OAuth2Framework\Component\Scope\ScopeParameterChecker

Complexity

Total Complexity

7

Size/Duplication

Total Lines	43
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	4

Importance

Changes

0

3 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	5	1
A	check()	0	16	3
A	getRequestedScope()	0	13	3

<?php

declare(strict_types=1);

/*
 * The MIT License (MIT)
 *
 * Copyright (c) 2014-2018 Spomky-Labs
 *
 * This software may be modified and distributed under the terms
 * of the MIT license.  See the LICENSE file for details.
 */

namespace OAuth2Framework\Component\Scope;

use OAuth2Framework\Component\AuthorizationEndpoint\AuthorizationRequest\AuthorizationRequest;
use OAuth2Framework\Component\AuthorizationEndpoint\ParameterChecker\ParameterChecker;
use OAuth2Framework\Component\Scope\Policy\ScopePolicyManager;

class ScopeParameterChecker implements ParameterChecker
{
    private $scopeRepository;

    private $scopePolicyManager;

    public function __construct(ScopeRepository $scopeRepository, ScopePolicyManager $scopePolicyManager)
    {
        $this->scopeRepository = $scopeRepository;
        $this->scopePolicyManager = $scopePolicyManager;
    }

    public function check(AuthorizationRequest $authorization): void
    {
        $requestedScope = $this->getRequestedScope($authorization);
        $requestedScope = $this->scopePolicyManager->apply($requestedScope, $authorization->getClient());
        if (empty($requestedScope)) {
            return;
        }
        $scopes = \explode(' ', $requestedScope);

        $availableScopes = $this->scopeRepository->all();
        if (0 !== \count(\array_diff($scopes, $availableScopes))) {
            throw new \InvalidArgumentException(\Safe\sprintf('An unsupported scope was requested. Available scopes are %s.', \implode(', ', $availableScopes)));
        }
        $authorization->getMetadata()->set('scope', \implode(' ', $scopes));
        $authorization->setResponseParameter('scope', \implode(' ', $scopes)); //TODO: should be done after consent depending on approved scope
    }

    private function getRequestedScope(AuthorizationRequest $authorization): string
    {
        if ($authorization->hasQueryParam('scope')) {
            $requestedScope = $authorization->getQueryParam('scope');
            if (1 !== \Safe\preg_match('/^[\x20\x23-\x5B\x5D-\x7E]+$/', $requestedScope)) {
                throw new \InvalidArgumentException('Invalid characters found in the "scope" parameter.');
            }
        } else {
            $requestedScope = '';
        }

        return $requestedScope;
    }
}