AuthorizationEndpoint::verifyScope() - Code Metrics - Inspection of "client" - php-guard/oauth-server - Measure and Improve Code Quality continuously with Scrutinizer

Completed
Push — master ( d9a404...9e6750 )

by Alexandre
created 2018-03-06 23:19 UTC
AuthorizationEndpoint::verifyScope() A

↳ Parent: AuthorizationEndpoint
Complexity

Conditions	2
Paths	2
Size

Total Lines	4
Code Lines	3
Duplication

Lines	0
Ratio	0 %
Code Coverage

Tests	1
CRAP Score	2
Importance

Changes
Metric	Value
cc	2
eloc	3
nc	2
nop	1
dl	0
loc	4
rs	10
c	0
b	0
f	0
ccs	1
cts	1
cp	1
crap	2
<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 18/02/2018
 * Time: 18:14
 */

namespace OAuth2\Endpoints;


use GuzzleHttp\Psr7\Response;
use GuzzleHttp\Psr7\Uri;
use OAuth2\Exceptions\OAuthException;
use OAuth2\Flows\AuthorizationCodeFlow;
use OAuth2\Flows\FlowInterface;
use OAuth2\Flows\FlowManager;
use OAuth2\ResponseModes\ResponseModeInterface;
use OAuth2\ResponseModes\ResponseModeManager;
use OAuth2\ResponseTypes\ResponseTypeInterface;
use OAuth2\ResponseTypes\ResponseTypeManager;
use OAuth2\Roles\ClientInterface;
use OAuth2\Roles\Clients\RegisteredClient;
use OAuth2\Roles\ResourceOwnerInterface;
use OAuth2\ScopePolicy\ScopePolicyManager;
use OAuth2\Storages\ClientStorageInterface;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

class AuthorizationEndpoint implements EndpointInterface
{
    /**
     * @var ResponseTypeManager
     */
    protected $responseTypeManager;
    /**
     * @var ResponseTypeInterface|null
     */
    private $responseType;
    /**
     * @var ResponseModeManager
     */
    protected $responseModeManager;
    /**
     * @var ScopePolicyManager
     */
    private $scopePolicyManager;
    /**
     * @var ResponseModeInterface|null
     */
    private $responseMode;
    /**
     * @var ResourceOwnerInterface
     */
    private $resourceOwner;
    /**
     * @var ClientStorageInterface
     */
    private $clientStorage;
    /**
     * @var RegisteredClient|null
     */
    private $client;
    /**
     * @var Uri|null
     */
    private $redirectUri;
    /**
     * @var mixed|null
     */
    private $state;
    /**
     * @var array|null
     */
    private $scopes;

    public function __construct(ResponseTypeManager $responseTypeManager,
                                ResponseModeManager $responseModeManager,
                                ScopePolicyManager $scopePolicyManager,
                                ResourceOwnerInterface $resourceOwner,
                                ClientStorageInterface $clientStorage)
    {
        $this->responseTypeManager = $responseTypeManager;
        $this->responseModeManager = $responseModeManager;
        $this->scopePolicyManager = $scopePolicyManager;
        $this->resourceOwner = $resourceOwner;
        $this->clientStorage = $clientStorage;
    }

    function handleRequest(ServerRequestInterface $request): ResponseInterface

    {
        $requestData = $request->getMethod() == 'GET' ? $request->getQueryParams() : $request->getParsedBody();

        try {
            // Authentication Request Validation
            // The Authorization Server MUST validate all the OAuth 2.0 parameters according to the OAuth 2.0 specification.
            $this->verifyRequestData($requestData);
            $this->verifyRequestData(/** @scrutinizer ignore-type */ $requestData);

        } catch (OAuthException $e) {
            /**
             * If the Authorization Server encounters any error, it MUST return an error response, per Section 3.1.2.6.
             */

            return new Response(400, ['content-type' => 'application/json'], $e->jsonSerialize());
        }

        // Authorization Server Authenticates End-User
        if (!$this->resourceOwner->isAuthenticated()) {
            return $this->resourceOwner->authenticate();
        }

        try {
            $consentGiven = $this->resourceOwner->hasGivenConsent($this->getClient(), $this->getScopes());
            if (is_null($consentGiven)) {
                return $this->resourceOwner->obtainConsent($this->getClient(), $this->getScopes());
            }

            if (!$consentGiven) {
                throw new OAuthException('access_denied', 'The resource owner denied the request.',
                    'https://tools.ietf.org/html/rfc6749#section-4.1');
            }
        } catch (OAuthException $e) {
            /**
             * If the Authorization Server encounters any error, it MUST return an error response, per Section 3.1.2.6.
             */
            $uri = $this->getRedirectUri();
            if(!empty($this->state)) {
                $uri = Uri::withQueryValue($uri, 'state', $this->state);
            }
            $uri = Uri::withQueryValue($uri, 'error', $e->getError());
            if($e->getErrorDescription()) {
                $uri = Uri::withQueryValue($uri, 'error_description', $e->getErrorDescription());
            }
            if($e->getErrorUri()) {
                $uri = Uri::withQueryValue($uri, 'error_uri', $e->getErrorUri());
            }
            return new Response(302, ['Location' => $uri]);
        }

        $responseData = $this->getResponseType()->handle($requestData);
        return $this->getResponseMode()->buildResponse($requestData, $responseData);
    }


    /**
     * @param array $requestData
     * @throws OAuthException
     */
    protected function verifyRequestData(array $requestData)
    {
        // response_type required
        if (empty($requestData['response_type'])) {
            throw new OAuthException('invalid_request', 'The request is missing the required parameter response_type.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        if (!($responseType = $this->responseTypeManager->getResponseType($requestData['response_type']))) {
            throw new OAuthException('invalid_request', 'The request includes the invalid parameter response_type.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }
        $this->responseType = $responseType;

        if (empty($requestData['client_id'])) {
            throw new OAuthException('invalid_request', 'The request is missing the required parameter client_id.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }

        if (!($client = $this->clientStorage->get($requestData['client_id']))) {
            throw new OAuthException('invalid_request', 'The request includes the invalid parameter client_id.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }
        $this->client = $client;

        $supportedResponseTypes = $this->client->getMetadata()->getResponseTypes() ?: ['code'];
        foreach (explode(' ', $requestData['response_type']) as $responseType) {
            if(!in_array($responseType, $supportedResponseTypes)) {
            throw new OAuthException('unsupported_response_type',
                'The authorization server does not support obtaining an authorization code using this method.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
            }
        }

        $this->verifyRedirectUri($requestData['redirect_uri'] ?? null);

        $this->verifyScope($requestData['scope'] ?? null);

        $this->state = $requestData['state'] ?? null;

        $responseModeIdentifier = $requestData['response_mode'] ?? $this->getResponseType()->getDefaultResponseMode();
        if (!($responseMode = $this->responseModeManager->getResponseMode($responseModeIdentifier))) {
            throw new OAuthException('invalid_request', 'response_mode invalid');
        }

        if (in_array($responseModeIdentifier, $this->getResponseType()->getUnsupportedResponseModes())) {
            throw new OAuthException('invalid_request', 'response_mode unsupported');
        }
        $this->responseMode = $responseMode;
    }

    /**
     * @param null|string $redirectUri
     * @throws OAuthException
     */
    protected function verifyRedirectUri(?string $redirectUri = null)
    {
        $redirectUris = $this->getClient()->getMetadata()->getRedirectUris();
        if ($redirectUri) {
            if (!in_array($redirectUri, $redirectUris)) {
                throw new OAuthException('invalid_request', 'The request includes the invalid parameter redirect_uri.',
                    'https://tools.ietf.org/html/rfc6749#section-4.1');
            }
        }
        else {
            if (count($redirectUris) == 1) {
               $redirectUri = $redirectUris[0];
            }
            else {
                throw new OAuthException('invalid_request', 'The request is missing the required parameter redirect_uri.',
                    'https://tools.ietf.org/html/rfc6749#section-4.1');
            }
        }
        try {

            $this->redirectUri = new Uri($redirectUri);
        }
        catch (\InvalidArgumentException $e) {
            throw new OAuthException('invalid_request', 'The request includes the malformed parameter redirect_uri.',
                'https://tools.ietf.org/html/rfc6749#section-4.1');
        }
    }

    /**
     * @param null|string $scope
     * @throws OAuthException
     */
    protected function verifyScope(?string $scope = null) {
        $scopes = $scope ? explode(' ', $scope) : $this->scopePolicyManager->getDefaultScopes($this->getClient());
        $this->scopePolicyManager->verifyScopes($this->getClient(), $scopes);
        $this->scopes = $scopes;
    }

    /**
     * @return null|ResponseTypeInterface
     */
    public function getResponseType(): ?ResponseTypeInterface
    {
        return $this->responseType;
    }

    /**
     * @return null|ResponseModeInterface
     */
    public function getResponseMode(): ?ResponseModeInterface
    {
        return $this->responseMode;
    }

    /**
     * @return null|RegisteredClient
     */
    public function getClient(): ?RegisteredClient
    {
        return $this->client;
    }

    /**
     * @return Uri|null
     */
    public function getRedirectUri(): ?Uri
    {
        return $this->redirectUri;
    }

    /**
     * @return null|mixed
     */
    public function getState()
    {
        return $this->state;
    }

    /**
     * @return null|array
     */
    public function getScopes(): ?array
    {
        return $this->scopes;
    }
}
php-guard / oauth-server

Push — master ( d9a404...9e6750 )

AuthorizationEndpoint::verifyScope() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like
