1
|
|
|
<?php declare(strict_types=1); |
2
|
|
|
|
3
|
|
|
namespace Limoncello\OAuthServer\GrantTraits; |
4
|
|
|
|
5
|
|
|
/** |
6
|
|
|
* Copyright 2015-2019 [email protected] |
7
|
|
|
* |
8
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
9
|
|
|
* you may not use this file except in compliance with the License. |
10
|
|
|
* You may obtain a copy of the License at |
11
|
|
|
* |
12
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0 |
13
|
|
|
* |
14
|
|
|
* Unless required by applicable law or agreed to in writing, software |
15
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS, |
16
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
17
|
|
|
* See the License for the specific language governing permissions and |
18
|
|
|
* limitations under the License. |
19
|
|
|
*/ |
20
|
|
|
|
21
|
|
|
use Limoncello\OAuthServer\Contracts\ClientInterface; |
22
|
|
|
use Limoncello\OAuthServer\Contracts\Integration\PasswordIntegrationInterface; |
23
|
|
|
use Limoncello\OAuthServer\Exceptions\OAuthTokenBodyException; |
24
|
|
|
use Psr\Http\Message\ResponseInterface; |
25
|
|
|
use function array_key_exists; |
26
|
|
|
use function explode; |
27
|
|
|
use function is_string; |
28
|
|
|
|
29
|
|
|
/** |
30
|
|
|
* Implements Resource Owner Password Credentials Grant. |
31
|
|
|
* |
32
|
|
|
* @package Limoncello\OAuthServer |
33
|
|
|
* |
34
|
|
|
* @link https://tools.ietf.org/html/rfc6749#section-1.3 |
35
|
|
|
* @link https://tools.ietf.org/html/rfc6749#section-4.3 |
36
|
|
|
*/ |
37
|
|
|
trait PasswordGrantTrait |
38
|
|
|
{ |
39
|
|
|
/** |
40
|
|
|
* @var PasswordIntegrationInterface |
41
|
|
|
*/ |
42
|
6 |
|
private $passIntegration; |
43
|
|
|
|
44
|
6 |
|
/** |
45
|
|
|
* @return PasswordIntegrationInterface |
46
|
|
|
*/ |
47
|
|
|
protected function passGetIntegration(): PasswordIntegrationInterface |
48
|
|
|
{ |
49
|
|
|
return $this->passIntegration; |
50
|
|
|
} |
51
|
|
|
|
52
|
44 |
|
/** |
53
|
|
|
* @param PasswordIntegrationInterface $passIntegration |
54
|
44 |
|
* |
55
|
|
|
* @return void |
56
|
|
|
*/ |
57
|
|
|
public function passSetIntegration(PasswordIntegrationInterface $passIntegration): void |
58
|
|
|
{ |
59
|
|
|
$this->passIntegration = $passIntegration; |
60
|
|
|
} |
61
|
|
|
|
62
|
4 |
|
/** |
63
|
|
|
* @param string[] $parameters |
64
|
4 |
|
* |
65
|
|
|
* @return string|null |
66
|
|
|
*/ |
67
|
|
|
protected function passGetUserName(array $parameters): ?string |
68
|
|
|
{ |
69
|
|
|
return $this->passReadStringValue($parameters, 'username'); |
70
|
|
|
} |
71
|
|
|
|
72
|
3 |
|
/** |
73
|
|
|
* @param string[] $parameters |
74
|
3 |
|
* |
75
|
|
|
* @return string|null |
76
|
|
|
*/ |
77
|
|
|
protected function passGetPassword(array $parameters): ?string |
78
|
|
|
{ |
79
|
|
|
return $this->passReadStringValue($parameters, 'password'); |
80
|
|
|
} |
81
|
|
|
|
82
|
5 |
|
/** |
83
|
|
|
* @param string[] $parameters |
84
|
5 |
|
* |
85
|
|
|
* @return string[]|null |
|
|
|
|
86
|
5 |
|
*/ |
87
|
|
|
protected function passGetScope(array $parameters): ?array |
88
|
|
|
{ |
89
|
|
|
$scope = $this->passReadStringValue($parameters, 'scope'); |
90
|
|
|
|
91
|
|
|
return empty($scope) === false ? explode(' ', $scope) : null; |
92
|
|
|
} |
93
|
|
|
|
94
|
|
|
/** |
95
|
7 |
|
* @param string[] $parameters |
96
|
|
|
* @param ClientInterface|null $determinedClient |
97
|
|
|
* |
98
|
7 |
|
* @return ResponseInterface |
99
|
6 |
|
*/ |
100
|
6 |
|
protected function passIssueToken(array $parameters, ClientInterface $determinedClient = null): ResponseInterface |
101
|
1 |
|
{ |
102
|
|
|
// if client is not given we interpret it as a 'default' client should be used |
103
|
|
|
if ($determinedClient === null) { |
104
|
|
|
$determinedClient = $this->passGetIntegration()->passReadDefaultClient(); |
105
|
6 |
|
if ($determinedClient->hasCredentials() === true) { |
106
|
1 |
|
throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_UNAUTHORIZED_CLIENT); |
107
|
|
|
} |
108
|
|
|
} |
109
|
5 |
|
|
110
|
|
|
if ($determinedClient !== null && $determinedClient->isPasswordGrantEnabled() === false) { |
111
|
5 |
|
throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_UNAUTHORIZED_CLIENT); |
112
|
5 |
|
} |
113
|
1 |
|
|
114
|
|
|
$scope = $this->passGetScope($parameters); |
115
|
|
|
list ($isScopeValid, $scopeList, $isScopeModified) = |
116
|
4 |
|
$this->passGetIntegration()->passValidateScope($determinedClient, $scope); |
117
|
4 |
|
if ($isScopeValid === false) { |
118
|
|
|
throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_INVALID_SCOPE); |
119
|
1 |
|
} |
120
|
|
|
|
121
|
|
|
if (($userName = $this->passGetUserName($parameters)) === null || |
122
|
3 |
|
($password = $this->passGetPassword($parameters)) === null |
123
|
3 |
|
) { |
124
|
3 |
|
throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_INVALID_REQUEST); |
125
|
3 |
|
} |
126
|
3 |
|
|
127
|
3 |
|
$response = $this->passGetIntegration()->passValidateCredentialsAndCreateAccessTokenResponse( |
128
|
3 |
|
$userName, |
129
|
|
|
$password, |
130
|
|
|
$determinedClient, |
131
|
2 |
|
$isScopeModified, |
132
|
|
|
$scopeList, |
133
|
|
|
$parameters |
134
|
|
|
); |
135
|
|
|
|
136
|
|
|
return $response; |
137
|
|
|
} |
138
|
|
|
|
139
|
|
|
/** |
140
|
5 |
|
* @param array $parameters |
141
|
|
|
* @param string $name |
142
|
5 |
|
* |
143
|
5 |
|
* @return null|string |
144
|
|
|
*/ |
145
|
|
|
private function passReadStringValue(array $parameters, string $name): ?string |
146
|
|
|
{ |
147
|
|
|
return array_key_exists($name, $parameters) === true && is_string($value = $parameters[$name]) === true ? |
148
|
|
|
$value : null; |
|
|
|
|
149
|
|
|
} |
150
|
|
|
} |
151
|
|
|
|
This check compares the return type specified in the
@return
annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.If the return type contains the type array, this check recommends the use of a more specific type like
String[]
orarray<String>
.