Changelog update

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 4.0.4 (released 2014-12-03)
+
+* Ensure refresh token hasn't expired (Issue #270)
+
 ## 4.0.3 (released 2014-12-02)
 
 * Fix bad type hintings (Issue #267)

src/Grant/AuthCodeGrant.php

@@ -166,21 +166,16 @@ class AuthCodeGrant extends AbstractGrant
     public function completeFlow()
     {
         // Get the required params
-        $clientId = $this->server->getRequest()->request->get('client_id', null);
+        $clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
-        if (is_null($clientId)) {
-            $clientId = $this->server->getRequest()->getUser();
         if (is_null($clientId)) {
             throw new Exception\InvalidRequestException('client_id');
         }
-        }
 
-        $clientSecret = $this->server->getRequest()->request->get('client_secret', null);
+        $clientSecret = $this->server->getRequest()->request->get('client_secret',
-        if (is_null($clientSecret)) {
+            $this->server->getRequest()->getPassword());
-            $clientSecret = $this->server->getRequest()->getPassword();
         if (is_null($clientSecret)) {
             throw new Exception\InvalidRequestException('client_secret');
         }
-        }
 
         $redirectUri = $this->server->getRequest()->request->get('redirect_uri', null);
         if (is_null($redirectUri)) {

src/Grant/ClientCredentialsGrant.php

@@ -55,21 +55,16 @@ class ClientCredentialsGrant extends AbstractGrant
     public function completeFlow()
     {
         // Get the required params
-        $clientId = $this->server->getRequest()->request->get('client_id', null);
+        $clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
-        if (is_null($clientId)) {
-            $clientId = $this->server->getRequest()->getUser();
         if (is_null($clientId)) {
             throw new Exception\InvalidRequestException('client_id');
         }
-        }
 
-        $clientSecret = $this->server->getRequest()->request->get('client_secret', null);
+        $clientSecret = $this->server->getRequest()->request->get('client_secret',
-        if (is_null($clientSecret)) {
+            $this->server->getRequest()->getPassword());
-            $clientSecret = $this->server->getRequest()->getPassword();
         if (is_null($clientSecret)) {
             throw new Exception\InvalidRequestException('client_secret');
         }
-        }
 
         // Validate client ID and client secret
         $client = $this->server->getClientStorage()->get(

src/Grant/PasswordGrant.php

@@ -80,21 +80,16 @@ class PasswordGrant extends AbstractGrant
     public function completeFlow()
     {
         // Get the required params
-        $clientId = $this->server->getRequest()->request->get('client_id', null);
+        $clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
-        if (is_null($clientId)) {
-            $clientId = $this->server->getRequest()->getUser();
         if (is_null($clientId)) {
             throw new Exception\InvalidRequestException('client_id');
         }
-        }
 
-        $clientSecret = $this->server->getRequest()->request->get('client_secret', null);
+        $clientSecret = $this->server->getRequest()->request->get('client_secret',
-        if (is_null($clientSecret)) {
+            $this->server->getRequest()->getPassword());
-            $clientSecret = $this->server->getRequest()->getPassword();
         if (is_null($clientSecret)) {
             throw new Exception\InvalidRequestException('client_secret');
         }
-        }
 
         // Validate client ID and client secret
         $client = $this->server->getClientStorage()->get(

src/Grant/RefreshTokenGrant.php

@@ -58,21 +58,16 @@ class RefreshTokenGrant extends AbstractGrant
      */
     public function completeFlow()
     {
-        $clientId = $this->server->getRequest()->request->get('client_id', null);
+        $clientId = $this->server->getRequest()->request->get('client_id', $this->server->getRequest()->getUser());
-        if (is_null($clientId)) {
-            $clientId = $this->server->getRequest()->getUser();
         if (is_null($clientId)) {
             throw new Exception\InvalidRequestException('client_id');
         }
-        }
 
-        $clientSecret = $this->server->getRequest()->request->get('client_secret', null);
+        $clientSecret = $this->server->getRequest()->request->get('client_secret',
-        if (is_null($clientSecret)) {
+            $this->server->getRequest()->getPassword());
-            $clientSecret = $this->server->getRequest()->getPassword();
         if (is_null($clientSecret)) {
             throw new Exception\InvalidRequestException('client_secret');
         }
-        }
 
         // Validate client ID and client secret
         $client = $this->server->getClientStorage()->get(
@@ -99,6 +94,11 @@ class RefreshTokenGrant extends AbstractGrant
             throw new Exception\InvalidRefreshException();
         }
 
+        // Ensure the old refresh token hasn't expired
+        if ($oldRefreshToken->isExpired() === true) {
+            throw new Exception\InvalidRefreshException();
+        }
+
         $oldAccessToken = $oldRefreshToken->getAccessToken();
 
         // Get the scopes for the original session

tests/unit/Grant/RefreshTokenGrantTest.php

@@ -190,7 +190,7 @@ class RefreshTokenGrantTest extends \PHPUnit_Framework_TestCase
         $refreshTokenStorage->shouldReceive('delete');
         $refreshTokenStorage->shouldReceive('create');
         $refreshTokenStorage->shouldReceive('get')->andReturn(
-            (new RefreshTokenEntity($server))
+            (new RefreshTokenEntity($server))->setExpireTime(time() + 86400)
         );
 
         $scopeStorage = M::mock('League\OAuth2\Server\Storage\ScopeInterface');
@@ -261,7 +261,7 @@ class RefreshTokenGrantTest extends \PHPUnit_Framework_TestCase
         $refreshTokenStorage->shouldReceive('delete');
         $refreshTokenStorage->shouldReceive('create');
         $refreshTokenStorage->shouldReceive('get')->andReturn(
-            (new RefreshTokenEntity($server))
+            (new RefreshTokenEntity($server))->setExpireTime(time() + 86400)
         );
 
         $scopeStorage = M::mock('League\OAuth2\Server\Storage\ScopeInterface');
@@ -285,6 +285,74 @@ class RefreshTokenGrantTest extends \PHPUnit_Framework_TestCase
         $this->assertTrue(isset($response['expires_in']));
     }
 
+    public function testCompleteFlowExpiredRefreshToken()
+    {
+        $this->setExpectedException('League\OAuth2\Server\Exception\InvalidRefreshException');
+        
+        $_POST = [
+            'grant_type'    => 'refresh_token',
+            'client_id'     =>  'testapp',
+            'client_secret' =>  'foobar',
+            'refresh_token' =>  'refresh_token',
+            'scope'         =>  'foo',
+        ];
+
+        $server = new AuthorizationServer();
+        $grant = new RefreshTokenGrant();
+
+        $oldSession = (new SessionEntity($server))->associateScope((new ScopeEntity($server))->hydrate(['id' => 'foo']));
+
+        $clientStorage = M::mock('League\OAuth2\Server\Storage\ClientInterface');
+        $clientStorage->shouldReceive('setServer');
+        $clientStorage->shouldReceive('get')->andReturn(
+            (new ClientEntity($server))->hydrate(['id' => 'testapp'])
+        );
+
+        $sessionStorage = M::mock('League\OAuth2\Server\Storage\SessionInterface');
+        $sessionStorage->shouldReceive('setServer');
+        $sessionStorage->shouldReceive('getScopes')->shouldReceive('getScopes')->andReturn([]);
+        $sessionStorage->shouldReceive('associateScope');
+        $sessionStorage->shouldReceive('getByAccessToken')->andReturn(
+            $oldSession
+        );
+
+        $accessTokenStorage = M::mock('League\OAuth2\Server\Storage\AccessTokenInterface');
+        $accessTokenStorage->shouldReceive('setServer');
+        $accessTokenStorage->shouldReceive('get')->andReturn(
+            (new AccessTokenEntity($server))
+        );
+        $accessTokenStorage->shouldReceive('delete');
+        $accessTokenStorage->shouldReceive('create');
+        $accessTokenStorage->shouldReceive('getScopes')->andReturn([
+            (new ScopeEntity($server))->hydrate(['id' => 'foo']),
+        ]);
+        $accessTokenStorage->shouldReceive('associateScope');
+
+        $refreshTokenStorage = M::mock('League\OAuth2\Server\Storage\RefreshTokenInterface');
+        $refreshTokenStorage->shouldReceive('setServer');
+        $refreshTokenStorage->shouldReceive('associateScope');
+        $refreshTokenStorage->shouldReceive('delete');
+        $refreshTokenStorage->shouldReceive('create');
+        $refreshTokenStorage->shouldReceive('get')->andReturn(
+            (new RefreshTokenEntity($server))
+        );
+
+        $scopeStorage = M::mock('League\OAuth2\Server\Storage\ScopeInterface');
+        $scopeStorage->shouldReceive('setServer');
+        $scopeStorage->shouldReceive('get')->andReturn(
+            (new ScopeEntity($server))->hydrate(['id' => 'foo'])
+        );
+
+        $server->setClientStorage($clientStorage);
+        $server->setScopeStorage($scopeStorage);
+        $server->setSessionStorage($sessionStorage);
+        $server->setAccessTokenStorage($accessTokenStorage);
+        $server->setRefreshTokenStorage($refreshTokenStorage);
+
+        $server->addGrantType($grant);
+        $server->issueAccessToken();
+    }
+
     public function testCompleteFlowRequestScopesInvalid()
     {
         $_POST = [
@@ -332,7 +400,7 @@ class RefreshTokenGrantTest extends \PHPUnit_Framework_TestCase
         $refreshTokenStorage->shouldReceive('delete');
         $refreshTokenStorage->shouldReceive('create');
         $refreshTokenStorage->shouldReceive('get')->andReturn(
-            (new RefreshTokenEntity($server))
+            (new RefreshTokenEntity($server))->setExpireTime(time() + 86400)
         );
 
         $scopeStorage = M::mock('League\OAuth2\Server\Storage\ScopeInterface');