OAuth2\Endpoint\Server\Authorization

Complexity

Total Complexity

36

Size/Duplication

Total Lines	274
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes

0

3 Methods

Rating	Name	Duplication	Size	Complexity
D	authorize()	0	82	15
C	checkClientRedirectUri()	0	64	20
A	__construct()	0	6	1

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 30/12/2017
 * Time: 18:49
 */

namespace OAuth2OLD\Endpoint\Server;

use GuzzleHttp\Psr7\Response;
use GuzzleHttp\Psr7\Uri;
use OAuth2OLD\Credential\AuthorizationCode;
use OAuth2OLD\Endpoint\Config;
use OAuth2OLD\Endpoint\Endpoint;
use OAuth2OLD\Endpoint\Server\Messages\Authorization\AuthorizationRequest as AuthorizationRequest;
use OAuth2OLD\Endpoint\Server\Messages\Authorization\AuthorizationResponse as AuthorizationResponse;
use OAuth2OLD\Endpoint\Server\Messages\Authorization\ErrorResponse;
use OAuth2OLD\Exception\MissingResourceOwnerDecision;
use OAuth2OLD\Exception\ResourceOwnerNotAuthenticatedException;

The type OAuth2OLD\Exception\ResourceOwnerNotAuthenticatedException was not found. Maybe you did not declare it correctly or list all dependencies?

use OAuth2OLD\ResponseType\ResponseTypeInterface;
use OAuth2OLD\Storage\ClientStorage;
use OAuth2OLD\Role\Client\RegisteredClient;
use OAuth2OLD\Role\Client\Type\ClientPassword;

The type OAuth2OLD\Role\Client\Type\ClientPassword was not found. Maybe you did not declare it correctly or list all dependencies?

use OAuth2OLD\Role\Client\Type\PublicClient;
use OAuth2OLD\Role\Client\WebApplication;
use OAuth2OLD\Role\ResourceOwner;


/**
 * @deprecated
 * Class Authorization
 * @package OAuth2\endpoints
 *
 * @see https://tools.ietf.org/html/rfc6749#section-3.1
 *
 * Authorization Endpoint
 *
 *     The authorization endpoint is used to interact with the resource
 * owner and obtain an authorization grant.  The authorization server
 * MUST first verify the identity of the resource owner.  The way in
 * which the authorization server authenticates the resource owner
 * (e.g., username and password login, session cookies) is beyond the
 * scope of this specification.
 *
 * The means through which the client obtains the location of the
 * authorization endpoint are beyond the scope of this specification,
 * but the location is typically provided in the service documentation.
 *
 * The endpoint URI MAY include an "application/x-www-form-urlencoded"
 * formatted (per Appendix B) query component ([RFC3986] Section 3.4),
 * which MUST be retained when adding additional query parameters.  The
 * endpoint URI MUST NOT include a fragment component.
 *
 * Since requests to the authorization endpoint result in user
 * authentication and the transmission of clear-text credentials (in the
 * HTTP response), the authorization server MUST require the use of TLS
 * as described in Section 1.6 when sending requests to the
 * authorization endpoint.
 *
 * The authorization server MUST support the use of the HTTP "GET"
 * method [RFC2616] for the authorization endpoint and MAY support the
 * use of the "POST" method as well.
 *
 * Parameters sent without a value MUST be treated as if they were
 * omitted from the request.  The authorization server MUST ignore
 * unrecognized request parameters.  Request and response parameters
 * MUST NOT be included more than once.
 */
class Authorization extends Endpoint
{
    /**
     * @var array
     *
     * @see https://tools.ietf.org/html/rfc6749#section-3.1.1
     *
     * Response Type
     *
     *     The authorization endpoint is used by the authorization code grant
     * type and implicit grant type flows.  The client informs the
     * authorization server of the desired grant type using the following
     * parameter:
     *
     * response_type
     * REQUIRED.  The value MUST be one of "code" for requesting an
     * authorization code as described by Section 4.1.1, "token" for
     * requesting an access token (implicit grant) as described by
     * Section 4.2.1, or a registered extension value as described by
     * Section 8.4.
     *
     * Extension response types MAY contain a space-delimited (%x20) list of
     * values, where the order of values does not matter (e.g., response
     * type "a b" is the same as "b a").  The meaning of such composite
     * response types is defined by their respective specifications.
     *
     * If an authorization request is missing the "response_type" parameter,
     * or if the response type is not understood, the authorization server
     * MUST return an error response as described in Section 4.1.2.1.
     */
    protected $responseTypesRegistry;
    /**
     * @var Server
     */
    private $server;

    /**
     * Authorization constructor.
     * @param Server $server
     */
    public function __construct(Server $server)
    {
        $this->responseTypesRegistry = [
            'code' => 'class'
        ];
        $this->server = $server;
    }


    /**
     * @see https://tools.ietf.org/html/rfc6749#section-3.3
     *
     * Access Token Scope
     *
     *     The authorization and token endpoints allow the client to specify the
     * scope of the access request using the "scope" request parameter.  In
     * turn, the authorization server uses the "scope" response parameter to
     * inform the client of the scope of the access token issued.
     *
     * The value of the scope parameter is expressed as a list of space-
     * delimited, case-sensitive strings.  The strings are defined by the
     * authorization server.  If the value contains multiple space-delimited
     * strings, their order does not matter, and each string adds an
     * additional access range to the requested scope.
     *
     * scope       = scope-token *( SP scope-token )
     * scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
     *
     * The authorization server MAY fully or partially ignore the scope
     * requested by the client, based on the authorization server policy or
     * the resource owner's instructions.  If the issued access token scope
     * is different from the one requested by the client, the authorization
     * server MUST include the "scope" response parameter to inform the
     * client of the actual scope granted.
     *
     * If the client omits the scope parameter when requesting
     * authorization, the authorization server MUST either process the
     * request using a pre-defined default value or fail the request
     * indicating an invalid scope.  The authorization server SHOULD
     * document its scope requirements and default value (if defined).
     *
     *
     * @see https://tools.ietf.org/html/rfc6749#section-10.12
     *
     *  The authorization server MUST implement CSRF protection for its
     * authorization endpoint and ensure that a malicious client cannot
     * obtain authorization without the awareness and explicit consent of
     * the resource owner.
     *
     * @param AuthorizationRequest $request
     * @param ResourceOwner $resourceOwner
     * @param bool|null $authorizationDecision
     * @return Response
     * @throws MissingResourceOwnerDecision
     * @throws ResourceOwnerNotAuthenticatedException
     * @throws \Exception
     */
    public function authorize(AuthorizationRequest $request, ResourceOwner $resourceOwner,
                              ?bool $authorizationDecision = null)
    {
        $client = $this->server->getClientStorage()->getByIdentifier($request->getClientId());
        $redirectUri = $request->getRedirectUri();

        try {
            $isImplicitResponseType = false;
            $responseTypes = [];
            foreach (explode(' ', $request->getResponseType()) as $responseTypeRequested) {
                $responseType = $this->server->getResponseType($responseTypeRequested);
                if(!$responseType) {
                    return new ErrorResponse($redirectUri, 'unsupported_response_type', 'Invalid response_type parameter',
                        'https://tools.ietf.org/html/rfc6749#section-3.1.1');
                }

                if($responseType->isImplicit()) {
                    $isImplicitResponseType = true;
                }

                $responseTypes[] = $responseType;
            }

            $redirectUri = $this->checkClientRedirectUri($client, $redirectUri, $isImplicitResponseType);

            $redirectUri = Uri::withoutQueryValue($redirectUri, 'response_type');
            $redirectUri = Uri::withoutQueryValue($redirectUri, 'client_id');
            $redirectUri = Uri::withoutQueryValue($redirectUri, 'redirect_uri');
            $redirectUri = Uri::withoutQueryValue($redirectUri, 'scope');
            $redirectUri = Uri::withoutQueryValue($redirectUri, 'state');
        } catch (\Exception $e) {
            return new Response(302, ['Location' => $this->server->getConfig(Config::INVALID_ENDPOINT_URI)]);
        }

        try {
            $request->validate();
        } catch (\Exception $e) {
            return new ErrorResponse($redirectUri, 'invalid_request', $e->getMessage(),
                'https://tools.ietf.org/html/rfc6749#section-4.1.1');
        }


        if ($this->server->getConfig(Config::ENFORCE_STATE) && !$request->getState()) {
            return new ErrorResponse($redirectUri, 'invalid_request', 'Missing state parameter',
                'https://tools.ietf.org/html/rfc6749#section-4.1.1');
        }

        if (!$resourceOwner->isAuthenticated()) {
            throw new ResourceOwnerNotAuthenticatedException();
        }

        if (is_null($authorizationDecision)) {
            throw new MissingResourceOwnerDecision();
        }

        if (!$authorizationDecision) {
            return new ErrorResponse($redirectUri, 'access_denied', 'The resource owner server denied the request',
                'https://tools.ietf.org/html/rfc6749#section-4.1.1');
        }

        /**
         * @var ResponseTypeInterface $responseType
         */
        $params = array();
        foreach ($responseTypes as $responseType) {
            $params = array_merge($responseType->getResponse($client, $redirectUri));
        }

        if ($request->getState()) {
            $params['state'] = $request->getState();
        }

        if($isImplicitResponseType) {
            $redirectUri = $redirectUri->withFragment(http_build_query($params));
        }
        else {
            foreach ($params as $key => $value) {
                $redirectUri = Uri::withQueryValue($redirectUri, $key, $value);
            }
        }

        return new Response(302, ['Location' => $redirectUri->__toString()]);

//        $code = AuthorizationCode::generate();

59% of this comment could be valid code. Did you maybe forget this after debugging?

//        $authorizationCode = new AuthorizationCode($code, $client->getIdentifier(), $redirectUri);
//        $this->server->getAuthorizationCodeStorage()->create($authorizationCode);
//        return new AuthorizationResponse($redirectUri, $authorizationCode, $request->getState());
    }

    /**
     * @see https://tools.ietf.org/html/rfc6749#section-3.1.2.3
     *
     * Dynamic Configuration
     *
     *     If multiple redirection URIs have been registered, if only part of
     * the redirection URI has been registered, or if no redirection URI has
     * been registered, the client MUST include a redirection URI with the
     * authorization request using the "redirect_uri" request parameter.
     *
     * When a redirection URI is included in an authorization request, the
     * authorization server MUST compare and match the value received
     * against at least one of the registered redirection URIs (or URI
     * components) as defined in [RFC3986] Section 6, if any redirection
     * URIs were registered.  If the client registration included the full
     * redirection URI, the authorization server MUST compare the two URIs
     * using simple string comparison as defined in [RFC3986] Section 6.2.1
     *
     * @param RegisteredClient $client
     * @param null|string $redirectUri
     * @param bool $isImplicitGrant
     * @return Uri|null|string
     * @throws \Exception
     */
    private function checkClientRedirectUri(RegisteredClient $client, ?string $redirectUri, $isImplicitGrant = false)
    {
        if (!$client instanceof RegisteredClient) {

The condition ! $client instanceof OAuth2OLD\Role\Client\RegisteredClient can never be true.

            throw new \Exception('Only registered clients are supported');
        }
        if (!$client instanceof PublicClient && !$client instanceof ClientPassword) {
            throw new \Exception('Only public and confidential clients are supported');
        }

        if (!$redirectUri && $this->server->getConfig(Config::ENFORCE_REDIRECT_URI)) {
            throw new \Exception('Invalid URI');
        }

        if (!$redirectUri) {
            if (count($client->getRedirectUris()) !== 1) {
                throw new \Exception('Invalid URI');
            }
            $redirectUri = new Uri($client->getRedirectUris()[0]);
        } else {
            if (!$redirectUri) {
                throw new \Exception('Invalid URI');
            }

            $redirectUri = new Uri($redirectUri);
            if ($redirectUri->getFragment()) {
                throw new \Exception('Invalid URI');
            }

            if (empty($client->getRedirectUris())) {
                if ($client instanceof ClientPassword && !$isImplicitGrant) {
                    return $redirectUri;
                } else {
                    throw new \Exception('Invalid URI');
                }
            }

            $redirectUriWithoutQuery = Uri::composeComponents(
                $redirectUri->getScheme(), $redirectUri->getAuthority(), $redirectUri->getPath(), '', '');

            $match = false;
            foreach ($client->getRedirectUris() as $registeredUri) {
                $registeredUri = new Uri($registeredUri);
                if ($registeredUri->getQuery()) {
                    if ($registeredUri->__toString() === $redirectUri->__toString()) {
                        $match = true;
                        break;
                    }
                } else {
                    if ($this->server->getConfig(Config::STRICT_REDIRECT_URI_COMPARISON)) {
                        if ($registeredUri->__toString() === $redirectUri->__toString()) {
                            $match = true;
                            break;
                        }
                    } else if ($registeredUri->__toString() === $redirectUriWithoutQuery) {
                        $match = true;
                        break;
                    }
                }
            }
            if (!$match) {
                throw new \Exception('Invalid URI');
            }
        }
        return $redirectUri;
    }
}