OAuth2\OpenID\ResponseTypes\IdTokenResponseType

Complexity

Total Complexity

28

Size/Duplication

Total Lines	154
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes

0

10 Methods

Rating	Name	Duplication	Size	Complexity
A	isQueryResponseModeSupported()	0	3	1
A	isMultiValuedResponseTypeSupported()	0	3	1
A	verifyRequest()	0	13	3
A	getResponseType()	0	3	1
A	requireTLS()	0	3	1
A	isImplicit()	0	3	1
A	__construct()	0	7	1
A	getExtendedResponseTypes()	0	2	1
A	getDefaultResponseMode()	0	3	1
C	handle()	0	67	17

<?php
/**
 * Created by PhpStorm.
 * User: GCC-MED
 * Date: 19/01/2018
 * Time: 15:06
 */

namespace OAuth2\OpenID\ResponseTypes;


use Firebase\JWT\JWT;
use OAuth2\OpenID\Config;
use OAuth2\Exceptions\OAuthException;
use OAuth2\OpenID\Credentials\IdToken;
use OAuth2\OpenID\ResponseModes\ResponseModeInterface;
use OAuth2\OpenID\Storages\UserInfoClaimsStorage;
use OAuth2\Repositories\ConfigurationRepository;
use OAuth2\Roles\Clients\RegisteredClient;
use OAuth2\Roles\ResourceOwnerInterface;
use OAuth2\OpenID\Storages\IdTokenStorageInterface;
use Psr\Http\Message\ServerRequestInterface;

class IdTokenResponseType implements ResponseTypeInterface
{
    /**
     * @var ConfigurationRepository
     */
    private $configurationRepository;
    /**
     * @var IdTokenStorageInterface
     */
    private $idTokenStorage;
    /**
     * @var UserInfoClaimsStorage
     */
    private $userInfoClaimsStorage;

    public function __construct(ConfigurationRepository $configurationRepository,
                                IdTokenStorageInterface $idTokenStorage,
                                UserInfoClaimsStorage $userInfoClaimsStorage)
{
    $this->configurationRepository = $configurationRepository;
    $this->idTokenStorage = $idTokenStorage;
    $this->userInfoClaimsStorage = $userInfoClaimsStorage;
}

    public function getResponseType(): string
    {
        return 'id_token';
    }

    /**
     * @param ServerRequestInterface $request
     * @param ResourceOwnerInterface $resourceOwner
     * @param RegisteredClient $client
     * @param array|null $scope
     * @param array|null $extendedResponseTypes
     * @return array
     */
    public function handle(ServerRequestInterface $request, ResourceOwnerInterface $resourceOwner,
                           RegisteredClient $client, ?array $scope = null, ?array $extendedResponseTypes = null): array
    {
        $data = $request->getMethod() === 'GET' ? $request->getQueryParams() : $request->getParsedBody();

        // Get required claims
        $claims = [
            'iss' => $this->configurationRepository->getConfig(Config::OPENID_ISSUER),
            'sub' => $resourceOwner->getIdentifier(),
            'aud' => $client->getIdentifier(),
            'exp' => time() + $this->idTokenStorage->getLifetime(),
            'iat' => time()
        ];

        // todo, include if auth_time is marked as an essential claim by the client otherwise it is optional (conf ?)
        if(isset($data['max_age']) && $data['max_age']) {
            $claims['auth_time'] = $resourceOwner->getTimeWhenAuthenticationOccured();
        }

        if(isset($data['nonce']) && !is_null($data['nonce'])) {
            $claims['nonce'] = $data['nonce'];
        }

        if(empty($extendedResponseTypes)) {
            $standardClaims = $this->userInfoClaimsStorage->getClaims($resourceOwner);

            foreach ($this->userInfoClaimsStorage->getClaimsByScope($scope) as $claimRequested) {
                if(isset($standardClaims[$claimRequested]) && $standardClaims[$claimRequested]) {
                    $claims[$claimRequested] = $standardClaims[$claimRequested];
                }
            }
        }

        if(isset($extendedResponseTypes['code'])) {
            //c_hash
            /**
             * @var \OAuth2\ResponseTypes\ResponseTypeInterface $responseType
             */
            $responseType = $extendedResponseTypes['code'];
            $code = $responseType->handle($request, $resourceOwner, $client, $scope)['code'];
            $result['code'] = $code;

$result was never initialized. Although not strictly required by PHP, it is generally a good practice to add $result = array(); before regardless.

            $claims['c_hash'] = 'todo'; //todo
        }

        if(isset($extendedResponseTypes['token'])) {
            //at_hash
            /**
             * @var \OAuth2\ResponseTypes\ResponseTypeInterface $responseType
             */
            $responseType = $extendedResponseTypes['token'];
            $token = $responseType->handle($request, $resourceOwner, $client, $scope)['token'];
            $result['token'] = $token;
            $claims['at_hash'] = 'todo'; //todo
        }
        else {
            $requestedScopes = isset($data['scope']) ? explode(' ', $data['scope']) : [];

            if ((empty($requestedScopes) && !is_null($scope)) || (is_array($scope) && !empty(array_diff($requestedScopes, $scope)))) {
                $data['scope'] = implode(' ', $scope);
            }
        }


//        $idToken = new IdToken($claims);

50% of this comment could be valid code. Did you maybe forget this after debugging?

        $key = 'mykey'; // todo
        $result['id_token'] = JWT::encode($claims, $key);
        return $result;
    }

    public function getDefaultResponseMode(): string
    {
        return ResponseModeInterface::RESPONSE_MODE_FRAGMENT;
    }

    public function isImplicit(): bool
    {
        return true;
    }

    /**
     * @param ServerRequestInterface $request
     * @throws OAuthException
     */
    public function verifyRequest(ServerRequestInterface $request): void
    {
        $scope = explode(' ', $request->getQueryParams()['scope'] ?? $request->getParsedBody()['scope'] ?? null);
        if (is_null($scope)) {

The condition is_null($scope) can never be true.

            throw new OAuthException('invalid_request',
                'Missing a required parameter : scope',
                'http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint'
            );
        }
        if (!in_array('openid', $scope)) {
            throw new OAuthException('invalid_request',
                'Invalid scope parameter : openid scope value must be present',
                'http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint'
            );
        }
    }

    public function requireTLS(): bool
    {
        return true;
    }

    public function isMultiValuedResponseTypeSupported(): bool
    {
        return true;
    }

    public function getExtendedResponseTypes(): ?array {
        return ['code', 'token'];
    }

    public function isQueryResponseModeSupported(): bool
    {
        return false;
    }
}