OAuth2\Extensions\PKCE\Flows\AuthorizationCodeFlow

Complexity

Total Complexity

7

Size/Duplication

Total Lines	56
Duplicated Lines	0 %

Importance

Changes

0

3 Methods

Rating	Name	Duplication	Size	Complexity
B	handleAuthorizationRequest()	0	31	5
A	__construct()	0	4	1
A	handleAccessTokenRequest()	0	5	1

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 07/03/2018
 * Time: 23:43
 */

namespace OAuth2\Extensions\PKCE\Flows;


use OAuth2\Endpoints\AuthorizationEndpoint;
use OAuth2\Endpoints\TokenEndpoint;
use OAuth2\Exceptions\OAuthException;
use OAuth2\Extensions\PKCE\Credentials\CodeChallenge;
use OAuth2\Extensions\PKCE\Storages\AuthorizationCodeStorageInterface;
use OAuth2\Roles\Clients\PublicClient;

/**
 * Class AuthorizationCodeFlow
 * @package OAuth2\Extensions\PKCE\Flows
 * @rfc https://tools.ietf.org/html/rfc7636
 */
class AuthorizationCodeFlow extends \OAuth2\Flows\AuthorizationCodeFlow
{
    /**
     * AuthorizationCodeFlow constructor.
     * @param AuthorizationCodeStorageInterface $authorizationCodeStorage
     */
    public function __construct(AuthorizationCodeStorageInterface $authorizationCodeStorage)
    {
        parent::__construct($authorizationCodeStorage);
        $this->authorizationCodeStorage = $authorizationCodeStorage;
    }

    /**
     * @param AuthorizationEndpoint $authorizationEndpoint
     * @param array $requestData
     * @return array
     * @throws OAuthException
     */
    function handleAuthorizationRequest(AuthorizationEndpoint $authorizationEndpoint, array $requestData): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        $authorizationCode = $this->authorizationCodeStorage->create(
            implode(' ', $authorizationEndpoint->getScopes()),
            $authorizationEndpoint->getClient()->getIdentifier(),
            $authorizationEndpoint->getResourceOwner()->getIdentifier(),
            $requestData['scope'] ?? null,
            $requestData['redirect_uri'] ?? null
        );

        if (empty($requestData['code_challenge'])) {
            if ($authorizationEndpoint->getClient() instanceof PublicClient) {
                throw new OAuthException('invalid_request',
                    'The request is missing the required parameter code_challenge for public clients',
                    'https://tools.ietf.org/html/rfc7636#section-4.4');
            }
        } else {
            $codeChallengeMethod = empty($requestData['code_challenge_method']) ? 'plain' : $requestData['code_challenge_method'];
            if(!in_array($codeChallengeMethod, ['plain', 'S256'])) {
                throw new OAuthException('invalid_request',
                    'The request includes the invalid parameter code_challenge_method. Supported : plain, S256',
                    'https://tools.ietf.org/html/rfc7636#section-4');
            }

            $codeChallenge = new CodeChallenge($requestData['code_challenge'], $codeChallengeMethod);
            $this->authorizationCodeStorage->associate($codeChallenge, $authorizationCode);

The method associate() does not exist on OAuth2\Storages\AuthorizationCodeStorageInterface. Since it exists in all sub-types, consider adding an abstract or default implementation to OAuth2\Storages\AuthorizationCodeStorageInterface.

        }

        $this->authorizationCodeStorage->save($authorizationCode);

        return ['code' => $authorizationCode->getCode()];
    }

    public function handleAccessTokenRequest(TokenEndpoint $tokenEndpoint, array $requestData): array
    {
        // TODO https://tools.ietf.org/html/rfc7636#section-4.2

        return parent::handleAccessTokenRequest($tokenEndpoint, $requestData);
    }

}