OAuth2\ClientAuthentication\Authenticators\ClientPasswordAuthenticator

Complexity

Total Complexity

16

Size/Duplication

Total Lines	89
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	3

Test Coverage

Coverage

62.79%

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	5	1
A	isPasswordAuthentication()	0	4	1
A	support()	0	9	2
C	authenticate()	0	51	12

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 07/01/2018
 * Time: 14:19
 */

namespace OAuth2\ClientAuthentication\Authenticators;


use OAuth2\Role\Client\Type\ClientPassword;
use OAuth2\Role\Client\Type\ConfidentialClient;
use OAuth2\Roles\ClientInterface;
use OAuth2\Roles\Clients\ConfidentialClientInterface;
use OAuth2\Storages\ClientStorageInterface;
use Psr\Http\Message\ServerRequestInterface;

class ClientPasswordAuthenticator implements ClientAuthenticatorInterface
{
    /**
     * @var ClientStorageInterface
     */
    private $clientStorage;
    /**
     * @var bool
     */
    private $supportCredentialsInBody;

    public function __construct(ClientStorageInterface $clientStorage, ?bool $supportCredentialsInBody = null)
    {
        $this->clientStorage = $clientStorage;
        $this->supportCredentialsInBody = $supportCredentialsInBody;
    }

    public function isPasswordAuthentication(): bool
    {
        return true;
    }

    public function support(ServerRequestInterface $request): bool
    {
        if ($request->hasHeader('Authorization')) {
            return true;
        }

        $body = $request->getParsedBody();
        return isset($body['client_id'], $body['client_secret']);
    }

    /**
     * @param ServerRequestInterface $request
     * @return ClientInterface
     * @throws \Exception
     */
    public function authenticate(ServerRequestInterface $request): ClientInterface
    {
        $identifier = null;
        $password = null;
        $useHTTPAuthenticationScheme = true;
        $body = $request->getParsedBody();
        if ($request->hasHeader('Authorization')) {
            // 2.3 The client MUST NOT use more than one authentication method in each request
            if (isset($body['client_secret'])) {
                throw new \Exception('Multiple authentication methods used');
            }

            $authorization = $request->getHeader('Authorization')[0] ?? '';
            $authorization = explode(' ', trim($authorization));
            $method = $authorization[0];
            if (strtolower($method) === 'basic') {
                $authorization = explode(':', base64_decode($authorization[1]));
                $identifier = $authorization[0] ?? null;
                $password = $authorization[1] ?? '';
            }
        } else {
            $identifier = $body['client_id'] ?? null;
            $password = $body['client_secret'] ?? '';
            $useHTTPAuthenticationScheme = false;
        }

        if (is_null($identifier)) {
            throw new \Exception('No client authentication included');
        }

        $client = $this->clientStorage->get($identifier);
        if (!$client) {
            throw new \Exception('Unknown client');
        }

        if (!$useHTTPAuthenticationScheme &&
            ($this->supportCredentialsInBody === false ||
                (is_null($this->supportCredentialsInBody) && $client->isHttpBasicAuthenticationSchemeSupported()))) {
            throw new \Exception('Authentication method is limited to HTTP Basic authentication scheme');
        }

        if (!$client instanceof ConfidentialClientInterface) {
            throw new \Exception('Unsupported authentication method');
        }

        if ($client->getPassword() !== $password) {
            throw new \Exception('Authentication failed');
        }

        return $client;
    }
}