OAuth2Framework\Component\Server\Scope\TokenEndpointScopeExtension

Complexity

Total Complexity

15

Size/Duplication

Total Lines	114
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	6

Importance

Changes

0

7 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	5	1
A	beforeAccessTokenIssuance()	0	14	2
A	afterAccessTokenIssuance()	0	4	1
A	getScope()	0	9	3
A	applyScopePolicy()	0	8	2
A	checkRequestedScopeIsAvailable()	0	14	4
A	getAvailableScopesForClient()	0	4	2

<?php

declare(strict_types=1);

/*
 * The MIT License (MIT)
 *
 * Copyright (c) 2014-2018 Spomky-Labs
 *
 * This software may be modified and distributed under the terms
 * of the MIT license.  See the LICENSE file for details.
 */

namespace OAuth2Framework\Component\Server\Scope;

use OAuth2Framework\Component\Server\Core\AccessToken\AccessToken;
use OAuth2Framework\Component\Server\Core\Client\Client;
use OAuth2Framework\Component\Server\Core\ResourceOwner\ResourceOwner;
use OAuth2Framework\Component\Server\TokenEndpoint\Extension\TokenEndpointExtension;
use OAuth2Framework\Component\Server\TokenEndpoint\GrantTypeData;
use OAuth2Framework\Component\Server\TokenEndpoint\GrantType;
use OAuth2Framework\Component\Server\Scope\Policy\ScopePolicyManager;
use OAuth2Framework\Component\Server\Core\Response\OAuth2Exception;
use Psr\Http\Message\ServerRequestInterface;

final class TokenEndpointScopeExtension implements TokenEndpointExtension
{
    /**
     * @var ScopeRepository
     */
    private $scopeRepository;

    /**
     * @var ScopePolicyManager
     */
    private $scopePolicyManager;

    /**
     * ScopeProcessor constructor.
     *
     * @param ScopeRepository         $scopeRepository
     * @param ScopePolicyManager $scopePolicyManager
     */
    public function __construct(ScopeRepository $scopeRepository, ScopePolicyManager $scopePolicyManager)
    {
        $this->scopeRepository = $scopeRepository;
        $this->scopePolicyManager = $scopePolicyManager;
    }

    /**
     * {@inheritdoc}
     */
    public function beforeAccessTokenIssuance(ServerRequestInterface $request, GrantTypeData $grantTypeData, GrantType $grantType, callable $next): GrantTypeData
    {
        /** @var GrantTypeData $grantTypeData */
        $grantTypeData = $next($request, $grantTypeData, $grantType);
        $scope = $this->getScope($request, $grantTypeData);
        $scope = $this->applyScopePolicy($scope, $grantTypeData->getClient());

It seems like $grantTypeData->getClient() can be null; however, applyScopePolicy() does not accept null, maybe add an additional type check?

        $this->checkRequestedScopeIsAvailable($scope, $grantTypeData);

        if (!empty($scope)) {
            $grantTypeData = $grantTypeData->withParameter('scope', $scope);
        }

        return $grantTypeData;
    }

    /**
     * {@inheritdoc}
     */
    public function afterAccessTokenIssuance(Client $client, ResourceOwner $resourceOwner, AccessToken $accessToken, callable $next): array
    {
        return $next($client, $resourceOwner, $accessToken);
    }

    /**
     * @param ServerRequestInterface $request
     * @param GrantTypeData          $grantTypeData
     *
     * @return string
     */
    private function getScope(ServerRequestInterface $request, GrantTypeData $grantTypeData): string
    {
        $params = $request->getParsedBody() ?? [];
        if (!array_key_exists('scope', $params)) {
            return $grantTypeData->hasParameter('scope') ? $grantTypeData->getParameter('scope') : '';
        }

        return $params['scope'];
    }

    /**
     * @param string $scope
     * @param Client $client
     *
     * @return string
     *
     * @throws OAuth2Exception
     */
    private function applyScopePolicy(string $scope, Client $client): string
    {
        try {
            return $this->scopePolicyManager->apply($scope, $client);
        } catch (\InvalidArgumentException $e) {
            throw new OAuth2Exception(400, OAuth2Exception::ERROR_INVALID_SCOPE, $e->getMessage(), [], $e);
        }
    }

    /**
     * @param string        $scope
     * @param GrantTypeData $grantTypeData
     *
     * @throws OAuth2Exception
     */
    private function checkRequestedScopeIsAvailable(string $scope, GrantTypeData $grantTypeData)
    {
        // The available scope can be limited by (in this order):
        // * the grant type (e.g. refresh token, authorization code parameter)
        // * the client configuration
        // * the scope repository
        $availableScope = $grantTypeData->hasParameter('scope') ? $grantTypeData->getParameter('scope') : $this->getAvailableScopesForClient($grantTypeData->getClient());

It seems like $grantTypeData->getClient() can be null; however, getAvailableScopesForClient() does not accept null, maybe add an additional type check?

        $availableScopes = explode(' ', $availableScope);
        $requestedScopes = empty($scope) ? [] : explode(' ', $scope);
        $diff = array_diff($requestedScopes, $availableScopes);
        if (0 !== count($diff)) {
            throw new OAuth2Exception(400, OAuth2Exception::ERROR_INVALID_SCOPE, sprintf('An unsupported scope was requested. Available scope is/are: %s.', implode(' ,', $availableScopes)));
        }
    }

    /**
     * @param Client $client
     *
     * @return string
     */
    private function getAvailableScopesForClient(Client $client): string
    {
        return ($client->has('scope')) ? $client->get('scope') : implode(' ', $this->scopeRepository->all());
    }
}