|
1
|
|
|
<?php |
|
2
|
|
|
/** |
|
3
|
|
|
* Created by PhpStorm. |
|
4
|
|
|
* User: GCC-MED |
|
5
|
|
|
* Date: 15/01/2018 |
|
6
|
|
|
* Time: 09:54 |
|
7
|
|
|
*/ |
|
8
|
|
|
|
|
9
|
|
|
namespace OAuth2OLD\ScopePolicy; |
|
10
|
|
|
|
|
11
|
|
|
|
|
12
|
|
|
use OAuth2OLD\Config; |
|
13
|
|
|
use OAuth2OLD\Roles\ClientInterface; |
|
14
|
|
|
use OAuth2OLD\ScopePolicy\Policies\DefaultScopePolicy; |
|
15
|
|
|
use OAuth2OLD\Server; |
|
16
|
|
|
|
|
17
|
|
|
class ScopePolicyManager |
|
18
|
|
|
{ |
|
19
|
|
|
/** |
|
20
|
|
|
* @var Server |
|
21
|
|
|
*/ |
|
22
|
|
|
protected $server; |
|
23
|
|
|
protected $defaultScopePolicy; |
|
24
|
|
|
protected $supportedScopes; |
|
25
|
|
|
protected $resourceOwnerRestrictedScopes = null; |
|
26
|
|
|
|
|
27
|
|
|
public function __construct(Server $server) |
|
28
|
|
|
{ |
|
29
|
|
|
$this->server = $server; |
|
30
|
|
|
$this->defaultScopePolicy = new DefaultScopePolicy($server->getConfigurationRepository()); |
|
31
|
|
|
|
|
32
|
|
|
$supportedScopes = $this->server->getConfigurationRepository()->getConfig(Config::SUPPORTED_SCOPES); |
|
33
|
|
|
$supportedScopes = is_string($supportedScopes) ? explode(' ', $supportedScopes) : $supportedScopes; |
|
34
|
|
|
$this->supportedScopes = $supportedScopes; |
|
35
|
|
|
} |
|
36
|
|
|
|
|
37
|
|
|
public function getDefaultScopes(ClientInterface $client): ?array |
|
38
|
|
|
{ |
|
39
|
|
|
if ($scopePolicy = $client->getScopePolicy()) { |
|
40
|
|
|
return $scopePolicy->getDefaultScopes($client); |
|
41
|
|
|
} |
|
42
|
|
|
return $this->defaultScopePolicy->getDefaultScopes($client); |
|
43
|
|
|
} |
|
44
|
|
|
|
|
45
|
|
|
public function getSupportedScopes(ClientInterface $client) |
|
46
|
|
|
{ |
|
47
|
|
|
return $client->getSupportedScopes() ? $client->getSupportedScopes() : $this->supportedScopes; |
|
48
|
|
|
} |
|
49
|
|
|
|
|
50
|
|
|
public function getScopeArray(ClientInterface $client, ?string $scope): ?array |
|
51
|
|
|
{ |
|
52
|
|
|
if ($scope) { |
|
53
|
|
|
$scope = explode(' ', $scope); |
|
54
|
|
|
} else { |
|
55
|
|
|
$scope = $this->getDefaultScopes($client); |
|
56
|
|
|
} |
|
57
|
|
|
return $scope; |
|
58
|
|
|
} |
|
59
|
|
|
|
|
60
|
|
|
public function checkScope(ClientInterface $client, ?array $scope): bool |
|
61
|
|
|
{ |
|
62
|
|
|
$supportedScopes = $this->getSupportedScopes($client); |
|
63
|
|
|
|
|
64
|
|
|
if (is_array($scope) && is_array($supportedScopes) && !empty(array_diff($scope, $supportedScopes))) { |
|
65
|
|
|
return false; |
|
66
|
|
|
} |
|
67
|
|
|
|
|
68
|
|
|
return true; |
|
69
|
|
|
} |
|
70
|
|
|
|
|
71
|
|
|
public function getResourceOwnerRestrictedScopes() : ?array { |
|
72
|
|
|
return $this->resourceOwnerRestrictedScopes; |
|
73
|
|
|
} |
|
74
|
|
|
|
|
75
|
|
|
/** |
|
76
|
|
|
* @see https://www.oauth.com/oauth2-servers/scope/checkboxes/ |
|
77
|
|
|
* if null, scopes are not restricted |
|
78
|
|
|
* @param array|null $resourceOwnerRestrictedScopes |
|
79
|
|
|
*/ |
|
80
|
|
|
public function setResourceOwnerRestrictedScopes(?array $resourceOwnerRestrictedScopes = null) |
|
81
|
|
|
{ |
|
82
|
|
|
$this->resourceOwnerRestrictedScopes = $resourceOwnerRestrictedScopes; |
|
83
|
|
|
} |
|
84
|
|
|
|
|
85
|
|
|
} |
php-guard /
oauth-server
