OAuth2OLD\GrantTypes\RefreshTokenGrantType

Complexity

Total Complexity

13

Size/Duplication

Total Lines	80
Duplicated Lines	0 %

Importance

Changes

0

3 Methods

Rating	Name	Duplication	Size	Complexity
C	grant()	0	45	11
A	__construct()	0	9	1
A	getUri()	0	3	1

<?php
/**
 * Created by PhpStorm.
 * User: GCC-MED
 * Date: 18/01/2018
 * Time: 12:00
 */

namespace OAuth2OLD\GrantTypes;


use OAuth2OLD\Config;
use OAuth2OLD\EndpointMessages\Token\AccessTokenResponse;
use OAuth2OLD\Exceptions\OAuthException;
use OAuth2OLD\Repositories\ConfigurationRepository;
use OAuth2OLD\Roles\ClientInterface;
use OAuth2OLD\Roles\Clients\RegisteredClient;
use OAuth2OLD\ScopePolicy\ScopePolicyManager;
use OAuth2OLD\Storages\AccessTokenStorageInterface;
use OAuth2OLD\Storages\RefreshTokenStorageInterface;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

class RefreshTokenGrantType implements GrantTypeInterface
{
    /**
     * @var AccessTokenStorageInterface
     */
    private $accessTokenStorage;
    /**
     * @var RefreshTokenStorageInterface
     */
    private $refreshTokenStorage;
    /**
     * @var ScopePolicyManager
     */
    private $scopePolicyManager;
    /**
     * @var ConfigurationRepository
     */
    private $configurationRepository;

    public function __construct(ConfigurationRepository $configurationRepository,
                                ScopePolicyManager $scopePolicyManager,
                                AccessTokenStorageInterface $accessTokenStorage,
                                RefreshTokenStorageInterface $refreshTokenStorage)
    {
        $this->scopePolicyManager = $scopePolicyManager;
        $this->accessTokenStorage = $accessTokenStorage;
        $this->refreshTokenStorage = $refreshTokenStorage;
        $this->configurationRepository = $configurationRepository;
    }

    function getUri(): string

It is generally recommended to explicitly declare the visibility for methods.

    {
        return 'refresh_token';
    }

    function grant(ServerRequestInterface $request, ClientInterface $client): ResponseInterface

It is generally recommended to explicitly declare the visibility for methods.

    {
        if (!$client instanceof RegisteredClient) {
            throw new OAuthException('unauthorized_client',
                'Unauthorized client type',
                'https://tools.ietf.org/html/rfc6749#section-5.2');
        }

        $refreshToken = $request->getParsedBody()['refresh_token'] ?? '';
        if(!$refreshToken) {
            throw new OAuthException('invalid_request', 'Missing a required parameter : refresh_token',
                'https://tools.ietf.org/html/rfc6749#section-4.3');
        }

        $refreshToken = $this->refreshTokenStorage->get($refreshToken);
        if(!$refreshToken || $refreshToken->getClientId() !== $client->getIdentifier()) {
            throw new OAuthException('invalid_grant', 'Refresh token is invalid',
                'https://tools.ietf.org/html/rfc6749#section-4.3');
        }

        if(!is_null($refreshToken->getExpiresAt()) && $refreshToken->getExpiresAt() < time()) {
            $this->refreshTokenStorage->revoke($refreshToken->getToken());

            throw new OAuthException('invalid_grant', 'Refresh token has expired',
                'https://tools.ietf.org/html/rfc6749#section-4.3');
        }

        $includedScopes = isset($request->getParsedBody()['scope']) ? explode(' ', $request->getParsedBody()['scope']) : null;
        if(is_array($includedScopes) && !empty(array_diff($includedScopes, explode(' ', $refreshToken->getToken())))) {
            throw new OAuthException('invalid_scope',
                'Some of scope included are not granted for this token. Scope granted : ' . $refreshToken->getScope(),
                'https://tools.ietf.org/html/rfc6749#section-6');
        }

        // issue an access token token and, optionally, a refresh token
        $accessToken = $this->accessTokenStorage->create($client->getIdentifier(), $refreshToken->getUserId(), $refreshToken->getScope());
        $newRefreshToken = null;
        if($this->configurationRepository->getConfig(Config::REGENERATE_REFRESH_TOKENS_AFTER_USE)) {
            $this->refreshTokenStorage->revoke($refreshToken->getToken());
            $newRefreshToken = $this->refreshTokenStorage->create(
                $refreshToken->getClientId(), $refreshToken->getUserId(), $refreshToken->getScope())->getToken();
        }

        return new AccessTokenResponse($accessToken->getToken(), $accessToken->getType(),
            $accessToken->getExpiresAt() - time(), $newRefreshToken);
    }
}