diff --git a/CHANGELOG.md b/CHANGELOG.md index f18643fd..8da0979f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 2.1.1 (released 2013-06-02) + +* Added conditional `isValid()` flag to check for Authorization header only (thanks @alexmcroberts) +* Fixed semantic meaning of `requireScopeParam()` and `requireStateParam()` by changing their default value to true +* Updated some duff docblocks +* Corrected array key call in Resource.php (Issue #63) + ## 2.1 (released 2013-05-10) * Moved zetacomponents/database to "suggest" in composer.json. If you rely on this feature you now need to include " zetacomponents/database" into "require" key in your own composer.json. (Issue #51) diff --git a/composer.json b/composer.json index 2d37cdd9..40db4273 100644 --- a/composer.json +++ b/composer.json @@ -1,7 +1,7 @@ { "name": "league/oauth2-server", "description": "A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.", - "version": "2.1", + "version": "2.1.1", "homepage": "https://github.com/php-loep/oauth2-server", "license": "MIT", "require": { diff --git a/src/League/OAuth2/Server/Authorization.php b/src/League/OAuth2/Server/Authorization.php index fd11316f..32748d8a 100644 --- a/src/League/OAuth2/Server/Authorization.php +++ b/src/League/OAuth2/Server/Authorization.php @@ -271,7 +271,7 @@ class Authorization * @param boolean $require * @return void */ - public function requireScopeParam($require = false) + public function requireScopeParam($require = true) { $this->requireScopeParam = $require; } @@ -318,7 +318,7 @@ class Authorization * @param boolean $require * @return void */ - public function requireStateParam($require = false) + public function requireStateParam($require = true) { $this->requireStateParam = $require; } diff --git a/src/League/OAuth2/Server/Resource.php b/src/League/OAuth2/Server/Resource.php index be902208..49f149ee 100644 --- a/src/League/OAuth2/Server/Resource.php +++ b/src/League/OAuth2/Server/Resource.php @@ -173,12 +173,13 @@ class Resource /** * Checks if the access token is valid or not. * + * @param $headersOnly Limit Access Token to Authorization header only * @throws Exception\InvalidAccessTokenException Thrown if the presented access token is not valid * @return bool */ - public function isValid() + public function isValid($headersOnly = false) { - $accessToken = $this->determineAccessToken(); + $accessToken = $this->determineAccessToken($headersOnly); $result = $this->storages['session']->validateAccessToken($accessToken); @@ -194,7 +195,7 @@ class Resource $sessionScopes = $this->storages['session']->getScopes($this->accessToken); foreach ($sessionScopes as $scope) { - $this->sessionScopes[] = $scope['key']; + $this->sessionScopes[] = $scope['scope']; } return true; @@ -237,10 +238,11 @@ class Resource /** * Reads in the access token from the headers. * + * @param $headersOnly Limit Access Token to Authorization header only * @throws Exception\MissingAccessTokenException Thrown if there is no access token presented * @return string */ - protected function determineAccessToken() + protected function determineAccessToken($headersOnly = false) { if ($header = $this->getRequest()->header('Authorization')) { // Check for special case, because cURL sometimes does an @@ -251,12 +253,12 @@ class Resource // 2nd request: Authorization: Bearer XXX, Bearer XXX if (strpos($header, ',') !== false) { $headerPart = explode(',', $header); - $accessToken = preg_replace('/^(?:\s+)?Bearer(\s{1})/', '', $headerPart[0]); + $accessToken = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $headerPart[0])); } else { - $accessToken = preg_replace('/^(?:\s+)?Bearer(\s{1})/', '', $header); + $accessToken = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $header)); } $accessToken = ($accessToken === 'Bearer') ? '' : $accessToken; - } else { + } elseif ($headersOnly === false) { $method = $this->getRequest()->server('REQUEST_METHOD'); $accessToken = $this->getRequest()->{$method}($this->tokenKey); } diff --git a/src/League/OAuth2/Server/Storage/ClientInterface.php b/src/League/OAuth2/Server/Storage/ClientInterface.php index b98da03d..72538561 100644 --- a/src/League/OAuth2/Server/Storage/ClientInterface.php +++ b/src/League/OAuth2/Server/Storage/ClientInterface.php @@ -50,8 +50,8 @@ interface ClientInterface * @param string $clientId The client's ID * @param string $clientSecret The client's secret (default = "null") * @param string $redirectUri The client's redirect URI (default = "null") - * @param string $grantType The grant type used in the request + * @param string $grantType The grant type used in the request (default = "null") * @return bool|array Returns false if the validation fails, array on success */ - public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType); + public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType = null); } \ No newline at end of file diff --git a/src/League/OAuth2/Server/Storage/PDO/Client.php b/src/League/OAuth2/Server/Storage/PDO/Client.php index ced1a3ca..1fcb3642 100644 --- a/src/League/OAuth2/Server/Storage/PDO/Client.php +++ b/src/League/OAuth2/Server/Storage/PDO/Client.php @@ -6,7 +6,7 @@ use League\OAuth2\Server\Storage\ClientInterface; class Client implements ClientInterface { - public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType) + public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType = null) { $db = \ezcDbInstance::get(); diff --git a/src/League/OAuth2/Server/Storage/ScopeInterface.php b/src/League/OAuth2/Server/Storage/ScopeInterface.php index 15eb214b..60efd9ca 100644 --- a/src/League/OAuth2/Server/Storage/ScopeInterface.php +++ b/src/League/OAuth2/Server/Storage/ScopeInterface.php @@ -35,8 +35,8 @@ interface ScopeInterface * * * @param string $scope The scope - * @param string $clientId The client ID - * @param string $grantType The grant type used in the request + * @param string $clientId The client ID (default = "null") + * @param string $grantType The grant type used in the request (default = "null") * @return bool|array If the scope doesn't exist return false */ public function getScope($scope, $clientId = null, $grantType = null); diff --git a/tests/resource/ResourceServerTest.php b/tests/resource/ResourceServerTest.php index c05966bf..04f988ca 100644 --- a/tests/resource/ResourceServerTest.php +++ b/tests/resource/ResourceServerTest.php @@ -196,8 +196,8 @@ class Resource_Server_test extends PHPUnit_Framework_TestCase )); $this->session->shouldReceive('getScopes')->andReturn(array( - array('key' => 'foo'), - array('key' => 'bar') + array('scope' => 'foo'), + array('scope' => 'bar') )); $request = new League\OAuth2\Server\Util\Request();