php-guard /
oauth-server
| Conditions | 14 |
| Paths | 24 |
| Total Lines | 78 |
| Code Lines | 50 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 26 | function handle(ServerRequestInterface $request): ResponseInterface |
||
|
|
|||
| 27 | { |
||
| 28 | if (!isset($request->getParsedBody()['grant_type'])) { |
||
| 29 | return new ErrorResponse('invalid_request', 'Missing a required parameter : grant_type', |
||
| 30 | 'https://tools.ietf.org/html/rfc6749#section-5.2'); |
||
| 31 | } |
||
| 32 | |||
| 33 | // $accessTokenRequest = AccessTokenRequest::createFromServerRequest($request); |
||
| 34 | |||
| 35 | $grantTypeName = $request->getParsedBody()['grant_type']; |
||
| 36 | $grantType = $this->server->getGrantTypeRepository()->getGrantType($grantTypeName); |
||
| 37 | if (!$grantType) { |
||
| 38 | return new ErrorResponse('unsupported_grant_type', |
||
| 39 | 'Unsupported grant type : ' . $grantTypeName, |
||
| 40 | 'https://tools.ietf.org/html/rfc6749#section-5.2'); |
||
| 41 | } |
||
| 42 | |||
| 43 | /** |
||
| 44 | * @var ClientStorageInterface $clientStorage |
||
| 45 | */ |
||
| 46 | $clientStorage = $this->server->getStorageRepository()->getStorage('client'); |
||
| 47 | $guard = $this->server->getGuard(); |
||
| 48 | $client = null; |
||
| 49 | |||
| 50 | try { |
||
| 51 | if ($guard->authenticate($request)) { |
||
| 52 | $client = $guard->getClient(); |
||
| 53 | } |
||
| 54 | } catch (OAuthException $e) { |
||
| 55 | if ($e->getError() == 'invalid_client' && $request->hasHeader('Authorization')) { |
||
| 56 | return new ErrorResponse($e->getError(), |
||
| 57 | 'Client authentication failed : ' . $e->getMessage(), |
||
| 58 | $e->getErrorUri(), 401, [ |
||
| 59 | 'WWW-Authenticate' => 'Basic' |
||
| 60 | ]); |
||
| 61 | } else { |
||
| 62 | return new ErrorResponse($e->getError(), |
||
| 63 | 'Client authentication failed : ' . $e->getMessage(), |
||
| 64 | $e->getErrorUri(), 401); |
||
| 65 | } |
||
| 66 | } |
||
| 67 | |||
| 68 | if(!$client) { |
||
| 69 | if (!isset($request->getParsedBody()['client_id'])) { |
||
| 70 | return new ErrorResponse('invalid_request', |
||
| 71 | 'Client authentication not included, missing a parameter : client_id : ', |
||
| 72 | 'https://tools.ietf.org/html/rfc6749#section-5.2'); |
||
| 73 | } |
||
| 74 | |||
| 75 | $client = $clientStorage->get($request->getParsedBody()['client_id']); |
||
| 76 | if (!$client) { |
||
| 77 | return new ErrorResponse('invalid_client', |
||
| 78 | 'Parameter client_id invalid', |
||
| 79 | 'https://tools.ietf.org/html/rfc6749#section-5.2'); |
||
| 80 | } |
||
| 81 | |||
| 82 | if ($client->hasCredentials()) { |
||
| 83 | return new ErrorResponse('invalid_client', |
||
| 84 | 'Client authentication failed : ' . $guard->getError(), |
||
| 85 | 'https://tools.ietf.org/html/rfc6749#section-5.2', 401, [ |
||
| 86 | 'WWW-Authenticate' => 'Basic' |
||
| 87 | ]); |
||
| 88 | } |
||
| 89 | } |
||
| 90 | |||
| 91 | if (is_array($client->getSupportedGrantTypes()) && !in_array($grantType->getUri(), $client->getSupportedGrantTypes())) { |
||
| 92 | return new ErrorResponse('unauthorized_client', |
||
| 93 | 'Unauthorized grant type : ' . $grantType->getUri(), |
||
| 94 | 'https://tools.ietf.org/html/rfc6749#section-5.2'); |
||
| 95 | } |
||
| 96 | |||
| 97 | try { |
||
| 98 | return $grantType->grant($request, $client); |
||
| 99 | } |
||
| 100 | catch (OAuthException $e) { |
||
| 101 | return new ErrorResponse($e->getError(), |
||
| 102 | $e->getErrorDescription(), |
||
| 103 | $e->getErrorUri()); |
||
| 104 | } |
||
| 106 | } |
Loading history...
Adding explicit visibility (
private,protected, orpublic) is generally recommend to communicate to other developers how, and from where this method is intended to be used.