Bgy\OAuth2\AuthorizationServer

Complexity

Total Complexity

20

Size/Duplication

Total Lines	180
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	16

Importance

Changes	4
Bugs	1	Features	2

10 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	7	1
C	requestAccessToken()	0	48	7
A	checkGrantType()	0	4	1
A	checkIfAClientIsAlwaysRequired()	0	5	1
A	checkIfAClientIsProvided()	0	4	1
A	checkIfTheProvidedClientIsValid()	0	7	1
A	checkIfClientSupportsRequestedGrantType()	0	8	1
B	buildAccessToken()	0	34	2
B	buildRefreshToken()	0	29	2
A	getGrantTypeByIdentifier()	0	11	3

<?php
/**
 * @author Boris Guéry <guery.b@gmail.com>
 */

namespace Bgy\OAuth2;

use Bgy\OAuth2\GrantType\GrantDecision;
use Bgy\OAuth2\GrantType\GrantError;
use Bgy\OAuth2\GrantType\GrantType;

class AuthorizationServer
{
    private $configuration;
    private $clientAuthenticator;

    public function __construct(AuthorizationServerConfiguration $configuration)
    {
        $this->configuration       = $configuration;
        $this->clientAuthenticator = new ClientAuthenticator(
            $this->configuration->getClientStorage()
        );
    }

    /**
     * @param TokenRequestAttempt $tokenRequestAttempt
     * @return FailedTokenRequestAttemptResult|SuccessfulTokenRequestAttemptResult
     */
    public function requestAccessToken(TokenRequestAttempt $tokenRequestAttempt)
    {
        if (!$this->checkGrantType($tokenRequestAttempt)) {

            return new FailedTokenRequestAttemptResult(GrantDecision::denied(GrantError::invalidGrant('Unknown grant type')));
        }

        if ($this->checkIfAClientIsAlwaysRequired()) {

            if (!$this->checkIfAClientIsProvided($tokenRequestAttempt)) {

                return new FailedTokenRequestAttemptResult(GrantDecision::denied(GrantError::invalidGrant('Missing client_id')));
            }

            if (!$this->checkIfTheProvidedClientIsValid($tokenRequestAttempt)) {

                return new FailedTokenRequestAttemptResult(GrantDecision::denied(GrantError::accessDenied('Invalid client credentials')));
            }

            if (!$this->checkIfClientSupportsRequestedGrantType($tokenRequestAttempt)) {

                return new FailedTokenRequestAttemptResult(
                    GrantDecision::denied(
                        GrantError::invalidGrant(
                            sprintf(
                                'This client doesn\'t support the following grant type: "%s"',
                                $tokenRequestAttempt->getGrantType()
                            )
                        )
                    )
                );
            }
        }

        $grantDecision = $this->getGrantTypeByIdentifier($tokenRequestAttempt->getGrantType())
            ->grant($tokenRequestAttempt)
        ;

        if ($grantDecision->equals(GrantDecision::allowed())) {

            $accessToken = $this->buildAccessToken($tokenRequestAttempt, $grantDecision);
            $refreshToken = $this->buildRefreshToken($accessToken);

            return new SuccessfulTokenRequestAttemptResult($grantDecision, $accessToken, $refreshToken);
        }

        return new FailedTokenRequestAttemptResult($grantDecision);
    }

    private function checkGrantType(TokenRequestAttempt $tokenRequestAttempt)
    {
        return (null !== $this->getGrantTypeByIdentifier($tokenRequestAttempt->getGrantType()));
    }

    private function checkIfAClientIsAlwaysRequired()
    {

        return $this->configuration->alwaysRequireAClient();
    }

    private function checkIfAClientIsProvided(TokenRequestAttempt $tokenRequestAttempt)
    {
        return (false === $tokenRequestAttempt->getInputData()->getClientId());
    }

    private function checkIfTheProvidedClientIsValid(TokenRequestAttempt $tokenRequestAttempt)
    {
        return $this->clientAuthenticator->isClientValid(
            $tokenRequestAttempt->getInputData()->getClientId(),
            $tokenRequestAttempt->getInputData()->getClientSecret()
        );
    }

    private function checkIfClientSupportsRequestedGrantType(TokenRequestAttempt $tokenRequestAttempt)
    {
        $client = $this->configuration->getClientStorage()
            ->findById($tokenRequestAttempt->getInputData()->getClientId())
        ;

        return in_array($tokenRequestAttempt->getGrantType(), $client->getAllowedGrantTypes());
    }

    private function buildAccessToken(TokenRequestAttempt $tokenRequestAttempt, GrantDecision $grantDecision)
    {
        if ($grantDecision->isDenied()) {

            throw new \LogicException('Unable to build an access token with a denied decision');
        }

        $token = $this->configuration->getTokenGenerator()->generate(
            ['length' => $this->configuration->getAccessTokenLength()]
        )
        ;

        $expiresAt = new \DateTime('now', new \DateTimeZone('UTC'));
        $expiresAt->add(
            \DateInterval::createFromDateString(
                sprintf(
                    "%d seconds",
                    $this->configuration->getAccessTokenTTL()
                )
            )
        );

        $accessToken = new AccessToken(
            $token,
            \DateTimeImmutable::createFromMutable($expiresAt),
            $tokenRequestAttempt->getInputData()->getClientId(),
            $grantDecision->getResourceOwner(),
            []
        );

        $this->configuration->getAccessTokenStorage()->save($accessToken);

        return $accessToken;
    }

    private function buildRefreshToken(AccessToken $accessToken)
    {
        $refreshToken = null;
        if ($this->configuration->alwaysGenerateARefreshToken()) {
            $token = $this->configuration->getTokenGenerator()->generate(
                ['length' => $this->configuration->getAccessTokenLength()]
            )
            ;
            $expiresAt = new \DateTime('now', new \DateTimeZone('UTC'));
            $expiresAt->add(
                \DateInterval::createFromDateString(
                    sprintf(
                        "%d seconds",
                        $this->configuration->getRefreshTokenTTL()
                    )
                )
            );

            $refreshToken = new RefreshToken(
                $token,
                $accessToken,
                \DateTimeImmutable::createFromMutable($expiresAt)
            );

            $this->configuration->getRefreshTokenStorage()->save($refreshToken);
        }

        return $refreshToken;
    }

    /**
     * @param $identifier
     * @return GrantType
     */
    private function getGrantTypeByIdentifier($identifier)
    {
        foreach ($this->configuration->getGrantTypeExtensions() as $grantTypeExtension) {
            if (strtolower($identifier) === strtolower($grantTypeExtension->getIdentifier())) {

                return $grantTypeExtension;
            }
        }

        return null;
    }
}