AuthorizationEndpoint::beforeConsent() - Code Metrics - Inspection of "refactor" - php-guard/oauth-server - Measure and Improve Code Quality continuously with Scrutinizer

Completed
Push — master ( 6e52f0...d9a404 )

by Alexandre
created 2018-03-04 18:01 UTC
AuthorizationEndpoint::beforeConsent() B

↳ Parent: AuthorizationEndpoint
Complexity

Conditions	2
Paths	2
Size

Total Lines	24
Code Lines	4
Duplication

Lines	0
Ratio	0 %
Importance

Changes
Metric	Value
cc	2
eloc	4
nc	2
nop	2
dl	0
loc	24
rs	8.9713
c	0
b	0
f	0
<?php
/**
 * Created by PhpStorm.
 * User: GCC-MED
 * Date: 19/01/2018
 * Time: 16:02
 */

namespace OAuth2OLD\OpenID\Endpoints;


use GuzzleHttp\Psr7\Response;
use GuzzleHttp\Psr7\Uri;
use OAuth2OLD\Config;
use OAuth2OLD\EndpointMessages\Authorization\ErrorResponse;
use OAuth2OLD\Exceptions\OAuthException;
use OAuth2OLD\OpenID\ResponseModes\ResponseModeInterface;
use OAuth2OLD\OpenID\ResponseTypes\ResponseTypeInterface as OpenIDResponseTypeInterface;
use OAuth2OLD\ResponseTypes\ResponseTypeInterface;
use OAuth2OLD\Roles\ClientInterface;
use OAuth2OLD\Roles\Clients\RegisteredClient;
use OAuth2OLD\Roles\ResourceOwnerInterface;
use OAuth2OLD\Storages\ClientStorageInterface;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

class AuthorizationEndpoint extends \OAuth2OLD\Endpoints\AuthorizationEndpoint
{
    /**
     * @param ServerRequestInterface $request
     * @param ResourceOwnerInterface $resourceOwner
     * @return ResponseInterface
     * @throws \Exception
     */
    public function handle(ServerRequestInterface $request, ResourceOwnerInterface $resourceOwner): ResponseInterface
    {
        /**
         * @var RegisteredClient $client
         */
        if($res = $this->verify($request, $result)) {
            return $res;
        }

        /**
         * @var RegisteredClient $client
         * @var Uri $redirectUri
         * @var array $responseTypes
         * @var ResponseModeInterface $responseMode
         * @var array|null $scope
         * @var bool $isSecure
         * @var array $data
         */
        extract($result);

        $result = [];

        try {
            if(!$resourceOwner->isConsentGivenForClient($client)) {
                throw new OAuthException('access_denied',
                    'The resource owner server denied the request',
                    'https://tools.ietf.org/html/rfc6749#section-4.1.1');
            }

            $extendedResponseTypes = [];

            /**
             * @var ResponseTypeInterface $responseType
             */
            foreach ($responseTypes as $responseType) {
                if($responseType->getExtendedResponseTypes()) {
                    $extendedResponseTypes = array_merge($extendedResponseTypes, $responseType->getExtendedResponseTypes());
                }
                $responseTypeNames[] = $responseType->getResponseType();
            }

            /**
             * @var ResponseTypeInterface $responseType
             */
            foreach ($responseTypes as $responseType) {
                if(!in_array($responseType->getResponseType(), $extendedResponseTypes)) {
                    $extendedResponseTypes = null;
                    if ($responseType->getExtendedResponseTypes()) {
                        $extendedResponseTypeNames = array_intersect($responseType->getExtendedResponseTypes(), array_keys($responseTypes));
                        foreach ($extendedResponseTypeNames as $name) {
                            $extendedResponseTypes[$name] = $responseTypes[$name];
                        }
                    }
                    $result = array_merge($result, $responseType->handle($request, $resourceOwner, $client, $scope, $extendedResponseTypes));
                }
            }
//            var_dump($result);die;


        } catch (OAuthException $e) {
            return new ErrorResponse($redirectUri, $e->getError(),
                $e->getErrorDescription(),
                $e->getErrorUri(),
                $data['state'] ?? null);
        }

        if(isset($data['state'])) {
            $result['state'] = $data['state'];
        }

        return $responseMode->handle($redirectUri, $result);


        // todo, repository for response mode
        // https://developer.okta.com/docs/api/resources/oidc#parameter-details
       /*

        if (isset($data['response_mode']) && $data['response_mode'] == 'post_message') {
            return $this->popupResponse(['access_token' => 'a'], $redirectUri);
        } else {
            return new AuthorizationResponse($redirectUri);
        }
        */
    }

    /**
     * @param ServerRequestInterface $request
     * @param null $result

     * @return Response
     * @throws \Exception
     */
    public function beforeConsent(ServerRequestInterface $request, &$result = null): ?Response
    {
        /**
         * @var RegisteredClient $client
         */
        if ($res = $this->verify($request, $result)) {
            return $res;
        }

        /**
         * @var RegisteredClient $client
         * @var Uri $redirectUri
         * @var array $responseTypes
         * @var ResponseModeInterface $responseMode
         * @var array|null $scope
         * @var bool $isSecure
         * @var array $data
         */
        extract($result);

        // Si le consentement est requis, retourné array sauf si prompt=none
        // l'affichage du consentement peut utiliser le paramètre 'display'

        return null;

//        return new AuthorizationResponse($redirectUri);

    }

    /**
     * @param ServerRequestInterface $request
     * @param null $result

     * @return array|Response
     * @throws \Exception
     */
    protected function verify(ServerRequestInterface $request, &$result = null) : ?Response
    {
        try {
            // Validate all oauth2 parameters
            // Verify that scope parameter is present and contains openid scope. If not, use basic oauth2 authorization endpoint
            // Verify all open id parameters
            // check sub (subject) claim that is the current user authenticated
            // check user authenticated or re-authenticate him if prompt=login
            // no interaction if prompt=none => no consent required, check client has consent

            if ($request->getMethod() == 'GET') {
                $data = $request->getQueryParams();
            } else if ($request->getMethod() == 'POST') {
                $data = $request->getParsedBody();
            } else {
                throw new OAuthException('invalid_request', 'Support only HTTP GET and POST methods');
            }

            $scopes = isset($data['scope']) ? explode(' ', trim($data['scope'])) : null;
            $client = $this->checkClient($data);
            $redirectUri = $this->checkRedirectUri($client, $data, $scopes);
        } catch (OAuthException $e) {
            return new \OAuth2OLD\EndpointMessages\Token\ErrorResponse($e->getError(), $e->getErrorDescription(), $e->getErrorUri());
        }

        try {
            // Oauth2
            $responseTypes = $this->checkResponseTypes($request, $data);
            $this->checkAuthorizedClient($client, $responseTypes);
            $isSecure = $this->checkRedirectionEndpointConfidentiality($client, $responseTypes, $redirectUri);

            $scope = $this->checkScope($client, $data);

//            if (!isset($data['scope']) || !$data['scope']) {

//                throw new OAuthException('invalid_request', 'Missing a required parameter : scope');
//            }


            $isStateRequired = $this->server->getConfigurationRepository()->getConfig(Config::ENFORCE_STATE);
            if ($isStateRequired && (!isset($data['state']) || !$data['state'])) {
                throw new OAuthException('invalid_request', 'Missing a required parameter : state');
            }

            $responseMode = $this->checkResponseMode($responseTypes, $data);

            $result = compact('client', 'redirectUri', 'responseTypes', 'data', 'scope', 'isSecure',
                'responseMode');

        } catch (OAuthException $e) {
            return new ErrorResponse($redirectUri,
                $e->getError(), $e->getErrorDescription(), $e->getErrorUri(),
                $data['state'] ?? null);
        }

        return null;

//        $requiredParameters = ['scope', 'response_type', 'client_id']

    }

    /**
     * @param ClientInterface $client
     * @param array $responseTypes
     * @throws OAuthException
     */
    protected function checkAuthorizedClient(ClientInterface $client, array $responseTypes)
    {
        $isImplicit = false;
        /**
         * @var OpenIDResponseTypeInterface $responseType
         */
        foreach ($responseTypes as $responseType) {
            if ($responseType->isImplicit()) {
                $isImplicit = true;
            }
        }

        if ($isImplicit && !$client->isImplicitAllowed()) {
            throw new OAuthException('unauthorized_client',
                'Client is not allowed to use implicit grant',
                'https://tools.ietf.org/html/rfc6749#section-3.1.1');
        }
    }

    /**
     * @param ClientInterface $client
     * @param array $data
     * @return array|null
     * @throws OAuthException
     */
    protected function checkScope(ClientInterface $client, array $data): ?array
    {
        $scopePolicyManager = $this->server->getScopePolicyManager();

        if (isset($data['scope'])) {
            $scope = explode(' ', $data['scope']);
        } else {
            $scope = $scopePolicyManager->getDefaultScopes($client);
        }

        if (!$scopePolicyManager->checkScope($client, $scope)) {
            $supportedScopes = implode(', ', $scopePolicyManager->getSupportedScopes($client));
            throw new OAuthException('invalid_scope',
                'Some of requested scopes are not supported. Scope supported : ' . $supportedScopes,
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        return $scope;
    }

    /**
     * @param ClientInterface $client
     * @param array $responseTypes
     * @param Uri $redirectUri
     * @return bool
     * @throws OAuthException
     * @throws \Exception
     */
    protected function checkRedirectionEndpointConfidentiality(ClientInterface $client, array $responseTypes, Uri $redirectUri): bool
    {
        $enforceTls = $this->server->getConfigurationRepository()->getConfig(Config::ENFORCE_TLS);
        if ($redirectUri->getScheme() === 'https') {
            return true;
        }

        foreach ($responseTypes as $responseType) {
            if ($responseType->requireTLS()) {
                if ($enforceTls === true || (is_null($enforceTls) && $client->isTLSSupported())) {
                    throw new OAuthException('access_denied',
                        'Require the use of TLS for the redirect URI',
                        'https://tools.ietf.org/html/rfc6749#section-3.1.2.1');
                }
                return false;
            }
        }
        return true;
    }

    /**
     * @param array $data
     * @return ClientInterface
     * @throws OAuthException
     * @throws \Exception
     */
    protected function checkClient(array $data): ClientInterface
    {
        if (!isset($data['client_id']) || !$data['client_id']) {
            throw new OAuthException('invalid_request', 'Missing a required parameter : client_id',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        /**
         * @var ClientStorageInterface $clientStorage
         */
        $clientStorage = $this->server->getStorageRepository()->getStorage('client');

        $client = $clientStorage->get($data['client_id']);
        if (!$client) {
            throw new OAuthException('invalid_request', 'Invalid parameter : client_id',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        if (!$client instanceof RegisteredClient) {

            throw new OAuthException('invalid_request', 'Client type is not supported',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        return $client;
    }

    /**
     * @param ClientInterface $client
     * @param array $data
     * @param array|null $scopes
     * @return Uri
     * @throws OAuthException
     * @throws \Exception
     */
    protected function checkRedirectUri(ClientInterface $client, array $data, ?array $scopes): Uri
    {
        if (!isset($data['redirect_uri']) || !$data['redirect_uri']) {
            if (is_array($scopes) && in_array('openid', $scopes)) {
                throw new OAuthException('invalid_request', 'Missing a required parameter : redirect_uri');
            }

            if ($this->server->getConfigurationRepository()->getConfig(Config::ENFORCE_REDIRECT_URI)) {
                throw new OAuthException('invalid_request', 'A redirect URI must be supplied');
            }
            if (empty($client->getRedirectUris())) {
                throw new OAuthException('invalid_request', 'No redirect URI was supplied or stored');
            }
            if (count($client->getRedirectUris()) > 1) {
                throw new OAuthException('invalid_request', 'A redirect URI must be supplied when multiple redirect URIs are registered');
            }

            $redirectUri = new Uri($client->getRedirectUris()[0]);
        } else {

            $redirectUri = new Uri($data['redirect_uri']);
            if ($redirectUri->getFragment()) {
                throw new OAuthException('invalid_request', 'The redirect URI must not contain a fragment');
            }

            if (empty($client->getRedirectUris())) {
                if ($client->requireRedirectUri()) {
                    throw new OAuthException('invalid_request', 'The client must register a redirect URI');
                } else {
                    return $redirectUri;
                }
            }

            $redirectUriWithoutQuery = Uri::composeComponents(
                $redirectUri->getScheme(), $redirectUri->getAuthority(), $redirectUri->getPath(), '', '');

            $match = false;
            foreach ($client->getRedirectUris() as $registeredUri) {
                $registeredUri = new Uri($registeredUri);
                if ($registeredUri->getQuery()) {
                    if ($registeredUri->__toString() === $redirectUri->__toString()) {
                        $match = true;
                        break;
                    }
                } else {
                    if ($this->server->getConfigurationRepository()->getConfig(Config::STRICT_REDIRECT_URI_COMPARISON)) {
                        if ($registeredUri->__toString() === $redirectUri->__toString()) {
                            $match = true;
                            break;
                        }
                    } else if ($registeredUri->__toString() === $redirectUriWithoutQuery) {
                        $match = true;
                        break;
                    }
                }
            }

            if (!$match) {
                throw new OAuthException('invalid_request', 'The redirect URI provided is missing or does not match');
            }
        }

        return $redirectUri;
    }

    /**
     * @param ServerRequestInterface $request
     * @param array $data
     * @return array
     * @throws OAuthException
     */
    protected function checkResponseTypes(ServerRequestInterface $request, array $data): array
    {
        if (!isset($data['response_type']) || !$data['response_type']) {
            throw new OAuthException('invalid_request', 'Missing a required parameter : response_type');
        }

        $responseTypeNames = explode(' ', $data['response_type']);
        $responseTypes = [];

        foreach ($responseTypeNames as $responseTypeName) {
            $responseType = $this->server->getResponseTypeRepository()->getResponseType($responseTypeName);
            if (!$responseType) {
                throw new OAuthException('invalid_request',
                    'Unknown response_type : ' . $responseTypeName);
            }

            if (!$responseType->isMultiValuedResponseTypeSupported()) {
                throw new OAuthException('invalid_request',
                    'Multi-valued response_type not supported with response_type : ' . $responseTypeName);
            }

            $responseTypes[$responseTypeName] = $responseType;
        }

        if (empty($responseTypes)) {
            throw new OAuthException('invalid_request', 'Invalid response_type parameter');
        }

        foreach ($responseTypes as $responseType) {
            $responseType->verifyRequest($request);
        }

        return $responseTypes;
    }

    /**
     * @param array $responseTypes
     * @param array $data
     * @return ResponseModeInterface
     * @throws OAuthException
     * @throws \Exception
     */
    protected function checkResponseMode(array $responseTypes, array $data): ResponseModeInterface
    {
        $isQueryResponseModeSupported = true;
        /**
         * @var ResponseTypeInterface $responseType
         */
        foreach ($responseTypes as $responseType) {
            if (!$responseType->isQueryResponseModeSupported()) {
                $isQueryResponseModeSupported = false;
            }
        }

        $responseModeRepository = $this->server->getResponseModeRepository();

        if (count($responseTypes) == 1) {
//            $responseType = array_values($responseTypes)[0];

            $defaultResponseMode = $responseType->getDefaultResponseMode();

        } else {
            $defaultResponseMode = $responseModeRepository->getDefaultResponseModeForMultipleValuedResponseType();
        }

        $responseMode = $data['response_mode'] ?? $defaultResponseMode;
        if ($responseMode === ResponseModeInterface::RESPONSE_MODE_QUERY && !$isQueryResponseModeSupported) {
            throw new OAuthException('invalid_request',
                'Invalid response_mode parameter : query mode is not supported for this response_type');
        }

        if (!$responseMode = $responseModeRepository->getResponseMode($responseMode)) {
            throw new OAuthException('invalid_request', 'Unsupported response_mode.');
        }

        return $responseMode;
    }

    protected function popupResponse(array $data, Uri $redirectUri)
    {
        $message = json_encode($data);
        $targetOrigin = Uri::composeComponents(
            $redirectUri->getScheme(),
            $redirectUri->getAuthority(),
            $redirectUri->getPath(), '', '');

        $popup = <<<HTML
<!doctype html>
<html>
<head><title>Fermer cette fenêtre</title></head>
<body><pre>
Cette fenêtre devrait ce fermer automatiquement. 
Si ce n'est pas le cas cliquez sur ce bouton
</pre>
<button type="button" onclick="window.close();">Fermer cette fenêtre</button>
<script type="text/javascript">
  window.opener.postMessage({$message}, '{$targetOrigin}');
</script>
</html>
HTML;
        return new Response(200, [], $popup);
    }
}
php-guard / oauth-server

Push — master ( 6e52f0...d9a404 )

AuthorizationEndpoint::beforeConsent() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like
