Chadicus\Slim\OAuth2\Middleware\Authorization

Complexity

Total Complexity

10

Size/Duplication

Total Lines	133
Duplicated Lines	0 %

Coupling/Cohesion

Components

1

Importance

Changes	2
Bugs	0	Features	0

6 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	5	1
A	hp$0 ➔ handle()	0	4	1
B	__invoke()	0	25	1
A	process()	0	18	4
A	withRequiredScope()	0	6	1
A	formatScopes()	0	17	3

<?php
namespace Chadicus\Slim\OAuth2\Middleware;

use Chadicus\Slim\OAuth2\Http\RequestBridge;
use Chadicus\Slim\OAuth2\Http\ResponseBridge;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use OAuth2;

/**
 * Slim Middleware to handle OAuth2 Authorization.
 */
class Authorization implements MiddlewareInterface
{
    /**
     * OAuth2 Server
     *
     * @var OAuth2\Server
     */
    private $server;

    /**
     * Array of scopes required for authorization.
     *
     * @var array
     */
    private $scopes;

    /**
     * Create a new instance of the Authroization middleware.
     *
     * @param OAuth2\Server $server The configured OAuth2 server.
     * @param array         $scopes Scopes required for authorization. $scopes can be given as an array of arrays.
     *                              OR logic will use with each grouping.
     *                              Example: Given ['superUser', ['basicUser', 'aPermission']], the request will be
     *                              verified if the request token has 'superUser' scope OR 'basicUser' and
     *                              'aPermission' as its scope.
     */
    public function __construct(OAuth2\Server $server, array $scopes = [])
    {
        $this->server = $server;
        $this->scopes = $this->formatScopes($scopes);
    }

    /**
     * Execute this middleware as a function.
     *
     * @param  ServerRequestInterface $request  The PSR7 request.
     * @param  ResponseInterface      $response The PSR7 response.
     * @param  callable               $next     The Next middleware.
     *
     * @return ResponseInterface
     */
    public function __invoke(ServerRequestInterface $request, ResponseInterface $response, callable $next)
    {
        $handler = new class implements RequestHandlerInterface

Missing class doc comment

This class is not in CamelCase format.

        {
            public $next;
            public $response;

            /**
             * Handle the request and return a response.
             *
             * @param ServerRequestInterface $request The request to handle.
             *
             * @return ResponseInterface
             */
            public function handle(ServerRequestInterface $request): ResponseInterface
            {
                return call_user_func_array($this->next, [$request, $this->response]);
            }
        };

        $handler->next = $next;
        $handler->response = $response;

        return $this->process($request, $handler);
    }

    /**
     * Execute this middleware.
     *
     * @param ServerRequestInterface  $request The PSR-7 request.
     * @param RequestHandlerInterface $handler The PSR-15 request handler.
     *
     * @return ResponseInterface
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
    {
        $oauth2Request = RequestBridge::toOAuth2($request);
        foreach ($this->scopes as $scope) {
            if ($this->server->verifyResourceRequest($oauth2Request, null, $scope)) {
                $token = $this->server->getResourceController()->getToken();

It seems like you code against a concrete implementation and not the interface OAuth2\Controller\ResourceControllerInterface as the method getToken() does only exist in the following implementations of said interface: OAuth2\Controller\ResourceController, OAuth2\OpenID\Controller\UserInfoController.

                return $handler->handle($request->withAttribute('oauth2-token', $token));
            }
        }

        $response = ResponseBridge::fromOauth2($this->server->getResponse());

$this->server->getResponse() of type object<OAuth2\ResponseInterface> is not a sub-type of object<OAuth2\Response>. It seems like you assume a concrete implementation of the interface OAuth2\ResponseInterface to be always present.

        if ($response->hasHeader('Content-Type')) {
            return $response;
        }

        return $response->withHeader('Content-Type', 'application/json');
    }

    /**
     * Returns a callable function to be used as a authorization middleware with a specified scope.
     *
     * @param array $scopes Scopes require for authorization.
     *
     * @return Authorization
     */
    public function withRequiredScope(array $scopes)
    {
        $clone = clone $this;
        $clone->scopes = $clone->formatScopes($scopes);
        return $clone;
    }

    /**
     * Helper method to ensure given scopes are formatted properly.
     *
     * @param array $scopes Scopes required for authorization.
     *
     * @return array The formatted scopes array.
     */
    private function formatScopes(array $scopes)
    {
        if (empty($scopes)) {
            return [null]; //use at least 1 null scope
        }

        array_walk(
            $scopes,
            function (&$scope) {
                if (is_array($scope)) {
                    $scope = implode(' ', $scope);
                }
            }
        );

        return $scopes;
    }
}