mirror of
https://github.com/elyby/oauth2-server.git
synced 2024-12-25 22:49:49 +05:30
abstract common grants tasks
This commit is contained in:
Julián Gutiérrez
parent
7811721d28
commit
44ff8692dc
@ -12,12 +12,16 @@
|
||||
namespace League\OAuth2\Server\Grant;
|
||||
|
||||
use League\Event\EmitterInterface;
|
||||
use League\Event\Event;
|
||||
use League\OAuth2\Server\Entities\AccessTokenEntity;
|
||||
use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
|
||||
use League\OAuth2\Server\Entities\RefreshTokenEntity;
|
||||
use League\OAuth2\Server\Entities\ScopeEntity;
|
||||
use League\OAuth2\Server\Exception\OAuthServerException;
|
||||
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
|
||||
use League\OAuth2\Server\Utils\SecureKey;
|
||||
use Psr\Http\Message\ServerRequestInterface;
|
||||
|
||||
/**
|
||||
@ -95,6 +99,60 @@ abstract class AbstractGrant implements GrantTypeInterface
|
||||
return $this->respondsWith;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param \Psr\Http\Message\ServerRequestInterface $request
|
||||
*
|
||||
* @return \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface
|
||||
*
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthServerException
|
||||
*/
|
||||
protected function validateClient(ServerRequestInterface $request)
|
||||
{
|
||||
$clientId = $this->getRequestParameter(['client_id', 'PHP_AUTH_USER'], $request);
|
||||
if (is_null($clientId)) {
|
||||
throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$clientSecret = $this->getRequestParameter(['client_secret', 'PHP_AUTH_PW'], $request);
|
||||
if (is_null($clientSecret)) {
|
||||
throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$client = $this->clientRepository->getClientEntity(
|
||||
$clientId,
|
||||
$clientSecret,
|
||||
null,
|
||||
$this->getIdentifier()
|
||||
);
|
||||
|
||||
if (!$client instanceof ClientEntityInterface) {
|
||||
$this->emitter->emit(new Event('client.authentication.failed', $request));
|
||||
|
||||
throw OAuthServerException::invalidClient();
|
||||
}
|
||||
|
||||
return $client;
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve request parameter.
|
||||
*
|
||||
* @param string|array $parameter
|
||||
* @param \Psr\Http\Message\ServerRequestInterface $request
|
||||
*
|
||||
* @return string|null
|
||||
*/
|
||||
protected function getRequestParameter($parameter, ServerRequestInterface $request)
|
||||
{
|
||||
foreach ((array) $parameter as $param) {
|
||||
if (isset($request->getParsedBody()[$param])) {
|
||||
return $request->getParsedBody()[$param];
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $scopeParamValue A string containing a delimited set of scope identifiers
|
||||
* @param string $scopeDelimiterString The delimiter between the scopes in the value string
|
||||
@ -142,4 +200,57 @@ abstract class AbstractGrant implements GrantTypeInterface
|
||||
{
|
||||
$this->emitter = $emitter;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param \DateInterval $tokenTTL
|
||||
* @param \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface $client
|
||||
* @param string $userIdentifier
|
||||
* @param array $scopes
|
||||
*
|
||||
* @return \League\OAuth2\Server\Entities\AccessTokenEntity
|
||||
*/
|
||||
protected function issueAccessToken(
|
||||
\DateInterval $tokenTTL,
|
||||
ClientEntityInterface $client,
|
||||
$userIdentifier,
|
||||
array $scopes = []
|
||||
) {
|
||||
$accessToken = new AccessTokenEntity();
|
||||
$accessToken->setIdentifier(SecureKey::generate());
|
||||
$accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL));
|
||||
$accessToken->setClient($client);
|
||||
$accessToken->setUserIdentifier($userIdentifier);
|
||||
|
||||
foreach ($scopes as $scope) {
|
||||
$accessToken->addScope($scope);
|
||||
}
|
||||
|
||||
return $accessToken;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param \League\OAuth2\Server\Entities\AccessTokenEntity $accessToken
|
||||
*
|
||||
* @return \League\OAuth2\Server\Entities\RefreshTokenEntity
|
||||
*/
|
||||
protected function issueRefreshToken(AccessTokenEntity $accessToken)
|
||||
{
|
||||
$refreshToken = new RefreshTokenEntity();
|
||||
$refreshToken->setIdentifier(SecureKey::generate());
|
||||
$refreshToken->setExpiryDateTime((new \DateTime())->add(new \DateInterval('P1M')));
|
||||
$refreshToken->setAccessToken($accessToken);
|
||||
|
||||
return $refreshToken;
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc
|
||||
*/
|
||||
public function canRespondToRequest(ServerRequestInterface $request)
|
||||
{
|
||||
return (
|
||||
isset($request->getParsedBody()['grant_type'])
|
||||
&& $request->getParsedBody()['grant_type'] === $this->identifier
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@ -11,13 +11,9 @@
|
||||
|
||||
namespace League\OAuth2\Server\Grant;
|
||||
|
||||
use DateInterval;
|
||||
use League\Event\Event;
|
||||
use League\OAuth2\Server\Entities\AccessTokenEntity;
|
||||
use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
|
||||
use League\OAuth2\Server\Exception\OAuthServerException;
|
||||
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
|
||||
use League\OAuth2\Server\Utils\SecureKey;
|
||||
use Psr\Http\Message\ServerRequestInterface;
|
||||
|
||||
/**
|
||||
@ -38,62 +34,14 @@ class ClientCredentialsGrant extends AbstractGrant
|
||||
public function respondToRequest(
|
||||
ServerRequestInterface $request,
|
||||
ResponseTypeInterface $responseType,
|
||||
DateInterval $accessTokenTTL,
|
||||
\DateInterval $tokenTTL,
|
||||
$scopeDelimiter = ' '
|
||||
) {
|
||||
// Get the required params
|
||||
$clientId = isset($request->getParsedBody()['client_id'])
|
||||
? $request->getParsedBody()['client_id'] // $_POST['client_id']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_USER'])
|
||||
? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
$client = $this->validateClient($request);
|
||||
$scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client);
|
||||
|
||||
if (is_null($clientId)) {
|
||||
throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
|
||||
}
|
||||
$accessToken = $this->issueAccessToken($tokenTTL, $client, $client->getIdentifier(), $scopes);
|
||||
|
||||
$clientSecret = isset($request->getParsedBody()['client_secret'])
|
||||
? $request->getParsedBody()['client_secret'] // $_POST['client_id']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_PW'])
|
||||
? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
|
||||
if (is_null($clientSecret)) {
|
||||
throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
// Validate client ID and client secret
|
||||
$client = $this->clientRepository->getClientEntity(
|
||||
$clientId,
|
||||
$clientSecret,
|
||||
null,
|
||||
$this->getIdentifier()
|
||||
);
|
||||
|
||||
if (($client instanceof ClientEntityInterface) === false) {
|
||||
$this->emitter->emit(new Event('client.authentication.failed', $request));
|
||||
throw OAuthServerException::invalidClient();
|
||||
}
|
||||
|
||||
// Validate any scopes that are in the request
|
||||
$scopeParam = isset($request->getParsedBody()['scope'])
|
||||
? $request->getParsedBody()['scope'] // $_POST['scope']
|
||||
: '';
|
||||
$scopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client);
|
||||
|
||||
// Generate an access token
|
||||
$accessToken = new AccessTokenEntity();
|
||||
$accessToken->setIdentifier(SecureKey::generate());
|
||||
$accessToken->setExpiryDateTime((new \DateTime())->add($accessTokenTTL));
|
||||
$accessToken->setClient($client);
|
||||
$accessToken->setUserIdentifier($client->getIdentifier());
|
||||
|
||||
// Associate scopes with the session and access token
|
||||
foreach ($scopes as $scope) {
|
||||
$accessToken->addScope($scope);
|
||||
}
|
||||
|
||||
// Save the token
|
||||
$this->accessTokenRepository->persistNewAccessToken($accessToken);
|
||||
|
||||
// Inject access token into token type
|
||||
@ -101,15 +49,4 @@ class ClientCredentialsGrant extends AbstractGrant
|
||||
|
||||
return $responseType;
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc
|
||||
*/
|
||||
public function canRespondToRequest(ServerRequestInterface $request)
|
||||
{
|
||||
return (
|
||||
array_key_exists('grant_type', $request->getParsedBody())
|
||||
&& $request->getParsedBody()['grant_type'] === 'client_credentials'
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@ -11,12 +11,9 @@
|
||||
|
||||
namespace League\OAuth2\Server\Grant;
|
||||
|
||||
use DateInterval;
|
||||
use League\Event\Event;
|
||||
use League\OAuth2\Server\Entities\AccessTokenEntity;
|
||||
use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
|
||||
use League\OAuth2\Server\Entities\Interfaces\UserEntityInterface;
|
||||
use League\OAuth2\Server\Entities\RefreshTokenEntity;
|
||||
use League\OAuth2\Server\Exception\OAuthServerException;
|
||||
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
|
||||
@ -24,7 +21,6 @@ use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\UserRepositoryInterface;
|
||||
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
|
||||
use League\OAuth2\Server\Utils\SecureKey;
|
||||
use Psr\Http\Message\ServerRequestInterface;
|
||||
|
||||
/**
|
||||
@ -32,6 +28,13 @@ use Psr\Http\Message\ServerRequestInterface;
|
||||
*/
|
||||
class PasswordGrant extends AbstractGrant
|
||||
{
|
||||
/**
|
||||
* Grant identifier
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
protected $identifier = 'password';
|
||||
|
||||
/**
|
||||
* @var \League\OAuth2\Server\Repositories\UserRepositoryInterface
|
||||
*/
|
||||
@ -56,9 +59,10 @@ class PasswordGrant extends AbstractGrant
|
||||
AccessTokenRepositoryInterface $accessTokenRepository,
|
||||
RefreshTokenRepositoryInterface $refreshTokenRepository
|
||||
) {
|
||||
parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
|
||||
|
||||
$this->userRepository = $userRepository;
|
||||
$this->refreshTokenRepository = $refreshTokenRepository;
|
||||
parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
|
||||
}
|
||||
|
||||
/**
|
||||
@ -67,97 +71,16 @@ class PasswordGrant extends AbstractGrant
|
||||
public function respondToRequest(
|
||||
ServerRequestInterface $request,
|
||||
ResponseTypeInterface $responseType,
|
||||
DateInterval $tokenTTL,
|
||||
\DateInterval $tokenTTL,
|
||||
$scopeDelimiter = ' '
|
||||
) {
|
||||
// Get the required params
|
||||
$clientId = isset($request->getParsedBody()['client_id'])
|
||||
? $request->getParsedBody()['client_id'] // $_POST['client_id']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_USER'])
|
||||
? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
$client = $this->validateClient($request);
|
||||
$user = $this->validateUser($request);
|
||||
$scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client);
|
||||
|
||||
if (is_null($clientId)) {
|
||||
throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
|
||||
}
|
||||
$accessToken = $this->issueAccessToken($tokenTTL, $client, $user->getIdentifier(), $scopes);
|
||||
$refreshToken = $this->issueRefreshToken($accessToken);
|
||||
|
||||
$clientSecret = isset($request->getParsedBody()['client_secret'])
|
||||
? $request->getParsedBody()['client_secret'] // $_POST['client_id']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_PW'])
|
||||
? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
|
||||
if (is_null($clientSecret)) {
|
||||
throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
// Validate client ID and client secret
|
||||
$client = $this->clientRepository->getClientEntity(
|
||||
$clientId,
|
||||
$clientSecret,
|
||||
null,
|
||||
$this->getIdentifier()
|
||||
);
|
||||
|
||||
if (($client instanceof ClientEntityInterface) === false) {
|
||||
$this->emitter->emit(new Event('client.authentication.failed', $request));
|
||||
throw OAuthServerException::invalidClient();
|
||||
}
|
||||
|
||||
// Username
|
||||
$username = isset($request->getParsedBody()['username'])
|
||||
? $request->getParsedBody()['username'] // $_POST['username']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_USER'])
|
||||
? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
|
||||
if (is_null($username)) {
|
||||
throw OAuthServerException::invalidRequest('username', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
// Password
|
||||
$password = isset($request->getParsedBody()['password'])
|
||||
? $request->getParsedBody()['password'] // $_POST['password']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_USER'])
|
||||
? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
|
||||
if (is_null($password)) {
|
||||
throw OAuthServerException::invalidRequest('password', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
// Verify user's username and password
|
||||
$userEntity = $this->userRepository->getUserEntityByUserCredentials($username, $password);
|
||||
if (($userEntity instanceof UserEntityInterface) === false) {
|
||||
$this->emitter->emit(new Event('user.authentication.failed', $request));
|
||||
throw OAuthServerException::invalidCredentials();
|
||||
}
|
||||
|
||||
// Validate any scopes that are in the request
|
||||
$scopeParam = isset($request->getParsedBody()['scope'])
|
||||
? $request->getParsedBody()['scope'] // $_POST['scope']
|
||||
: '';
|
||||
$scopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client);
|
||||
|
||||
// Generate an access token
|
||||
$accessToken = new AccessTokenEntity();
|
||||
$accessToken->setIdentifier(SecureKey::generate());
|
||||
$accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL));
|
||||
$accessToken->setClient($client);
|
||||
$accessToken->setUserIdentifier($userEntity->getIdentifier());
|
||||
|
||||
// Associate scopes with the session and access token
|
||||
foreach ($scopes as $scope) {
|
||||
$accessToken->addScope($scope);
|
||||
}
|
||||
|
||||
// Generate a refresh token
|
||||
$refreshToken = new RefreshTokenEntity();
|
||||
$refreshToken->setIdentifier(SecureKey::generate());
|
||||
$refreshToken->setExpiryDateTime((new \DateTime())->add(new DateInterval('P1M')));
|
||||
$refreshToken->setAccessToken($accessToken);
|
||||
|
||||
// Persist the tokens
|
||||
$this->accessTokenRepository->persistNewAccessToken($accessToken);
|
||||
$this->refreshTokenRepository->persistNewRefreshToken($refreshToken);
|
||||
|
||||
@ -169,13 +92,31 @@ class PasswordGrant extends AbstractGrant
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc
|
||||
* @param \Psr\Http\Message\ServerRequestInterface $request
|
||||
*
|
||||
* @return \League\OAuth2\Server\Entities\Interfaces\UserEntityInterface
|
||||
*
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthServerException
|
||||
*/
|
||||
public function canRespondToRequest(ServerRequestInterface $request)
|
||||
protected function validateUser(ServerRequestInterface $request)
|
||||
{
|
||||
return (
|
||||
isset($request->getParsedBody()['grant_type'])
|
||||
&& $request->getParsedBody()['grant_type'] === 'password'
|
||||
);
|
||||
$username = $this->getRequestParameter(['username', 'PHP_AUTH_USER'], $request);
|
||||
if (is_null($username)) {
|
||||
throw OAuthServerException::invalidRequest('username', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$password = $this->getRequestParameter(['password', 'PHP_AUTH_PW'], $request);
|
||||
if (is_null($password)) {
|
||||
throw OAuthServerException::invalidRequest('password', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$user = $this->userRepository->getUserEntityByUserCredentials($username, $password);
|
||||
if (!$user instanceof UserEntityInterface) {
|
||||
$this->emitter->emit(new Event('user.authentication.failed', $request));
|
||||
|
||||
throw OAuthServerException::invalidCredentials();
|
||||
}
|
||||
|
||||
return $user;
|
||||
}
|
||||
}
|
||||
|
||||
@ -11,14 +11,8 @@
|
||||
|
||||
namespace League\OAuth2\Server\Grant;
|
||||
|
||||
use DateInterval;
|
||||
use Lcobucci\JWT\Parser;
|
||||
use Lcobucci\JWT\Signer\Key;
|
||||
use Lcobucci\JWT\Signer\Rsa\Sha256;
|
||||
use Lcobucci\JWT\ValidationData;
|
||||
use League\OAuth2\Server\Entities\AccessTokenEntity;
|
||||
use League\Event\Event;
|
||||
use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
|
||||
use League\OAuth2\Server\Entities\RefreshTokenEntity;
|
||||
use League\OAuth2\Server\Exception\OAuthServerException;
|
||||
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
|
||||
@ -26,9 +20,7 @@ use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
|
||||
use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
|
||||
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
|
||||
use League\OAuth2\Server\Utils\KeyCrypt;
|
||||
use League\OAuth2\Server\Utils\SecureKey;
|
||||
use Psr\Http\Message\ServerRequestInterface;
|
||||
use Symfony\Component\EventDispatcher\Event;
|
||||
|
||||
/**
|
||||
* Refresh token grant
|
||||
@ -36,14 +28,22 @@ use Symfony\Component\EventDispatcher\Event;
|
||||
class RefreshTokenGrant extends AbstractGrant
|
||||
{
|
||||
/**
|
||||
* @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface
|
||||
* Grant identifier
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
private $refreshTokenRepository;
|
||||
protected $identifier = 'refresh_token';
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $pathToPublicKey;
|
||||
|
||||
/**
|
||||
* @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface
|
||||
*/
|
||||
private $refreshTokenRepository;
|
||||
|
||||
/**
|
||||
* @param string $pathToPublicKey
|
||||
* @param \League\OAuth2\Server\Repositories\ClientRepositoryInterface $clientRepository
|
||||
@ -58,9 +58,10 @@ class RefreshTokenGrant extends AbstractGrant
|
||||
AccessTokenRepositoryInterface $accessTokenRepository,
|
||||
RefreshTokenRepositoryInterface $refreshTokenRepository
|
||||
) {
|
||||
parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
|
||||
|
||||
$this->pathToPublicKey = $pathToPublicKey;
|
||||
$this->refreshTokenRepository = $refreshTokenRepository;
|
||||
parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
|
||||
}
|
||||
|
||||
/**
|
||||
@ -69,113 +70,35 @@ class RefreshTokenGrant extends AbstractGrant
|
||||
public function respondToRequest(
|
||||
ServerRequestInterface $request,
|
||||
ResponseTypeInterface $responseType,
|
||||
DateInterval $tokenTTL,
|
||||
\DateInterval $tokenTTL,
|
||||
$scopeDelimiter = ' '
|
||||
) {
|
||||
// Get the required params
|
||||
$clientId = isset($request->getParsedBody()['client_id'])
|
||||
? $request->getParsedBody()['client_id'] // $_POST['client_id']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_USER'])
|
||||
? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
|
||||
if (is_null($clientId)) {
|
||||
throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$clientSecret = isset($request->getParsedBody()['client_secret'])
|
||||
? $request->getParsedBody()['client_secret'] // $_POST['client_id']
|
||||
: (isset($request->getServerParams()['PHP_AUTH_PW'])
|
||||
? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER']
|
||||
: null);
|
||||
|
||||
if (is_null($clientSecret)) {
|
||||
throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
$encryptedRefreshToken = isset($request->getParsedBody()['refresh_token'])
|
||||
? $request->getParsedBody()['refresh_token']
|
||||
: null;
|
||||
|
||||
if ($encryptedRefreshToken === null) {
|
||||
throw OAuthServerException::invalidRequest('refresh_token', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
// Validate client ID and client secret
|
||||
$client = $this->clientRepository->getClientEntity(
|
||||
$clientId,
|
||||
$clientSecret,
|
||||
null,
|
||||
$this->getIdentifier()
|
||||
);
|
||||
|
||||
if (($client instanceof ClientEntityInterface) === false) {
|
||||
$this->emitter->emit(new Event('client.authentication.failed', $request));
|
||||
throw OAuthServerException::invalidClient();
|
||||
}
|
||||
|
||||
// Validate refresh token
|
||||
try {
|
||||
$oldRefreshToken = KeyCrypt::decrypt($encryptedRefreshToken, $this->pathToPublicKey);
|
||||
} catch (\LogicException $e) {
|
||||
throw OAuthServerException::invalidRefreshToken('Cannot parse refresh token: ' . $e->getMessage());
|
||||
}
|
||||
|
||||
$oldRefreshTokenData = json_decode($oldRefreshToken, true);
|
||||
if ($oldRefreshTokenData['client_id'] !== $client->getIdentifier()) {
|
||||
throw OAuthServerException::invalidRefreshToken('Token is not linked to client' . ' got: ' . $client->getIdentifier() . ' expected: '. $oldRefreshTokenData['client_id']);
|
||||
}
|
||||
|
||||
if ($oldRefreshTokenData['expire_time'] < time()) {
|
||||
throw OAuthServerException::invalidRefreshToken('Token has expired');
|
||||
}
|
||||
|
||||
if ($this->refreshTokenRepository->isRefreshTokenRevoked($oldRefreshTokenData['refresh_token_id']) === true) {
|
||||
throw OAuthServerException::invalidRefreshToken('Token has been revoked');
|
||||
}
|
||||
|
||||
// Get and validate any requested scopes
|
||||
$scopeParam = isset($request->getParsedBody()['scope'])
|
||||
? $request->getParsedBody()['scope'] // $_POST['scope']
|
||||
: '';
|
||||
$requestedScopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client);
|
||||
$client = $this->validateClient($request);
|
||||
$oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier());
|
||||
$scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client);
|
||||
|
||||
// If no new scopes are requested then give the access token the original session scopes
|
||||
if (count($requestedScopes) === 0) {
|
||||
$newScopes = $oldRefreshTokenData['scopes'];
|
||||
if (count($scopes) === 0) {
|
||||
$scopes = $oldRefreshToken['scopes'];
|
||||
} else {
|
||||
// The OAuth spec says that a refreshed access token can have the original scopes or fewer so ensure
|
||||
// the request doesn't include any new scopes
|
||||
foreach ($requestedScopes as $requestedScope) {
|
||||
if (in_array($requestedScope->getIdentifier(), $oldRefreshTokenData['scopes']) === false) {
|
||||
throw OAuthServerException::invalidScope($requestedScope->getIdentifier());
|
||||
// the request doesn't include any new scopes
|
||||
foreach ($scopes as $scope) {
|
||||
if (in_array($scope->getIdentifier(), $oldRefreshToken['scopes']) === false) {
|
||||
$this->emitter->emit(new Event('scope.selection.failed', $request));
|
||||
|
||||
throw OAuthServerException::invalidScope($scope->getIdentifier());
|
||||
}
|
||||
}
|
||||
|
||||
$newScopes = $requestedScopes;
|
||||
}
|
||||
|
||||
// Generate a new access token
|
||||
$accessToken = new AccessTokenEntity();
|
||||
$accessToken->setIdentifier(SecureKey::generate());
|
||||
$accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL));
|
||||
$accessToken->setClient($client);
|
||||
$accessToken->setUserIdentifier($oldRefreshTokenData['user_id']);
|
||||
foreach ($newScopes as $scope) {
|
||||
$accessToken->addScope($scope);
|
||||
}
|
||||
// Expire old tokens
|
||||
$this->accessTokenRepository->revokeAccessToken($oldRefreshToken['access_token_id']);
|
||||
$this->refreshTokenRepository->revokeRefreshToken($oldRefreshToken['refresh_token_id']);
|
||||
|
||||
// Expire the old tokens and save the new one
|
||||
$this->accessTokenRepository->revokeAccessToken($oldRefreshTokenData['access_token_id']);
|
||||
$this->refreshTokenRepository->revokeRefreshToken($oldRefreshTokenData['refresh_token_id']);
|
||||
$accessToken = $this->issueAccessToken($tokenTTL, $client, $oldRefreshToken['user_id'], $scopes);
|
||||
$refreshToken = $this->issueRefreshToken($accessToken);
|
||||
|
||||
// Generate a new refresh token
|
||||
$refreshToken = new RefreshTokenEntity();
|
||||
$refreshToken->setIdentifier(SecureKey::generate());
|
||||
$refreshToken->setExpiryDateTime((new \DateTime())->add(new DateInterval('P1M')));
|
||||
$refreshToken->setAccessToken($accessToken);
|
||||
|
||||
// Persist the tokens
|
||||
$this->accessTokenRepository->persistNewAccessToken($accessToken);
|
||||
$this->refreshTokenRepository->persistNewRefreshToken($refreshToken);
|
||||
|
||||
@ -187,13 +110,46 @@ class RefreshTokenGrant extends AbstractGrant
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc
|
||||
* @param \Psr\Http\Message\ServerRequestInterface $request
|
||||
* @param string $clientId
|
||||
*
|
||||
* @return array
|
||||
*
|
||||
* @throws \League\OAuth2\Server\Exception\OAuthServerException
|
||||
*/
|
||||
public function canRespondToRequest(ServerRequestInterface $request)
|
||||
protected function validateOldRefreshToken(ServerRequestInterface $request, $clientId)
|
||||
{
|
||||
return (
|
||||
isset($request->getParsedBody()['grant_type'])
|
||||
&& $request->getParsedBody()['grant_type'] === 'refresh_token'
|
||||
);
|
||||
$encryptedRefreshToken = $this->getRequestParameter('refresh_token', $request);
|
||||
if (is_null($encryptedRefreshToken)) {
|
||||
throw OAuthServerException::invalidRequest('refresh_token', null, '`%s` parameter is missing');
|
||||
}
|
||||
|
||||
// Validate refresh token
|
||||
try {
|
||||
$refreshToken = KeyCrypt::decrypt($encryptedRefreshToken, $this->pathToPublicKey);
|
||||
} catch (\LogicException $e) {
|
||||
throw OAuthServerException::invalidRefreshToken('Cannot parse refresh token: ' . $e->getMessage());
|
||||
}
|
||||
|
||||
$refreshTokenData = json_decode($refreshToken, true);
|
||||
if ($refreshTokenData['client_id'] !== $clientId) {
|
||||
$this->emitter->emit(new Event('refresh_token.client.failed', $request));
|
||||
|
||||
throw OAuthServerException::invalidRefreshToken(
|
||||
'Token is not linked to client,' .
|
||||
' got: ' . $clientId .
|
||||
' expected: '. $refreshTokenData['client_id']
|
||||
);
|
||||
}
|
||||
|
||||
if ($refreshTokenData['expire_time'] < time()) {
|
||||
throw OAuthServerException::invalidRefreshToken('Token has expired');
|
||||
}
|
||||
|
||||
if ($this->refreshTokenRepository->isRefreshTokenRevoked($refreshTokenData['refresh_token_id']) === true) {
|
||||
throw OAuthServerException::invalidRefreshToken('Token has been revoked');
|
||||
}
|
||||
|
||||
return $refreshTokenData;
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user