Merge branch 'release/3.2'

add the ability to change the algorithm that is used to generate the token strings

.travis.yml

@@ -3,6 +3,16 @@ language: php
 php:
   - 5.4
   - 5.5
+  - 5.6
+  - hhvm
+  
+matrix:
+  allow_failures:
+    - php: hhvm
 
 before_script: composer install --prefer-source
-script: phpunit --configuration phpunit.xml.dist
+script: phpunit --configuration phpunit.xml.dist
+
+cache:
+  directories:
+    - vendor

CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog
 
-## 3.1 (released 2013-12-05)
+## 3.2 (released 2014-04-16)
+
+* Added the ability to change the algorithm that is used to generate the token strings (Issue #151)
+
+## 3.1.2 (released 2014-02-26)
+
+* Support Authorization being an environment variable. [See more](http://fortrabbit.com/docs/essentials/quirks-and-constraints#authorization-header)
+
+## 3.1.1 (released 2013-12-05)
+
+* Normalize headers when `getallheaders()` is available (Issues #108 and #114)
+
+## 3.1.0 (released 2013-12-05)
 
 * No longer necessary to inject the authorisation server into a grant, the server will inject itself
 * Added test for 1419ba8cdcf18dd034c8db9f7de86a2594b68605
@@ -9,7 +21,7 @@
 
 * Forgot to tell TravisCI from testing PHP 5.3
 
-## 3.0 (released 2013-12-02)
+## 3.0.0 (released 2013-12-02)
 
 * Fixed spelling of Implicit grant class (Issue #84)
 * Travis CI now tests for PHP 5.5

CONTRIBUTING.md

@@ -0,0 +1,15 @@
+Thanks for contributing to this project.
+
+
+**Please submit your pull request against the `develop` branch only.**
+
+
+Please ensure that you run `phpunit` from the project root after you've made any changes.
+
+If you've added something new please create a new unit test, if you've changed something please update any unit tests as appropritate.
+
+We're trying to ensure there is **100%** test code coverage (including testing PHP errors and exceptions) so please ensure any new/updated tests cover all of your changes.
+
+Thank you,
+
+@alexbilbie

README.md

@@ -1,34 +1,36 @@
 # PHP OAuth 2.0 Server
 
+[![Latest Stable Version](https://poser.pugx.org/league/oauth2-server/v/stable.png)](https://packagist.org/packages/league/oauth2-server) [![Coverage Status](https://coveralls.io/repos/thephpleague/oauth2-server/badge.png?branch=master)](https://coveralls.io/r/thephpleague/oauth2-server?branch=master) [![Total Downloads](https://poser.pugx.org/league/oauth2-server/downloads.png)](https://packagist.org/packages/league/oauth2-server) [![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/thephpleague/oauth2-server/trend.png)](https://bitdeli.com/free "Bitdeli Badge")
+
+
 A standards compliant [OAuth 2.0](http://tools.ietf.org/wg/oauth/draft-ietf-oauth-v2/) authorization server and resource server written in PHP.
 
 ## Package Installation
 
-The framework is provided as a Composer package which can be installed by adding the package to your composer.json file:
+The framework is provided as a Composer package which can be installed by adding the package to your `composer.json` file:
 
 ```javascript
 {
 	"require": {
-		"league/oauth2-server": "2.*"
+		"league/oauth2-server": "3.*"
 	}
 }
 ```
 
-#### Master branch
+### Framework Integrations
 
-Latest stable version - [![Latest Stable Version](https://poser.pugx.org/league/oauth2-server/v/stable.png)](https://packagist.org/packages/league/oauth2-server)
-Code coverage - [![Coverage Status](https://coveralls.io/repos/php-loep/oauth2-server/badge.png?branch=master)](https://coveralls.io/r/php-loep/oauth2-server?branch=master)
-Downloads - [![Total Downloads](https://poser.pugx.org/league/oauth2-server/downloads.png)](https://packagist.org/packages/league/oauth2-server)
-
-#### Develop branch
-
-Latest unstable version - [![Latest Unstable Version](https://poser.pugx.org/league/oauth2-server/v/unstable.png)](https://packagist.org/packages/league/oauth2-server)
-Code coverage - [![Coverage Status](https://coveralls.io/repos/php-loep/oauth2-server/badge.png?branch=develop)](https://coveralls.io/r/php-loep/oauth2-server?branch=develop)
+* [Laravel Service Provider](https://packagist.org/packages/lucadegasperi/oauth2-server-laravel) by @lucadegasperi
+* [Laravel Eloquent implementation](https://github.com/ScubaClick/scubaclick-oauth2) by @ScubaClick (under development)
 
 ---
 
 The library features 100% unit test code coverage. To run the tests yourself run `phpunit` from the project root.
 
+[![Build Status](https://travis-ci.org/thephpleague/oauth2-server.png?branch=master)](https://travis-ci.org/thephpleague/oauth2-server) [master]
+
+[![Build Status](https://travis-ci.org/thephpleague/oauth2-server.png?branch=develop)](https://travis-ci.org/thephpleague/oauth2-server) [develop]
+
+
 ## Current Features
 
 ### Authorization Server
@@ -40,7 +42,7 @@ The authorization server is a flexible class and the following core specificatio
 * client credentials ([section 2.3.1](http://tools.ietf.org/html/rfc6749#section-2.3.1))
 * password (user credentials) ([section 4.3](http://tools.ietf.org/html/rfc6749#section-4.3))
 
-An overview of the different OAuth 2.0 grants can be found in the wiki [https://github.com/php-loep/oauth2-server/wiki/Which-OAuth-2.0-grant-should-I-use%3F](https://github.com/php-loep/oauth2-server/wiki/Which-OAuth-2.0-grant-should-I-use%3F).
+An [overview of the different OAuth 2.0 grants](https://github.com/thephpleague/oauth2-server/wiki/Which-OAuth-2.0-grant-should-I-use%3F) can be found in the [wiki].
 
 ### Resource Server
 
@@ -48,35 +50,35 @@ The resource server allows you to secure your API endpoints by checking for a va
 
 ### Custom grants
 
-Custom grants can be created easily by implementing an interface. Check out a guide here [https://github.com/php-loep/oauth2-server/wiki/Creating-custom-grants](https://github.com/php-loep/oauth2-server/wiki/Creating-custom-grants).
+Custom grants can be created easily by implementing an interface. Check out the [custom grant guide](https://github.com/thephpleague/oauth2-server/wiki/Creating-custom-grants).
 
-### PDO driver
+## Tutorials and Documentation
 
-If you are using MySQL and want to very quickly implement the library then all of the storage interfaces have been implemented with PDO classes. Check out the guide here [https://github.com/php-loep/oauth2-server/wiki/Using-the-PDO-storage-classes](https://github.com/php-loep/oauth2-server/wiki/Using-the-PDO-storage-classes).
+* **[Wiki]** - The wiki has lots of guides on how to use this library.
 
-## Tutorials and documentation
+* **[Developing an OAuth-2.0 Authorization Server]** - A simple tutorial on how to use the authorization server.
 
-The wiki has lots of guides on how to use this library, check it out - [https://github.com/php-loep/oauth2-server/wiki](https://github.com/php-loep/oauth2-server/wiki).
+* **[Securing your API with OAuth 2.0]** - A simple tutorial on how to use the resource server to secure an API server.
 
-A simple tutorial on how to use the authorization server can be found at [https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server](https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server).
-
-A simple tutorial on how to use the resource server to secure an API server can be found at [https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0](https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0).
+[Wiki]: https://github.com/thephpleague/oauth2-server/wiki
+[Securing your API with OAuth 2.0]: https://github.com/thephpleague/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0
+[Developing an OAuth-2.0 Authorization Server]: https://github.com/thephpleague/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server
 
 ## Changelog
 
-[See the project releases page](https://github.com/php-loep/oauth2-server/releases)
+[See the project releases page](https://github.com/thephpleague/oauth2-server/releases)
 
 ## Contributing
 
-Please see [CONTRIBUTING](https://github.com/php-loep/oauth2-server/blob/master/CONTRIBUTING.md) for details.
+Please see [CONTRIBUTING](https://github.com/thephpleague/oauth2-server/blob/master/CONTRIBUTING.md) for details.
 
 ## Support
 
-Bugs and feature request are tracked on [GitHub](https://github.com/php-loep/oauth2-server/issues)
+Bugs and feature request are tracked on [GitHub](https://github.com/thephpleague/oauth2-server/issues)
 
 ## License
 
-This package is released under the MIT License. See the bundled [LICENSE](https://github.com/php-loep/oauth2-server/blob/master/LICENSE) file for details.
+This package is released under the MIT License. See the bundled [LICENSE](https://github.com/thephpleague/oauth2-server/blob/master/LICENSE) file for details.
 
 ## Credits
 
@@ -88,6 +90,8 @@ Special thanks to:
 * [Nick Jackson](https://github.com/jacksonj04)
 * [Michael Gooden](https://github.com/MichaelGooden)
 * [Phil Sturgeon](https://github.com/philsturgeon)
-* [and all the other contributors](https://github.com/php-loep/oauth2-server/contributors)
+* [and all the other contributors](https://github.com/thephpleague/oauth2-server/contributors)
 
-The initial code was developed as part of the [Linkey](http://linkey.blogs.lincoln.ac.uk) project which was funded by [JISC](http://jisc.ac.uk) under the Access and Identity Management programme.
+The initial code was developed as part of the [Linkey](http://linkey.blogs.lincoln.ac.uk) project which was funded by [JISC](http://jisc.ac.uk) under the Access and Identity Management programme.
+
+[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/thephpleague/oauth2-server/trend.png)](https://bitdeli.com/free "Bitdeli Badge")

composer.json

@@ -1,8 +1,7 @@
 {
 	"name": "league/oauth2-server",
 	"description": "A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.",
-	"version": "3.1",
-	"homepage": "https://github.com/php-loep/oauth2-server",
+	"version": "3.2",
 	"license": "MIT",
 	"require": {
 		"php": ">=5.4.0"
@@ -14,7 +13,7 @@
 	"repositories": [
 		{
 			"type": "git",
-			"url": "https://github.com/php-loep/oauth2-server.git"
+			"url": "https://github.com/thephpleague/oauth2-server.git"
 		}
 	],
 	"keywords": [
@@ -38,8 +37,7 @@
 		}
 	],
 	"replace": {
-		"lncd/oauth2": "*",
-		"league/oauth2server": "*"
+		"lncd/oauth2": "*"
 	},
 	"autoload": {
 		"psr-0": {
@@ -49,4 +47,4 @@
 	"suggest": {
 
 	}
-}
+}

src/League/OAuth2/Server/Resource.php

@@ -185,7 +185,7 @@ class Resource
 
         $result = $this->storages['session']->validateAccessToken($accessToken);
 
-        if ( ! $result) {
+        if (! $result) {
             throw new Exception\InvalidAccessTokenException('Access token is not valid');
         }
 
@@ -227,7 +227,7 @@ class Resource
             return false;
         } elseif (is_array($scopes)) {
             foreach ($scopes as $scope) {
-                if ( ! in_array($scope, $this->sessionScopes)) {
+                if (! in_array($scope, $this->sessionScopes)) {
                     return false;
                 }
             }
@@ -246,7 +246,15 @@ class Resource
      */
     public function determineAccessToken($headersOnly = false)
     {
-        if ($header = $this->getRequest()->header('Authorization')) {
+        // Try to get it directly from a header
+        if (! $header = $this->getRequest()->header('Authorization')) {
+
+            // Failing that try getting it from a server variable
+            $header = $this->getRequest()->server('HTTP_AUTHORIZATION');
+        }
+
+        // One of them worked
+        if ($header) {
             // Check for special case, because cURL sometimes does an
             // internal second request and doubles the authorization header,
             // which always resulted in an error.
@@ -271,5 +279,4 @@ class Resource
 
         return $accessToken;
     }
-
 }

src/League/OAuth2/Server/Storage/SessionInterface.php

@@ -208,7 +208,7 @@ interface SessionInterface
      *  AND refresh_token_expires >= UNIX_TIMESTAMP(NOW()) AND client_id = :clientId
      * </code>
      *
-     * @param  string   $refreshToken The access token
+     * @param  string   $refreshToken The refresh token
      * @param  string   $clientId     The client ID
      * @return int|bool               The ID of the access token the refresh token is linked to (or false if invalid)
      */

src/League/OAuth2/Server/Util/KeyAlgorithm/DefaultAlgorithm.php

@@ -0,0 +1,38 @@
+<?php
+/**
+ * OAuth 2.0 Secure key default algorithm
+ *
+ * @package     php-loep/oauth2-server
+ * @author      Alex Bilbie <hello@alexbilbie.com>
+ * @copyright   Copyright (c) 2013 PHP League of Extraordinary Packages
+ * @license     http://mit-license.org/
+ * @link        http://github.com/php-loep/oauth2-server
+ */
+
+namespace League\OAuth2\Server\Util\KeyAlgorithm;
+
+
+class DefaultAlgorithm implements KeyAlgorithmInterface
+{
+    /**
+     * @param int $len
+     * @return string
+     * @throws \Exception
+     */
+    public function make($len = 40)
+    {
+        // We generate twice as many bytes here because we want to ensure we have
+        // enough after we base64 encode it to get the length we need because we
+        // take out the "/", "+", and "=" characters.
+        $bytes = openssl_random_pseudo_bytes($len * 2, $strong);
+
+        // We want to stop execution if the key fails because, well, that is bad.
+        if ($bytes === false || $strong === false) {
+            // @codeCoverageIgnoreStart
+            throw new \Exception('Error Generating Key');
+            // @codeCoverageIgnoreEnd
+        }
+
+        return substr(str_replace(array('/', '+', '='), '', base64_encode($bytes)), 0, $len);
+    }
+}

src/League/OAuth2/Server/Util/KeyAlgorithm/KeyAlgorithmInterface.php

@@ -0,0 +1,18 @@
+<?php
+/**
+ * OAuth 2.0 Key algorithm interface
+ *
+ * @package     php-loep/oauth2-server
+ * @author      Alex Bilbie <hello@alexbilbie.com>
+ * @copyright   Copyright (c) 2013 PHP League of Extraordinary Packages
+ * @license     http://mit-license.org/
+ * @link        http://github.com/php-loep/oauth2-server
+ */
+
+namespace League\OAuth2\Server\Util\KeyAlgorithm;
+
+
+interface KeyAlgorithmInterface
+{
+    public function make($len = 40);
+}

src/League/OAuth2/Server/Util/Request.php

@@ -119,7 +119,7 @@ class Request implements RequestInterface
     {
         $normalized = array();
         foreach ($headers as $key => $value) {
-            $normalized[$this->normalizeKey($key)] = $value;
+            $normalized[ucfirst($this->normalizeKey($key))] = $value;
         }
 
         return $normalized;

src/League/OAuth2/Server/Util/SecureKey.php

@@ -11,11 +11,16 @@
 
 namespace League\OAuth2\Server\Util;
 
+use League\OAuth2\Server\Util\KeyAlgorithm\DefaultAlgorithm;
+use League\OAuth2\Server\Util\KeyAlgorithm\KeyAlgorithmInterface;
+
 /**
  * SecureKey class
  */
 class SecureKey
 {
+    protected static $algorithm;
+
     /**
      * Generate a new unique code
      * @param  integer $len Length of the generated code
@@ -23,18 +28,27 @@ class SecureKey
      */
     public static function make($len = 40)
     {
-        // We generate twice as many bytes here because we want to ensure we have
-        // enough after we base64 encode it to get the length we need because we
-        // take out the "/", "+", and "=" characters.
-        $bytes = openssl_random_pseudo_bytes($len * 2, $strong);
+        return self::getAlgorithm()->make($len);
+    }
 
-        // We want to stop execution if the key fails because, well, that is bad.
-        if ($bytes === false || $strong === false) {
-            // @codeCoverageIgnoreStart
-            throw new \Exception('Error Generating Key');
-            // @codeCoverageIgnoreEnd
+    /**
+     * @param KeyAlgorithmInterface $algorithm
+     */
+    public static function setAlgorithm(KeyAlgorithmInterface $algorithm)
+    {
+        self::$algorithm = $algorithm;
+    }
+
+    /**
+     * @return KeyAlgorithmInterface
+     */
+    public static function getAlgorithm()
+    {
+        if (!self::$algorithm) {
+
+            self::$algorithm = new DefaultAlgorithm();
         }
 
-        return substr(str_replace(array('/', '+', '='), '', base64_encode($bytes)), 0, $len);
+        return self::$algorithm;
     }
 }

tests/authorization/AuthServerTest.php

@@ -386,7 +386,6 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     public function test_issueAccessToken()
@@ -425,7 +424,6 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     public function test_issueAccessToken_customExpiresIn()
@@ -507,7 +505,6 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     public function tearDown() {

tests/authorization/ClientCredentialsGrantTest.php

@@ -290,7 +290,6 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     function test_issueAccessToken_clientCredentialsGrant()
@@ -328,7 +327,6 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     function test_issueAccessToken_clientCredentialsGrant_customExpiresIn()
@@ -408,7 +406,6 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
 }

tests/authorization/PasswordGrantTest.php

@@ -471,7 +471,6 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     function test_issueAccessToken_passwordGrant()
@@ -516,7 +515,6 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     function test_issueAccessToken_passwordGrant_customExpiresIn()
@@ -611,7 +609,5 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('refresh_token', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
-
 }

tests/authorization/RefreshTokenTest.php

@@ -67,7 +67,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('refresh_token', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     /**
@@ -208,7 +207,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     public function test_issueAccessToken_refreshTokenGrant()
@@ -247,7 +245,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('expires_in', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     public function test_issueAccessToken_refreshTokenGrant_rotateTokens()
@@ -290,7 +287,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
         $this->assertArrayHasKey('refresh_token', $v);
 
         $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
-        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
     }
 
     public function test_issueAccessToken_refreshTokenGrant_customExpiresIn()

tests/util/SecureKeyTest.php

@@ -12,4 +12,21 @@ class Secure_Key_test extends PHPUnit_Framework_TestCase
 		$this->assertTrue($v1 !== $v2);
 		$this->assertEquals(50, strlen($v3));
 	}
+
+    public function test_make_with_different_algorithm()
+    {
+        $algorithm = $this->getMock('League\OAuth2\Server\Util\KeyAlgorithm\KeyAlgorithmInterface');
+
+        $result = 'dasdsdsaads';
+        $algorithm
+            ->expects($this->once())
+            ->method('make')
+            ->with(11)
+            ->will($this->returnValue($result))
+        ;
+
+        League\OAuth2\Server\Util\SecureKey::setAlgorithm($algorithm);
+        $this->assertSame($algorithm, League\OAuth2\Server\Util\SecureKey::getAlgorithm());
+        $this->assertEquals($result, League\OAuth2\Server\Util\SecureKey::make(11));
+    }
 }

tests/util/key_algorithm/DefaultAlgorithmTest.php

@@ -0,0 +1,22 @@
+<?php
+/**
+ * Created by PhpStorm.
+ * User: jderay
+ * Date: 3/11/14
+ * Time: 12:31 PM
+ */
+
+class Default_Algorithm_test extends PHPUnit_Framework_TestCase
+{
+    public function test_make()
+    {
+        $algorithm = new League\OAuth2\Server\Util\KeyAlgorithm\DefaultAlgorithm();
+        $v1 = $algorithm->make();
+        $v2 = $algorithm->make();
+        $v3 = $algorithm->make(50);
+
+        $this->assertEquals(40, strlen($v1));
+        $this->assertTrue($v1 !== $v2);
+        $this->assertEquals(50, strlen($v3));
+    }
+}