OAuth2\Flows\ResourceOwnerPasswordCredentialsFlow

Complexity

Total Complexity

10

Size/Duplication

Total Lines	76
Duplicated Lines	0 %

Importance

Changes

0

7 Methods

Rating	Name	Duplication	Size	Complexity
A	getResponseTypes()	0	3	1
A	__construct()	0	8	1
B	handleAccessTokenRequest()	0	24	4
A	getUnsupportedResponseModes()	0	3	1
A	getGrantTypes()	0	3	1
A	handleAuthorizationRequest()	0	3	1
A	getDefaultResponseMode()	0	3	1

<?php
/**
 * Created by PhpStorm.
 * User: GCC-MED
 * Date: 12/03/2018
 * Time: 15:16
 */

namespace OAuth2\Flows;


use OAuth2\Endpoints\AuthorizationEndpoint;
use OAuth2\Endpoints\TokenEndpoint;
use OAuth2\Exceptions\OAuthException;
use OAuth2\GrantTypes\AbstractGrantType;
use OAuth2\GrantTypes\GrantTypeInterface;
use OAuth2\ResponseTypes\ResponseTypeInterface;
use OAuth2\ScopePolicy\Policies\ScopePolicyInterface;
use OAuth2\ScopePolicy\ScopePolicyManager;
use OAuth2\Storages\AccessTokenStorageInterface;
use OAuth2\Storages\RefreshTokenStorageInterface;
use OAuth2\Storages\ResourceOwnerStorageInterface;

class ResourceOwnerPasswordCredentialsFlow extends AbstractGrantType implements FlowInterface
{
    /**
     * @var ResourceOwnerStorageInterface
     */
    private $resourceOwnerStorage;
    /**
     * @var ScopePolicyManager
     */
    private $scopePolicyManager;

    public function __construct(ScopePolicyManager $scopePolicyManager,
                                ResourceOwnerStorageInterface $resourceOwnerStorage,
                                AccessTokenStorageInterface $accessTokenStorage,
                                RefreshTokenStorageInterface $refreshTokenStorage)
    {
        parent::__construct($accessTokenStorage, $refreshTokenStorage);
        $this->resourceOwnerStorage = $resourceOwnerStorage;
        $this->scopePolicyManager = $scopePolicyManager;
    }

    /**
     * @return ResponseTypeInterface[]
     */
    function getResponseTypes(): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        return [];
    }

    /**
     * @return GrantTypeInterface[]
     */
    function getGrantTypes(): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        return ['password'];

The expression return array('password') returns the type array<integer,string> which is incompatible with the documented return type OAuth2\GrantTypes\GrantTypeInterface[].

    }

    function handleAccessTokenRequest(TokenEndpoint $tokenEndpoint, array $requestData): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        if (empty($requestData['username'])) {
            throw new OAuthException('invalid_request',
                'The request is missing the required parameter username.',
                'https://tools.ietf.org/html/rfc7636#section-4.3');
        }
        if (empty($requestData['password'])) {
            throw new OAuthException('invalid_request',
                'The request is missing the required parameter password.',
                'https://tools.ietf.org/html/rfc7636#section-4.3');
        }

        $scopes = $this->scopePolicyManager->getScopes($tokenEndpoint->getClient(), $requestData['scope'] ?? null);
        $this->scopePolicyManager->verifyScopes($tokenEndpoint->getClient(), $scopes);

        $resourceOwnerIdentifier = $this->resourceOwnerStorage->validateCredentials($requestData['username'], $requestData['password']);
        if (!$resourceOwnerIdentifier) {
            throw new OAuthException('invalid_grant',
                'The provider authorization grant is invalid. Resource owner credentials invalid.',
                'https://tools.ietf.org/html/rfc7636#section-4.3');
        }

        return $this->issueTokens(implode(' ', $scopes), $tokenEndpoint->getClient()->getIdentifier(), $resourceOwnerIdentifier);
    }

    function handleAuthorizationRequest(AuthorizationEndpoint $authorizationEndpoint, array $requestData): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        throw new \BadMethodCallException();
    }

    function getDefaultResponseMode(): string

It is generally recommended to explicitly declare the visibility for methods.

    {
        throw new \BadMethodCallException();
    }

    function getUnsupportedResponseModes(): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        throw new \BadMethodCallException();
    }
}