (is_null($password)) { - throw OAuthServerException::invalidRequest('password', null, '`%s` parameter is missing'); - } - - // Verify user's username and password - $userEntity = $this->userRepository->getUserEntityByUserCredentials($username, $password); - if (($userEntity instanceof UserEntityInterface) === false) { - $this->emitter->emit(new Event('user.authentication.failed', $request)); - throw OAuthServerException::invalidCredentials(); - } - - // Validate any scopes that are in the request - $scopeParam = isset($request->getParsedBody()['scope']) - ? $request->getParsedBody()['scope'] // $_POST['scope'] - : ''; - $scopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client); - - // Generate an access token - $accessToken = new AccessTokenEntity(); - $accessToken->setIdentifier(SecureKey::generate()); - $accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL)); - $accessToken->setClient($client); - $accessToken->setUserIdentifier($userEntity->getIdentifier()); - - // Associate scopes with the session and access token - foreach ($scopes as $scope) { - $accessToken->addScope($scope); - } - - // Generate a refresh token - $refreshToken = new RefreshTokenEntity(); - $refreshToken->setIdentifier(SecureKey::generate()); - $refreshToken->setExpiryDateTime((new \DateTime())->add(new DateInterval('P1M'))); - $refreshToken->setAccessToken($accessToken); - - // Persist the tokens $this->accessTokenRepository->persistNewAccessToken($accessToken); $this->refreshTokenRepository->persistNewRefreshToken($refreshToken); @@ -169,13 +92,31 @@ class PasswordGrant extends AbstractGrant } /** - * @inheritdoc + * @param \Psr\Http\Message\ServerRequestInterface $request + * + * @return \League\OAuth2\Server\Entities\Interfaces\UserEntityInterface + * + * @throws \League\OAuth2\Server\Exception\OAuthServerException */ - public function canRespondToRequest(ServerRequestInterface $request) + protected function validateUser(ServerRequestInterface $request) { - return ( - isset($request->getParsedBody()['grant_type']) - && $request->getParsedBody()['grant_type'] === 'password' - ); + $username = $this->getRequestParameter(['username', 'PHP_AUTH_USER'], $request); + if (is_null($username)) { + throw OAuthServerException::invalidRequest('username', null, '`%s` parameter is missing'); + } + + $password = $this->getRequestParameter(['password', 'PHP_AUTH_PW'], $request); + if (is_null($password)) { + throw OAuthServerException::invalidRequest('password', null, '`%s` parameter is missing'); + } + + $user = $this->userRepository->getUserEntityByUserCredentials($username, $password); + if (!$user instanceof UserEntityInterface) { + $this->emitter->emit(new Event('user.authentication.failed', $request)); + + throw OAuthServerException::invalidCredentials(); + } + + return $user; } } diff --git a/src/Grant/RefreshTokenGrant.php b/src/Grant/RefreshTokenGrant.php index a78ab177..a5db9514 100644 --- a/src/Grant/RefreshTokenGrant.php +++ b/src/Grant/RefreshTokenGrant.php @@ -11,14 +11,8 @@ namespace League\OAuth2\Server\Grant; -use DateInterval; -use Lcobucci\JWT\Parser; -use Lcobucci\JWT\Signer\Key; -use Lcobucci\JWT\Signer\Rsa\Sha256; -use Lcobucci\JWT\ValidationData; -use League\OAuth2\Server\Entities\AccessTokenEntity; +use League\Event\Event; use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface; -use League\OAuth2\Server\Entities\RefreshTokenEntity; use League\OAuth2\Server\Exception\OAuthServerException; use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface; use League\OAuth2\Server\Repositories\ClientRepositoryInterface; @@ -26,9 +20,7 @@ use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface; use League\OAuth2\Server\Repositories\ScopeRepositoryInterface; use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface; use League\OAuth2\Server\Utils\KeyCrypt; -use League\OAuth2\Server\Utils\SecureKey; use Psr\Http\Message\ServerRequestInterface; -use Symfony\Component\EventDispatcher\Event; /** * Refresh token grant @@ -36,14 +28,22 @@ use Symfony\Component\EventDispatcher\Event; class RefreshTokenGrant extends AbstractGrant { /** - * @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface + * Grant identifier + * + * @var string */ - private $refreshTokenRepository; + protected $identifier = 'refresh_token'; + /** * @var string */ private $pathToPublicKey; + /** + * @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface + */ + private $refreshTokenRepository; + /** * @param string $pathToPublicKey * @param \League\OAuth2\Server\Repositories\ClientRepositoryInterface $clientRepository @@ -58,9 +58,10 @@ class RefreshTokenGrant extends AbstractGrant AccessTokenRepositoryInterface $accessTokenRepository, RefreshTokenRepositoryInterface $refreshTokenRepository ) { + parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository); + $this->pathToPublicKey = $pathToPublicKey; $this->refreshTokenRepository = $refreshTokenRepository; - parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository); } /** @@ -69,113 +70,35 @@ class RefreshTokenGrant extends AbstractGrant public function respondToRequest( ServerRequestInterface $request, ResponseTypeInterface $responseType, - DateInterval $tokenTTL, + \DateInterval $tokenTTL, $scopeDelimiter = ' ' ) { - // Get the required params - $clientId = isset($request->getParsedBody()['client_id']) - ? $request->getParsedBody()['client_id'] // $_POST['client_id'] - : (isset($request->getServerParams()['PHP_AUTH_USER']) - ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER'] - : null); - - if (is_null($clientId)) { - throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing'); - } - - $clientSecret = isset($request->getParsedBody()['client_secret']) - ? $request->getParsedBody()['client_secret'] // $_POST['client_id'] - : (isset($request->getServerParams()['PHP_AUTH_PW']) - ? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER'] - : null); - - if (is_null($clientSecret)) { - throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing'); - } - - $encryptedRefreshToken = isset($request->getParsedBody()['refresh_token']) - ? $request->getParsedBody()['refresh_token'] - : null; - - if ($encryptedRefreshToken === null) { - throw OAuthServerException::invalidRequest('refresh_token', null, '`%s` parameter is missing'); - } - - // Validate client ID and client secret - $client = $this->clientRepository->getClientEntity( - $clientId, - $clientSecret, - null, - $this->getIdentifier() - ); - - if (($client instanceof ClientEntityInterface) === false) { - $this->emitter->emit(new Event('client.authentication.failed', $request)); - throw OAuthServerException::invalidClient(); - } - - // Validate refresh token - try { - $oldRefreshToken = KeyCrypt::decrypt($encryptedRefreshToken, $this->pathToPublicKey); - } catch (\LogicException $e) { - throw OAuthServerException::invalidRefreshToken('Cannot parse refresh token: ' . $e->getMessage()); - } - - $oldRefreshTokenData = json_decode($oldRefreshToken, true); - if ($oldRefreshTokenData['client_id'] !== $client->getIdentifier()) { - throw OAuthServerException::invalidRefreshToken('Token is not linked to client' . ' got: ' . $client->getIdentifier() . ' expected: '. $oldRefreshTokenData['client_id']); - } - - if ($oldRefreshTokenData['expire_time'] < time()) { - throw OAuthServerException::invalidRefreshToken('Token has expired'); - } - - if ($this->refreshTokenRepository->isRefreshTokenRevoked($oldRefreshTokenData['refresh_token_id']) === true) { - throw OAuthServerException::invalidRefreshToken('Token has been revoked'); - } - - // Get and validate any requested scopes - $scopeParam = isset($request->getParsedBody()['scope']) - ? $request->getParsedBody()['scope'] // $_POST['scope'] - : ''; - $requestedScopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client); + $client = $this->validateClient($request); + $oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier()); + $scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client); // If no new scopes are requested then give the access token the original session scopes - if (count($requestedScopes) === 0) { - $newScopes = $oldRefreshTokenData['scopes']; + if (count($scopes) === 0) { + $scopes = $oldRefreshToken['scopes']; } else { // The OAuth spec says that a refreshed access token can have the original scopes or fewer so ensure - // the request doesn't include any new scopes - foreach ($requestedScopes as $requestedScope) { - if (in_array($requestedScope->getIdentifier(), $oldRefreshTokenData['scopes']) === false) { - throw OAuthServerException::invalidScope($requestedScope->getIdentifier()); + // the request doesn't include any new scopes + foreach ($scopes as $scope) { + if (in_array($scope->getIdentifier(), $oldRefreshToken['scopes']) === false) { + $this->emitter->emit(new Event('scope.selection.failed', $request)); + + throw OAuthServerException::invalidScope($scope->getIdentifier()); } } - - $newScopes = $requestedScopes; } - // Generate a new access token - $accessToken = new AccessTokenEntity(); - $accessToken->setIdentifier(SecureKey::generate()); - $accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL)); - $accessToken->setClient($client); - $accessToken->setUserIdentifier($oldRefreshTokenData['user_id']); - foreach ($newScopes as $scope) { - $accessToken->addScope($scope); - } + // Expire old tokens + $this->accessTokenRepository->revokeAccessToken($oldRefreshToken['access_token_id']); + $this->refreshTokenRepository->revokeRefreshToken($oldRefreshToken['refresh_token_id']); - // Expire the old tokens and save the new one - $this->accessTokenRepository->revokeAccessToken($oldRefreshTokenData['access_token_id']); - $this->refreshTokenRepository->revokeRefreshToken($oldRefreshTokenData['refresh_token_id']); + $accessToken = $this->issueAccessToken($tokenTTL, $client, $oldRefreshToken['user_id'], $scopes); + $refreshToken = $this->issueRefreshToken($accessToken); - // Generate a new refresh token - $refreshToken = new RefreshTokenEntity(); - $refreshToken->setIdentifier(SecureKey::generate()); - $refreshToken->setExpiryDateTime((new \DateTime())->add(new DateInterval('P1M'))); - $refreshToken->setAccessToken($accessToken); - - // Persist the tokens $this->accessTokenRepository->persistNewAccessToken($accessToken); $this->refreshTokenRepository->persistNewRefreshToken($refreshToken); @@ -187,13 +110,46 @@ class RefreshTokenGrant extends AbstractGrant } /** - * @inheritdoc + * @param \Psr\Http\Message\ServerRequestInterface $request + * @param string $clientId + * + * @return array + * + * @throws \League\OAuth2\Server\Exception\OAuthServerException */ - public function canRespondToRequest(ServerRequestInterface $request) + protected function validateOldRefreshToken(ServerRequestInterface $request, $clientId) { - return ( - isset($request->getParsedBody()['grant_type']) - && $request->getParsedBody()['grant_type'] === 'refresh_token' - ); + $encryptedRefreshToken = $this->getRequestParameter('refresh_token', $request); + if (is_null($encryptedRefreshToken)) { + throw OAuthServerException::invalidRequest('refresh_token', null, '`%s` parameter is missing'); + } + + // Validate refresh token + try { + $refreshToken = KeyCrypt::decrypt($encryptedRefreshToken, $this->pathToPublicKey); + } catch (\LogicException $e) { + throw OAuthServerException::invalidRefreshToken('Cannot parse refresh token: ' . $e->getMessage()); + } + + $refreshTokenData = json_decode($refreshToken, true); + if ($refreshTokenData['client_id'] !== $clientId) { + $this->emitter->emit(new Event('refresh_token.client.failed', $request)); + + throw OAuthServerException::invalidRefreshToken( + 'Token is not linked to client,' . + ' got: ' . $clientId . + ' expected: '. $refreshTokenData['client_id'] + ); + } + + if ($refreshTokenData['expire_time'] < time()) { + throw OAuthServerException::invalidRefreshToken('Token has expired'); + } + + if ($this->refreshTokenRepository->isRefreshTokenRevoked($refreshTokenData['refresh_token_id']) === true) { + throw OAuthServerException::invalidRefreshToken('Token has been revoked'); + } + + return $refreshTokenData; } }