Oauth2RevokeAction::parseTokenAsAccessToken() - Code Metrics - Inspection of "Fixed \Yii2Oauth2ServerTests\unit\controllers\cons..." - rhertogh/yii2-oauth2-server - Measure and Improve Code Quality continuously with Scrutinizer

Passed
Push — master ( a721e7...5904cd )

by Rutger
created 2024-07-27 16:23 UTC
Oauth2RevokeAction::parseTokenAsAccessToken() A

↳ Parent: Oauth2RevokeAction
Complexity

Conditions	3
Paths	19
Size

Total Lines	40
Code Lines	27
Duplication

Lines	0
Ratio	0 %
Code Coverage

Tests	32
CRAP Score	3
Importance

Changes	1
Bugs	0	Features	0
Metric	Value
eloc	27
c	1
b	0
f	0
dl	0
loc	40
ccs	32
cts	32
cp	1
rs	9.488
cc	3
nc	19
nop	3
crap	3
<?php

namespace rhertogh\Yii2Oauth2Server\controllers\web\server;

use Defuse\Crypto\Crypto;
use Defuse\Crypto\Key;
use Lcobucci\JWT\Configuration;
use Lcobucci\JWT\Signer\Key\InMemory;
use Lcobucci\JWT\Signer\Rsa\Sha256;
use Lcobucci\JWT\Validation\Constraint\SignedWith;
use rhertogh\Yii2Oauth2Server\controllers\web\Oauth2ServerController;
use rhertogh\Yii2Oauth2Server\controllers\web\server\base\Oauth2BaseServerAction;
use rhertogh\Yii2Oauth2Server\helpers\Oauth2RequestHelper;
use rhertogh\Yii2Oauth2Server\interfaces\controllers\web\server\Oauth2RevokeActionInterface;
use rhertogh\Yii2Oauth2Server\Oauth2Module;
use Yii;
use yii\helpers\Json;
use yii\web\BadRequestHttpException;
use yii\web\ForbiddenHttpException;
use yii\web\NotFoundHttpException;

/**
 * OAuth 2.0 Token Revocation (RFC 7009)
 *
 * @property Oauth2ServerController $controller
 * @see https://datatracker.ietf.org/doc/html/rfc7009
 */
class Oauth2RevokeAction extends Oauth2BaseServerAction implements Oauth2RevokeActionInterface
{
    public function run()
    {
        try {
            $module = $this->controller->module;

            if (!$module->enableTokenRevocation) {
                throw new NotFoundHttpException();
            }

            $tokenParsers = [
                'refresh_token' => [$this, 'parseTokenAsRefreshToken'],
                'access_token' => [$this, 'parseTokenAsAccessToken'],
            ];

            $request = Yii::$app->request;
class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}

            $token = $request->getBodyParam('token');
            if (empty($token)) {
                throw new BadRequestHttpException('The `token` body parameter is required.');
            }
            $tokenTypeHint = $request->getBodyParam('token_type_hint');
            if (!empty($tokenTypeHint)) {

                if (in_array($tokenTypeHint, array_keys($tokenParsers))) {
                    // Move hinted type to beginning.
                    $tokenParsers = [$tokenTypeHint => $tokenParsers[$tokenTypeHint]] + $tokenParsers;
                } else {
                    Yii::getLogger()->log(
                        'The client specified an unknown `token_type_hint` "' . $tokenTypeHint . '".',
                        $module->getElaboratedHttpClientErrorsLogLevel(),
                        __METHOD__
                    );
                }
            }

            foreach ($tokenParsers as $tokenParser) {
                $parseResult = call_user_func($tokenParser, $module, $token, $tokenTypeHint);
                if ($parseResult) {
                    $clientIdentifier = $parseResult['clientIdentifier'] ?? null;
                    $refreshTokenIdentifier = $parseResult['refreshTokenIdentifier'] ?? null;
                    $accessTokenIdentifier = $parseResult['accessTokenIdentifier'] ?? null;
                    break;
                }
            }

            if (empty($clientIdentifier) || empty($accessTokenIdentifier)) {
                throw new BadRequestHttpException('Unable to resolve the `token` parameter to a valid token type.');
            }

            $client = $module->getClientRepository()->findModelByIdentifier($clientIdentifier);
            if (!$client) {
                throw new BadRequestHttpException('The `client_id` "' . $clientIdentifier . '" specified in the token is not valid.'); // phpcs:ignore Generic.Files.LineLength.TooLong

            }

            if ($client->isConfidential()) {
                try {
                    [$credentialsClientIdentifier, $clientSecret] = Oauth2RequestHelper::getClientCredentials($request);
                    [$credentialsClientIdentifier, $clientSecret] = Oauth2RequestHelper::getClientCredentials(/** @scrutinizer ignore-type */ $request);
                } catch (\Exception $exception) {

                }

                if (empty($credentialsClientIdentifier) || empty($clientSecret)) {
                    throw new ForbiddenHttpException('Client authentication is required for confidential clients.');
                }

                if (
                    !Yii::$app->security->compareString($client->getIdentifier(), $credentialsClientIdentifier)
                    || !$client->validateSecret($clientSecret, $module->getCryptographer())
                ) {
                    throw new ForbiddenHttpException('Invalid client authentication.');
                }
            }

            if (!empty($refreshTokenIdentifier)) {
                $module->getRefreshTokenRepository()->revokeRefreshToken($refreshTokenIdentifier);
            }
            $module->getAccessTokenRepository()->revokeAccessToken($accessTokenIdentifier);


            return Yii::$app->response;
        } catch (\Exception $e) {
            return $this->processException($e, __METHOD__);
        }
    }

    protected function parseTokenAsRefreshToken(Oauth2Module $module, string $token, string $tokenTypeHint)
    {
        try {
            $refreshTokenString = Crypto::decrypt($token, Key::loadFromAsciiSafeString($module->codesEncryptionKey));
            $refreshToken = Json::decode($refreshTokenString);
        } catch (\Throwable $e) {
            if ($tokenTypeHint === 'refresh_token') {
                Yii::getLogger()->log(
                    'The client specified the `token_type_hint` as "refresh_token",'
                        . ' however the server is unable to parse the `token` as such: ' . $e,
                    $module->getElaboratedHttpClientErrorsLogLevel(),
                    __METHOD__
                );
            }
            unset($e);
        }

        if (!empty($refreshToken['refresh_token_id'])) {
            Yii::debug('Found refresh token: ' . $refreshTokenString, __METHOD__);
            $refreshTokenIdentifier = $refreshToken['refresh_token_id'];

            if (empty($refreshToken['access_token_id'])) {
                throw new BadRequestHttpException('The `access_token_id` must be specified in the refresh token.');
            }

            $accessTokenIdentifier = $refreshToken['access_token_id'];

            if (empty($refreshToken['client_id'])) {
                throw new BadRequestHttpException('The `client_id` must be specified in the refresh token.');
            }

            $clientIdentifier = $refreshToken['client_id'];

            return [
                'clientIdentifier' => $clientIdentifier,
                'refreshTokenIdentifier' => $refreshTokenIdentifier,
                'accessTokenIdentifier' => $accessTokenIdentifier
            ];
        }

        return null;
    }

    protected function parseTokenAsAccessToken(Oauth2Module $module, string $token, string $tokenTypeHint)
    {
        try {
            // Based on \League\OAuth2\Server\AuthorizationValidators\BearerTokenValidator::initJwtConfiguration().
            $jwtConfiguration = Configuration::forSymmetricSigner(
                new Sha256(),
                InMemory::plainText('empty', 'empty')
            );

            $publicKey = $module->getPublicKey();
            $jwtConfiguration->setValidationConstraints(
                new SignedWith(
                    new Sha256(),
                    InMemory::plainText($publicKey->getKeyContents(), $publicKey->getPassPhrase() ?? '')
                )
            );

            $accessToken = $jwtConfiguration->parser()->parse($token);
            $jwtConfiguration->validator()->assert($accessToken, ...$jwtConfiguration->validationConstraints());
            Yii::debug('Found access token: ' . $token, __METHOD__);
            $accessTokenClaims = $accessToken->claims();
            $accessTokenIdentifier = $accessTokenClaims->get('jti');
            $clientIdentifier = $accessTokenClaims->get('client_id');

            return [
                'clientIdentifier' => $clientIdentifier,
                'accessTokenIdentifier' => $accessTokenIdentifier
            ];
        } catch (\Throwable $e) {
            if ($tokenTypeHint === 'access_token') {
                Yii::getLogger()->log(
                    'The client specified the `token_type_hint` as "access_token",'
                        . ' however the server is unable to parse the `token` as such: ' . $e,
                    $module->getElaboratedHttpClientErrorsLogLevel(),
                    __METHOD__
                );
            }
            unset($e);
        }
        return null;
    }
}

rhertogh / yii2-oauth2-server

Push — master ( a721e7...5904cd )

Oauth2RevokeAction::parseTokenAsAccessToken() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like
