OAuth2\ClientAuthentication\ClientAuthenticationMethodManager

Complexity

Total Complexity

15

Size/Duplication

Total Lines	90
Duplicated Lines	0 %

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	addClientAuthenticationMethod()	0	2	1
C	authenticate()	0	62	12
A	getClientAuthenticationMethod()	0	3	1
A	__construct()	0	3	1

<?php
/**
 * Created by PhpStorm.
 * User: GCC-MED
 * Date: 09/03/2018
 * Time: 17:00
 */

namespace OAuth2\ClientAuthentication;


use OAuth2\Exceptions\OAuthException;
use OAuth2\Roles\ClientInterface;
use OAuth2\Storages\ClientStorageInterface;
use Psr\Http\Message\ServerRequestInterface;

class ClientAuthenticationMethodManager
{
    protected $clientAuthenticationMethods = [];
    /**
     * @var ClientStorageInterface
     */
    private $clientStorage;

    public function __construct(ClientStorageInterface $clientStorage)
    {
        $this->clientStorage = $clientStorage;
    }

    public function addClientAuthenticationMethod(string $identifier, ClientAuthenticationMethodInterface $clientAuthenticationMethod) {
        $this->clientAuthenticationMethods[$identifier] = $clientAuthenticationMethod;
    }
    public function getClientAuthenticationMethod(string $identifier): ClientAuthenticationMethodInterface
    {
        return $this->clientAuthenticationMethods[$identifier] ?? null;

The expression return $this->clientAuthenticationMethods[$identifier] ?? null could return the type null which is incompatible with the type-hinted return OAuth2\ClientAuthentication\ClientAuthenticationMethodInterface. Consider adding an additional type-check to rule them out.

    }

    /**
     * authenticate the client if client authentication is included
     * @param ServerRequestInterface $request
     * @param array $requestData
     * @return ClientInterface
     * @throws OAuthException
     */
    public function authenticate(ServerRequestInterface $request, array $requestData): ClientInterface
    {
        /**
         * require client authentication for confidential clients or for any
         * client that was issued client credentials (or with other
         * authentication requirements)
         */

        /**
         * @var ClientAuthenticationMethodInterface $clientAuthenticationMethod
         */
        $clientAuthenticationMethodUsedIdentifier = null;
        $clientAuthenticationMethodUsed = null;
        $authenticated = false;
        foreach ($this->clientAuthenticationMethods as $identifier => $clientAuthenticationMethod) {
            if($clientAuthenticationMethod->support($request, $requestData))  {
                if($clientAuthenticationMethodUsedIdentifier) {
                    throw new OAuthException('invalid_request',
                        'The request utilizes more than one mechanism for authenticating the client.',
                        'https://tools.ietf.org/html/rfc6749#section-3.2.1');
                }
                $clientAuthenticationMethodUsedIdentifier = $identifier;
                $clientAuthenticationMethodUsed = $clientAuthenticationMethod;
            }
        }

        if($clientAuthenticationMethodUsed) {
            if(!$client = $clientAuthenticationMethod->authenticate($request, $requestData)) {

The variable $clientAuthenticationMethod seems to be defined by a foreach iteration on line 59. Are you sure the iterator is never empty, otherwise this variable is not defined?

                throw new OAuthException('invalid_client',
                    'Client authentication failed. Unknown client.',
                    'https://tools.ietf.org/html/rfc6749#section-3.2.1');
            }
        } else {
            if (empty($requestData['client_id'])) {
                throw new OAuthException('invalid_request', 'The request is missing the required parameter client_id.',
                    'https://tools.ietf.org/html/rfc6749#section-4.1');
            }

            if (!$client = $this->clientStorage->get($requestData['client_id'])) {
                throw new OAuthException('invalid_request', 'The request includes the invalid parameter client_id.',
                    'https://tools.ietf.org/html/rfc6749#section-4.1');
            }

            if($client->hasCredentials()) {
                if (!$authenticated) {

The condition $authenticated is always false.

                    throw new OAuthException('invalid_client', 'Client authentication failed. No client authentication included',
                        'https://tools.ietf.org/html/rfc6749#section-3.2.1');
                }
            }

            $clientAuthenticationMethodUsedIdentifier = 'none';
        }

        $tokenEndpointAuthMethod = $client->getMetadata()->getTokenEndpointAuthMethod() ?: 'client_secret_basic';
        if($tokenEndpointAuthMethod !== $clientAuthenticationMethodUsedIdentifier) {
            throw new OAuthException('invalid_client',
                'Client authentication failed. Unsupported authentication method.',
                'https://tools.ietf.org/html/rfc6749#section-3.2.1');

        }

        return $client;
    }
}