Oauth2RefreshTokenGrant::respondToAccessTokenRequest()

Complexity

Conditions	9
Paths	8

Size

Total Lines	58
Code Lines	29

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	29
CRAP Score	9.4078

Importance

Changes	1
Bugs	0	Features	0

<?php
    public function respondToAccessTokenRequest(
        ServerRequestInterface $request,
        ResponseTypeInterface $responseType,
        DateInterval $accessTokenTTL
    ) {
        /** @var Oauth2ClientInterface $client */
        $client = $this->validateClient($request);
        $oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier());

        $user = $this->module->getUserRepository()->getUserEntityByIdentifier($oldRefreshToken['user_id']);
        if (empty($user)) {
            throw new NotFoundHttpException(
                Yii::t('oauth2', 'Unable to find user with id "' . $oldRefreshToken['user_id'] . '".')
            );
        }

        if ($user->isOauth2ClientAllowed($client, $this->getIdentifier()) !== true) {
            throw Oauth2ServerException::accessDenied(
                Yii::t('oauth2', 'User {user_id} is not allowed to use client {client_identifier}.', [
                    'user_id' => $user->getId(),

The method getId() does not exist on rhertogh\Yii2Oauth2Server\interfaces\models\external\user\Oauth2UserInterface. It seems like you code against a sub-type of said class. However, the method does not exist in rhertogh\Yii2Oauth2Server\interfaces\models\external\user\Oauth2OidcUserInterface or rhertogh\Yii2Oauth2Server\interfaces\models\external\user\Oauth2PasswordGrantUserInterface. Are you sure you never get one of those?

                    'client_identifier' => $client->getIdentifier(),
                ])
            );
        }

        if ($this->module->enableOpenIdConnect) {
            $scopes = $oldRefreshToken['scopes'] ?? [];

            if (
                in_array(Oauth2OidcScopeInterface::OPENID_CONNECT_SCOPE_OPENID, $scopes)
                && !in_array(Oauth2OidcScopeInterface::OPENID_CONNECT_SCOPE_OFFLINE_ACCESS, $scopes)
            ) {
                // Refresh tokens are not issued when `openIdConnectIssueRefreshTokenWithoutOfflineAccessScope`
                // is disabled, but let's ensure setting hasn't changed.
                if (!$this->module->openIdConnectIssueRefreshTokenWithoutOfflineAccessScope) {
                    throw Oauth2ServerException::accessDenied(
                        'The refresh token grant type is unavailable in OpenID Connect context when'
                            . ' `openIdConnectIssueRefreshTokenWithoutOfflineAccessScope` is disabled.'
                    );
                }

                if (!($user instanceof Oauth2OidcUserSessionStatusInterface)) {
                    throw new InvalidConfigException(
                        'In order to support OpenId Connect Refresh Tokens without offline_access scope '
                            . get_class($user) . ' must implement ' . Oauth2OidcUserSessionStatusInterface::class
                    );
                }

                if (!$user->hasActiveSession()) {
                    throw Oauth2ServerException::accessDenied(
                        'The refresh token grant type is unavailable in OpenID Connect context when the user is'
                        . ' offline and the authorized scope does not include "offline_access".'
                    );
                }
            }
        }

        return parent::respondToAccessTokenRequest($request, $responseType, $accessTokenTTL);
    }