TokenEndpoint::handle() - Code Metrics - php-guard/oauth-server - Measure and Improve Code Quality continuously with Scrutinizer

TokenEndpoint::handle() A
last analyzed 2018-06-23 21:42 UTC

↳ Parent: TokenEndpoint

Complexity

Conditions	5
Paths	8

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	5
nc	8
nop	1
dl	0
loc	35
rs	9.0488
c	0
b	0
f	0

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 08/03/2018
 * Time: 22:22
 */

namespace OAuth2\Endpoints;


use GuzzleHttp\Psr7\Response;
use OAuth2\ClientAuthentication\ClientAuthenticationMethodManager;
use OAuth2\Exceptions\OAuthException;
use OAuth2\AuthorizationGrantTypes\GrantTypeInterface;
use OAuth2\AuthorizationGrantTypes\GrantTypeManager;
use OAuth2\Roles\ClientTypes\RegisteredClient;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

/**
 * Class TokenEndpoint
 * @package OAuth2\Endpoints
 *
 * @see https://tools.ietf.org/html/rfc6749#section-3.2
 * The token endpoint is used by the client to obtain an access token by
 * presenting its authorization grant or refresh token.  The token
 * endpoint is used with every authorization grant except for the
 * implicit grant type (since an access token is issued directly).
 *
 * The means through which the client obtains the location of the token
 * endpoint are beyond the scope of this specification, but the location
 * is typically provided in the service documentation.
 *
 * The endpoint URI MAY include an "application/x-www-form-urlencoded"
 * formatted (per Appendix B) query component ([RFC3986] Section 3.4),
 * which MUST be retained when adding additional query parameters.  The
 * endpoint URI MUST NOT include a fragment component.
 *
 * Since requests to the token endpoint result in the transmission of
 * clear-text credentials (in the HTTP request and response), the
 * authorization server MUST require the use of TLS as described in
 * Section 1.6 when sending requests to the token endpoint.
 *
 * The client MUST use the HTTP "POST" method when making access token
 * requests.
 *
 * Parameters sent without a value MUST be treated as if they were
 * omitted from the request.  The authorization server MUST ignore
 * unrecognized request parameters.  Request and response parameters
 * MUST NOT be included more than once.
 */
class TokenEndpoint implements EndpointInterface
{
    /**
     * @var GrantTypeManager
     */
    private $grantTypeManager;
    /**
     * @var ClientAuthenticationMethodManager
     */
    private $clientAuthenticationMethodManager;

    /**
     * @var RegisteredClient|null
     */
    protected $client;
    /**
     * @var GrantTypeInterface|null
     */
    protected $grantType;

    public function __construct(GrantTypeManager $grantTypeManager,
                                ClientAuthenticationMethodManager $clientAuthenticationMethodManager)
    {
        $this->grantTypeManager = $grantTypeManager;
        $this->clientAuthenticationMethodManager = $clientAuthenticationMethodManager;
    }

    /**
     * @param ServerRequestInterface $request
     * @return ResponseInterface
     *
     * @see https://tools.ietf.org/html/rfc6749#section-4.1.3
     * The client makes a request to the token endpoint by sending the
     * following parameters using the "application/x-www-form-urlencoded"
     * format per Appendix B with a character encoding of UTF-8 in the HTTP
     * request entity-body:
     *
     * grant_type
     * REQUIRED.  Value MUST be set to "authorization_code".
     *
     * code
     * REQUIRED.  The authorization code received from the
     * authorization server.
     *
     * redirect_uri
     * REQUIRED, if the "redirect_uri" parameter was included in the
     * authorization request as described in Section 4.1.1, and their
     * values MUST be identical.
     *
     * client_id
     * REQUIRED, if the client is not authenticating with the
     * authorization server as described in Section 3.2.1.
     *
     * If the client type is confidential or the client was issued client
     * credentials (or assigned other authentication requirements), the
     * client MUST authenticate with the authorization server as described
     * in Section 3.2.1.
     *
     *  The authorization server MUST:
     *
     * o  require client authentication for confidential clients or for any
     * client that was issued client credentials (or with other
     * authentication requirements),
     *
     * o  authenticate the client if client authentication is included,
     *
     * o  ensure that the authorization code was issued to the authenticated
     * confidential client, or if the client is public, ensure that the
     * code was issued to "client_id" in the request,
     *
     * o  verify that the authorization code is valid, and
     *
     * o  ensure that the "redirect_uri" parameter is present if the
     * "redirect_uri" parameter was included in the initial authorization
     * request as described in Section 4.1.1, and if included ensure that
     * their values are identical.
     */
    public function handle(ServerRequestInterface $request): ResponseInterface
    {
        if ($request->getMethod() === 'POST') {
            $requestData = $request->getParsedBody();
        } else {
            return new Response(405);
        }

        try {
            // Authentication Request Validation
            // The Authorization Server MUST validate all the OAuth 2.0 parameters according to the OAuth 2.0 specification.
            $this->verifyRequestData($request, $requestData);

            $responseData = $this->getGrantType()->handleAccessTokenRequest($this, $requestData);

        } catch (OAuthException $e) {
            /**
             * If the Authorization Server encounters any error, it MUST return an error response, per Section 5.2
             */
            $status = 400;
            $headers = ['Content-Type' => 'application/json'];
            if ($e->getError() === 'invalid_client') {
                $status = 401;
                if ($request->hasHeader('Authorization')) {
                    $headers['WWW-Authenticate'] = 'Basic';
                }
            }
            return new Response($status, $headers, $e->jsonSerialize());
        }

        return new Response(200, [
            'Content-Type' => 'application/json',
            'Cache-Control' => 'no-store',
            'Pragma' => 'no-cache'
        ], json_encode($responseData));
    }

    /**
     * @param ServerRequestInterface $request
     * @param array $requestData
     * @throws OAuthException
     */
    protected function verifyRequestData(ServerRequestInterface $request, array $requestData)
    {
        if (empty($requestData['grant_type'])) {
            throw new OAuthException('invalid_request', 'The request is missing the required parameter grant_type.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        if (!($grantType = $this->grantTypeManager->getGrantType($requestData['grant_type']))) {
            throw new OAuthException('unsupported_grant_type',
                'The authorization grant type is not supported by the authorization server',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        $this->grantType = $grantType;

        $this->verifyClient($request, $requestData);

        $supportedGrantTypes = $this->client->getMetadata()->getGrantTypes() ?: ['authorization_code'];
        if (!in_array($requestData['grant_type'], $supportedGrantTypes)) {
            throw new OAuthException('unauthorized_client',
                'The authenticated client is not authorized to use this authorization grant type.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

    }

    /**
     * @param ServerRequestInterface $request
     * @param array $requestData
     * @throws OAuthException
     */
    protected function verifyClient(ServerRequestInterface $request, array $requestData)
    {
        $this->client = $this->clientAuthenticationMethodManager->authenticate($request, $requestData);
        $this->getGrantType();
    }

    /**
     * @return null|GrantTypeInterface
     */
    public function getGrantType()
    {
        return $this->grantType;
    }

    /**
     * @return null|RegisteredClient
     */
    public function getClient(): ?RegisteredClient
    {
        return $this->client;
    }
}

1			<?php
2			/**
3			* Created by PhpStorm.
4			* User: Alexandre
5			* Date: 08/03/2018
6			* Time: 22:22
7			*/
8
9			namespace OAuth2\Endpoints;
10
11
12			use GuzzleHttp\Psr7\Response;
13			use OAuth2\ClientAuthentication\ClientAuthenticationMethodManager;
14			use OAuth2\Exceptions\OAuthException;
15			use OAuth2\AuthorizationGrantTypes\GrantTypeInterface;
16			use OAuth2\AuthorizationGrantTypes\GrantTypeManager;
17			use OAuth2\Roles\ClientTypes\RegisteredClient;
18			use Psr\Http\Message\ResponseInterface;
19			use Psr\Http\Message\ServerRequestInterface;
20
21			/**
22			* Class TokenEndpoint
23			* @package OAuth2\Endpoints
24			*
25			* @see https://tools.ietf.org/html/rfc6749#section-3.2
26			* The token endpoint is used by the client to obtain an access token by
27			* presenting its authorization grant or refresh token. The token
28			* endpoint is used with every authorization grant except for the
29			* implicit grant type (since an access token is issued directly).
30			*
31			* The means through which the client obtains the location of the token
32			* endpoint are beyond the scope of this specification, but the location
33			* is typically provided in the service documentation.
34			*
35			* The endpoint URI MAY include an "application/x-www-form-urlencoded"
36			* formatted (per Appendix B) query component ([RFC3986] Section 3.4),
37			* which MUST be retained when adding additional query parameters. The
38			* endpoint URI MUST NOT include a fragment component.
39			*
40			* Since requests to the token endpoint result in the transmission of
41			* clear-text credentials (in the HTTP request and response), the
42			* authorization server MUST require the use of TLS as described in
43			* Section 1.6 when sending requests to the token endpoint.
44			*
45			* The client MUST use the HTTP "POST" method when making access token
46			* requests.
47			*
48			* Parameters sent without a value MUST be treated as if they were
49			* omitted from the request. The authorization server MUST ignore
50			* unrecognized request parameters. Request and response parameters
51			* MUST NOT be included more than once.
52			*/
53			class TokenEndpoint implements EndpointInterface
54			{
55			/**
56			* @var GrantTypeManager
57			*/
58			private $grantTypeManager;
59			/**
60			* @var ClientAuthenticationMethodManager
61			*/
62			private $clientAuthenticationMethodManager;
63
64			/**
65			* @var RegisteredClient\|null
66			*/
67			protected $client;
68			/**
69			* @var GrantTypeInterface\|null
70			*/
71			protected $grantType;
72
73			public function __construct(GrantTypeManager $grantTypeManager,
74			ClientAuthenticationMethodManager $clientAuthenticationMethodManager)
75			{
76			$this->grantTypeManager = $grantTypeManager;
77			$this->clientAuthenticationMethodManager = $clientAuthenticationMethodManager;
78			}
79
80			/**
81			* @param ServerRequestInterface $request
82			* @return ResponseInterface
83			*
84			* @see https://tools.ietf.org/html/rfc6749#section-4.1.3
85			* The client makes a request to the token endpoint by sending the
86			* following parameters using the "application/x-www-form-urlencoded"
87			* format per Appendix B with a character encoding of UTF-8 in the HTTP
88			* request entity-body:
89			*
90			* grant_type
91			* REQUIRED. Value MUST be set to "authorization_code".
92			*
93			* code
94			* REQUIRED. The authorization code received from the
95			* authorization server.
96			*
97			* redirect_uri
98			* REQUIRED, if the "redirect_uri" parameter was included in the
99			* authorization request as described in Section 4.1.1, and their
100			* values MUST be identical.
101			*
102			* client_id
103			* REQUIRED, if the client is not authenticating with the
104			* authorization server as described in Section 3.2.1.
105			*
106			* If the client type is confidential or the client was issued client
107			* credentials (or assigned other authentication requirements), the
108			* client MUST authenticate with the authorization server as described
109			* in Section 3.2.1.
110			*
111			* The authorization server MUST:
112			*
113			* o require client authentication for confidential clients or for any
114			* client that was issued client credentials (or with other
115			* authentication requirements),
116			*
117			* o authenticate the client if client authentication is included,
118			*
119			* o ensure that the authorization code was issued to the authenticated
120			* confidential client, or if the client is public, ensure that the
121			* code was issued to "client_id" in the request,
122			*
123			* o verify that the authorization code is valid, and
124			*
125			* o ensure that the "redirect_uri" parameter is present if the
126			* "redirect_uri" parameter was included in the initial authorization
127			* request as described in Section 4.1.1, and if included ensure that
128			* their values are identical.
129			*/
130			public function handle(ServerRequestInterface $request): ResponseInterface
131			{
132			if ($request->getMethod() === 'POST') {
133			$requestData = $request->getParsedBody();
134			} else {
135			return new Response(405);
136			}
137
138			try {
139			// Authentication Request Validation
140			// The Authorization Server MUST validate all the OAuth 2.0 parameters according to the OAuth 2.0 specification.
141			$this->verifyRequestData($request, $requestData);
142
143			$responseData = $this->getGrantType()->handleAccessTokenRequest($this, $requestData);
144
145			} catch (OAuthException $e) {
146			/**
147			* If the Authorization Server encounters any error, it MUST return an error response, per Section 5.2
148			*/
149			$status = 400;
150			$headers = ['Content-Type' => 'application/json'];
151			if ($e->getError() === 'invalid_client') {
152			$status = 401;
153			if ($request->hasHeader('Authorization')) {
154			$headers['WWW-Authenticate'] = 'Basic';
155			}
156			}
157			return new Response($status, $headers, $e->jsonSerialize());
158			}
159
160			return new Response(200, [
161			'Content-Type' => 'application/json',
162			'Cache-Control' => 'no-store',
163			'Pragma' => 'no-cache'
164			], json_encode($responseData));
165			}
166
167			/**
168			* @param ServerRequestInterface $request
169			* @param array $requestData
170			* @throws OAuthException
171			*/
172			protected function verifyRequestData(ServerRequestInterface $request, array $requestData)
173			{
174			if (empty($requestData['grant_type'])) {
175			throw new OAuthException('invalid_request', 'The request is missing the required parameter grant_type.',
176			'https://tools.ietf.org/html/rfc6749#section-4.1');
177			}
178
179			if (!($grantType = $this->grantTypeManager->getGrantType($requestData['grant_type']))) {
180			throw new OAuthException('unsupported_grant_type',
181			'The authorization grant type is not supported by the authorization server',
182			'https://tools.ietf.org/html/rfc6749#section-4.1');
183			}
184
185			$this->grantType = $grantType;
186
187			$this->verifyClient($request, $requestData);
188
189			$supportedGrantTypes = $this->client->getMetadata()->getGrantTypes() ?: ['authorization_code'];
190			if (!in_array($requestData['grant_type'], $supportedGrantTypes)) {
191			throw new OAuthException('unauthorized_client',
192			'The authenticated client is not authorized to use this authorization grant type.',
193			'https://tools.ietf.org/html/rfc6749#section-4.1');
194			}
195
196			}
197
198			/**
199			* @param ServerRequestInterface $request
200			* @param array $requestData
201			* @throws OAuthException
202			*/
203			protected function verifyClient(ServerRequestInterface $request, array $requestData)
204			{
205			$this->client = $this->clientAuthenticationMethodManager->authenticate($request, $requestData);
206			$this->getGrantType();
207			}
208
209			/**
210			* @return null\|GrantTypeInterface
211			*/
212			public function getGrantType()
213			{
214			return $this->grantType;
215			}
216
217			/**
218			* @return null\|RegisteredClient
219			*/
220			public function getClient(): ?RegisteredClient
221			{
222			return $this->client;
223			}
224			}

php-guard / oauth-server

TokenEndpoint::handle() A last analyzed 2018-06-23 21:42 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

TokenEndpoint::handle() A
last analyzed 2018-06-23 21:42 UTC