OAuth2OLD\Endpoint\Server\Token

Complexity

Total Complexity

13

Size/Duplication

Total Lines	128
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	3	1
A	getClientByIdentifier()	0	3	1
C	authorizationCode()	0	68	10
A	refreshToken()	0	2	1

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 30/12/2017
 * Time: 18:50
 */

namespace OAuth2OLD\Endpoint\Server;

use GuzzleHttp\Psr7\Uri;
use OAuth2OLD\Credential\AccessToken;
use OAuth2OLD\Credential\RefreshToken;
use OAuth2OLD\Credential\TokenType\BearerToken;
use OAuth2OLD\Endpoint\Config;
use OAuth2OLD\Endpoint\Server\Messages\AccessToken\AccessTokenRequest;
use OAuth2OLD\Endpoint\Server\Messages\AccessToken\AccessTokenResponse;
use OAuth2OLD\Endpoint\Server\Messages\Authorization\AuthorizationRequest;
use OAuth2OLD\Endpoint\Server\Messages\AccessToken\ErrorResponse;
use OAuth2OLD\GrantType\AuthorizationCode;
use OAuth2OLD\GrantType\InvalidGrantType;
use OAuth2OLD\Storage\ClientStorage;
use OAuth2OLD\Role\Client;
use OAuth2OLD\Role\Client\RegisteredClient;
use OAuth2OLD\Role\Client\Type\ClientPassword;

The type OAuth2OLD\Role\Client\Type\ClientPassword was not found. Maybe you did not declare it correctly or list all dependencies?

use Psr\Http\Message\ServerRequestInterface;


/**
 * Class Token
 * @package OAuth2\endpoints
 *
 * @see https://tools.ietf.org/html/rfc6749#section-3.2
 *
 * Token Endpoint
 *
 *     The token endpoint is used by the client to obtain an access token by
 * presenting its authorization grant or refresh token.  The token
 * endpoint is used with every authorization grant except for the
 * implicit grant type (since an access token is issued directly).
 *
 * The means through which the client obtains the location of the token
 * endpoint are beyond the scope of this specification, but the location
 * is typically provided in the service documentation.
 *
 * The endpoint URI MAY include an "application/x-www-form-urlencoded"
 * formatted (per Appendix B) query component ([RFC3986] Section 3.4),
 * which MUST be retained when adding additional query parameters.  The
 * endpoint URI MUST NOT include a fragment component.
 *
 * Since requests to the token endpoint result in the transmission of
 * clear-text credentials (in the HTTP request and response), the
 * authorization server MUST require the use of TLS as described in
 * Section 1.6 when sending requests to the token endpoint.
 *
 * The client MUST use the HTTP "POST" method when making access token
 * requests.
 *
 * Parameters sent without a value MUST be treated as if they were
 * omitted from the request.  The authorization server MUST ignore
 * unrecognized request parameters.  Request and response parameters
 * MUST NOT be included more than once.
 */
class Token
{
    /**
     * @var Server
     */
    private $server;

    /**
     * Token constructor.
     * @param Server $server
     */
    public function __construct(Server $server)
    {
        $this->server = $server;
    }

    protected function getClientByIdentifier(string $identifier)
    {
        return $this->server->getClientProvider()->getByIdentifier($identifier);

The method getClientProvider() does not exist on OAuth2OLD\Endpoint\Server\Server. Did you maybe mean getClient()?

    }

    /**
     * @see https://tools.ietf.org/html/rfc6749#section-3.3
     *
     * Access Token Scope
     *
     *     The authorization and token endpoints allow the client to specify the
     * scope of the access request using the "scope" request parameter.  In
     * turn, the authorization server uses the "scope" response parameter to
     * inform the client of the scope of the access token issued.
     *
     * The value of the scope parameter is expressed as a list of space-
     * delimited, case-sensitive strings.  The strings are defined by the
     * authorization server.  If the value contains multiple space-delimited
     * strings, their order does not matter, and each string adds an
     * additional access range to the requested scope.
     *
     * scope       = scope-token *( SP scope-token )
     * scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
     *
     * The authorization server MAY fully or partially ignore the scope
     * requested by the client, based on the authorization server policy or
     * the resource owner's instructions.  If the issued access token scope
     * is different from the one requested by the client, the authorization
     * server MUST include the "scope" response parameter to inform the
     * client of the actual scope granted.
     *
     * If the client omits the scope parameter when requesting
     * authorization, the authorization server MUST either process the
     * request using a pre-defined default value or fail the request
     * indicating an invalid scope.  The authorization server SHOULD
     * document its scope requirements and default value (if defined).
     *
     * @param AccessTokenRequest $request
     * @return AccessTokenResponse|ErrorResponse
     */
    public function authorizationCode(AccessTokenRequest $request)
    {
//        var_dump($request);die;

75% of this comment could be valid code. Did you maybe forget this after debugging?

        // todo is client in dev mode ?
        if (!$this->server->isSecure()) {
            return new ErrorResponse('invalid_request', 'Require TLS',
                'https://tools.ietf.org/html/rfc6749#section-3.2');
        }


        // todo require authentication, even for not confidential client ? own authenticator system ?
        $client = $this->server->getClient();
        if (!$client) {
            if (!$request->getClientId()) {
                return new ErrorResponse('invalid_request', 'Missing client_id parameter',
                    'https://tools.ietf.org/html/rfc6749#section-4.1.3');
            }
            $client = $this->getClientByIdentifier($request->getClientId());

            // todo 401  HTTP 401 (Unauthorized) status code and include the "WWW-Authenticate" response header field
            /**
             * Client authentication failed (e.g., unknown client, no
             * client authentication included, or unsupported
             * authentication method).  The authorization server MAY
             * return an HTTP 401 (Unauthorized) status code to indicate
             * which HTTP authentication schemes are supported.  If the
             * client attempted to authenticate via the "Authorization"
             * request header field, the authorization server MUST
             * respond with an HTTP 401 (Unauthorized) status code and
             * include the "WWW-Authenticate" response header field
             * matching the authentication scheme used by the client.
             */
            if (!$client || $this->server->getGuard()->requireAuthentication($client)) {
                return new ErrorResponse('invalid_client', 'Client not authenticated',
                    'https://tools.ietf.org/html/rfc6749#section-4.1.3', 401, [
                        'WWW-Authenticate' => 'Basic'
                    ]);
            }
        }

        $grantType = $this->server->getGrantType($request->getGrantType());
        if (!$grantType) {
            return new ErrorResponse('unsupported_grant_type', 'The grant type is not supported by the
               authorization server',
                'https://tools.ietf.org/html/rfc6749#section-5.2');
        }

        try {
            $redirectUri = $grantType->grant($request, $client);
        }
        catch(InvalidGrantType $e) {
            return new ErrorResponse('invalid_grant', $e->getErrorDescription(), $e->getErrorUri());
        }

        if ($redirectUri && $redirectUri !== $request->getRedirectUri()) {
            return new ErrorResponse('invalid_request', 'Invalid redirect uri',
                'https://tools.ietf.org/html/rfc6749#section-4.1.3');
        }

        $accessToken = AccessToken::generate();
        $refreshToken = RefreshToken::generate();

        $accessToken = new AccessToken($accessToken);

$accessToken of type OAuth2OLD\Credential\AccessToken is incompatible with the type string expected by parameter $token of OAuth2OLD\Credential\AccessToken::__construct().

        $this->server->getStorage('access_token')->save($accessToken);
        $this->server->getStorage('refresh_token')->save($refreshToken);
        $scope = null; // todo get requested scope, if different, change it
        return new AccessTokenResponse(new Uri($request->getRedirectUri()),
            $accessToken->getToken(), \OAuth2OLD\Credential\Token::TYPE_BEARER, 3600, $refreshToken->getToken(), $scope);
    }

    public function refreshToken()
    {

    }
}