chadicus / slim-oauth2-middleware

src/Authorization.php

<?php
namespace Chadicus\Slim\OAuth2\Middleware;

use Chadicus\Slim\OAuth2\Http\RequestBridge;
use Chadicus\Slim\OAuth2\Http\ResponseBridge;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;
use OAuth2;
use Slim;

/**
 * Slim Middleware to handle OAuth2 Authorization.
 */
class Authorization implements MiddlewareInterface
{
    /**
     * Slim App
     *
     * @var Slim\App
     */
    private $slim;

    /**
     * OAuth2 Server
     *
     * @var OAuth2\Server
     */
    private $server;

    /**
     * Array of scopes required for authorization.
     *
     * @var array
     */
    private $scopes;

    /**
     * Create a new instance of the Authroization middleware.
     *
     * @param Slim\App      $slim   The slim framework application instance.
     * @param OAuth2\Server $server The configured OAuth2 server.
     * @param array         $scopes Scopes required for authorization. $scopes can be given as an array of arrays. OR
     *                              logic will use with each grouping.  Example:
     *                              Given ['superUser', ['basicUser', 'aPermission']], the request will be verified if
     *                              the request token has 'superUser' scope OR 'basicUser' and 'aPermission' as its
     *                              scope.
     */
    public function __construct(Slim\App $slim, OAuth2\Server $server, array $scopes = [])
    {
        $this->slim = $slim;
        $this->server = $server;
        $this->scopes = $scopes;
    }

    /**
     * Execute this middleware.
     *
     * @param  ServerRequestInterface $request  The PSR7 request.
     * @param  ResponseInterface      $response The PSR7 response.
     * @param  callable               $next     The Next middleware.
     *
     * @return Slim\Http\Response
     */
    public function __invoke(ServerRequestInterface $request, ResponseInterface $response, callable $next)
    {
        $oauth2Request = RequestBridge::toOAuth2($request);

        $scopes = $this->scopes;
        if (empty($scopes)) {
            $scopes = [null]; //use at least 1 null scope
        }

        foreach ($scopes as $scope) {
            if (is_array($scope)) {
                $scope = implode(' ', $scope);
            }

            if ($this->server->verifyResourceRequest($oauth2Request, null, $scope)) {
                $this->slim->getContainer()->token = $this->server->getResourceController()->getToken();

Accessing token on the interface Interop\Container\ContainerInterface suggest that you code against a concrete implementation. How about adding an instanceof check?

                return $next($request, $response);
            }
        }

        return ResponseBridge::fromOAuth2($this->server->getResponse());

$this->server->getResponse() of type object<OAuth2\ResponseInterface> is not a sub-type of object<OAuth2\Response>. It seems like you assume a concrete implementation of the interface OAuth2\ResponseInterface to be always present.

    }

    /**
     * Returns a callable function to be used as a authorization middleware with a specified scope.
     *
     * @param array $scopes Scopes require for authorization.
     *
     * @return Authorization
     */
    public function withRequiredScope(array $scopes)
    {
        $clone = clone $this;
        $clone->scopes = $scopes;
        return $clone;
    }
}