o2system / security

src/Authentication/Oauth/Token.php

<?php
/**
 * This file is part of the O2System Framework package.
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 *
 * @author         Steeve Andrian Salim
 * @copyright      Copyright (c) Steeve Andrian Salim
 */

// ------------------------------------------------------------------------

namespace O2System\Security\Authentication\Oauth;

// ------------------------------------------------------------------------

use O2System\Psr\Http\Server\MethodInterface;
use O2System\Security\Encoders\Base64;
use O2System\Security\Encoders\Json;
use O2System\Security\Generators\Signature;
use O2System\Spl\Traits\Collectors\ErrorCollectorTrait;

/**
 * Class Token
 * @package O2System\Security\Authentication\Oauth
 */
class Token implements MethodInterface
{
    use ErrorCollectorTrait;

    protected $consumer;

    public function __construct(Consumer $consumer)
    {
        $this->consumer = $consumer;
    }

    // ------------------------------------------------------------------------

    /**
     * Token::getVerifier
     *
     * Gets Token oauth_verifier code.
     *
     * @return bool|string
     */
    public function getVerifier()
    {
        if ( ! empty($this->key) && ! empty($this->secret)) {
            $key = rawurlencode($this->key);

The property key does not exist on O2System\Security\Authentication\Oauth\Token. Did you maybe forget to declare it?

            $secret = rawurlencode($this->secret);

The property secret does not exist on O2System\Security\Authentication\Oauth\Token. Did you maybe forget to declare it?

            return base64_encode($key . ':' . $secret);
        }

        return false;
    }

    // ------------------------------------------------------------------------

    /**
     * Token::getRequest
     *
     * Gets OAuth Request Token.
     *
     * @return array|bool Returns FALSE if failed.
     */
    public function getRequest($callbackUrl, $httpMethod = self::HTTP_POST)
    {
        $algorithm = 'HMAC-SHA1';

The assignment to $algorithm is dead and can be removed.

        if (false === ($signature = Base64::decode($this->consumer->secret))) {
            $this->addError(400, 'Invalid Consumer Secret');

            return false;
        }

        if (false === ($signature = Json::decode($signature))) {

The condition false === $signature = O2System\Security\Encoders\Json::decode($signature) is always false.

            $this->addError(400, 'Invalid Consumer Secret');

            return false;
        }

        $signature->callbackUrl = $callbackUrl;

The property callbackUrl does not seem to exist on O2System\Spl\DataStructures\SplArrayObject.

        $signature->httpMethod = $httpMethod;

The property httpMethod does not seem to exist on O2System\Spl\DataStructures\SplArrayObject.

        $algorithm = $signature->algorithm;

        if (false !== ($payload = Base64::decode($this->consumer->key))) {
            $payload = Json::decode($payload)->getArrayCopy();
        }

        if ($payload) {
            $payload[ 'timestamp' ] = time();

            $segments[] = Base64::encode(Json::encode($signature));

$segments was never initialized. Although not strictly required by PHP, it is generally a good practice to add $segments = array(); before regardless.

            $segments[] = $token = Base64::encode(Signature::generate([
                'payload' => Base64::encode(Json::encode($payload)),
                'token'   => \OAuthProvider::generateToken(strlen($this->consumer->secret), true),
            ], $this->consumer->key, $algorithm));

            $secret = Base64::encode(Signature::generate($segments, $this->consumer->key, $algorithm));

            return [
                'oauth_token'        => $token,
                'oauth_token_secret' => $secret,
            ];
        }

        return false;
    }

    // ------------------------------------------------------------------------
}