rhertogh\Yii2Oauth2Server\controllers\web\openidconnect\Oauth2OidcEndSessionAction

Complexity

Total Complexity

23

Size/Duplication

Total Lines	114
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes	1
Bugs	0	Features	0

1 Method

Rating	Name	Duplication	Size	Complexity
F	run()	0	107	23

<?php

namespace rhertogh\Yii2Oauth2Server\controllers\web\openidconnect;

use Lcobucci\JWT\Encoding\JoseEncoder;
use Lcobucci\JWT\Signer\Key\InMemory;
use Lcobucci\JWT\Signer\Rsa\Sha256;
use Lcobucci\JWT\Token\Parser;
use Lcobucci\JWT\Validation\Constraint\PermittedFor;
use Lcobucci\JWT\Validation\Constraint\RelatedTo;
use Lcobucci\JWT\Validation\Constraint\SignedWith;
use Lcobucci\JWT\Validation\Validator;
use League\OAuth2\Server\RedirectUriValidators\RedirectUriValidator;
use rhertogh\Yii2Oauth2Server\controllers\web\base\Oauth2BaseWebAction;
use rhertogh\Yii2Oauth2Server\controllers\web\Oauth2OidcController;
use rhertogh\Yii2Oauth2Server\helpers\UrlHelper;
use rhertogh\Yii2Oauth2Server\interfaces\models\external\user\Oauth2OidcUserInterface;
use Yii;
use yii\base\InvalidConfigException;
use yii\web\BadRequestHttpException;
use yii\web\ForbiddenHttpException;
use yii\web\Response;
use yii\web\UnauthorizedHttpException;

/**
 * @property Oauth2OidcController $controller
 */
class Oauth2OidcEndSessionAction extends Oauth2BaseWebAction
{
    /**
     * @see https://openid.net/specs/openid-connect-rpinitiated-1_0.html
     * @return Response
     * @throws InvalidConfigException
     */
    public function run()
    {
        $module = $this->controller->module;
        $request = Yii::$app->request;

It seems like Yii::app->request can also be of type yii\web\Request. However, the property $request is declared as type yii\console\Request. Maybe add an additional type check?

        $identity = $module->getUserIdentity();

Are you sure the assignment to $identity is correct as $module->getUserIdentity() targeting rhertogh\Yii2Oauth2Server\Oauth2Module::getUserIdentity() seems to always return null.

        $logoutVerificationRequired = false;

        if (!$module->enableOpenIdConnect) {
            throw new ForbiddenHttpException('OpenID Connect is disabled.');
        }

        if ($identity && !($identity instanceof Oauth2OidcUserInterface)) {

$identity is of type null, thus it always evaluated to false.

            throw new InvalidConfigException('In order to support OpenID Connect '
                . get_class($identity) . ' must implement ' . Oauth2OidcUserInterface::class);
        }

        $clientIdentifier = $this->getRequestParam($request, 'client_id');

It seems like $request can also be of type yii\console\Request; however, parameter $request of rhertogh\Yii2Oauth2Server\controllers\web\base\Oauth2BaseWebAction::getRequestParam() does only seem to accept yii\web\Request, maybe add an additional type check?

        $idTokenHint = $this->getRequestParam($request, 'id_token_hint');
        $state = $this->getRequestParam($request, 'state');
        $postLogoutRedirectUri = $this->getRequestParam($request, 'post_logout_redirect_uri');

        // The `id_token_hint` is the OIDC id token (https://openid.net/specs/openid-connect-core-1_0.html#IDToken)

Inline comments must end in full-stops, exclamation marks, or question marks

        if ($idTokenHint) {

            $parser = new Parser(new JoseEncoder());

            $idToken = $parser->parse($idTokenHint);

It seems like $idTokenHint can also be of type array; however, parameter $jwt of Lcobucci\JWT\Token\Parser::parse() does only seem to accept string, maybe add an additional type check?

            $validator = new Validator();

            if (!$validator->validate($idToken, new SignedWith(

The first expression of a multi-line control structure must be on the line after the opening parenthesis

                new Sha256(),
                InMemory::plainText($module->getPublicKey()->getKeyContents())
            ))) {

Each line in a multi-line control structure must be indented at least once; expected at least 16 spaces, but found 12

The closing parenthesis of a multi-line control structure must be on the line after the last expression

                throw new UnauthorizedHttpException('Invalid `id_token_hint` signature.');
            }

            if ($clientIdentifier) {
                if (!$validator->validate($idToken, new PermittedFor($clientIdentifier))) {

It seems like $clientIdentifier can also be of type array; however, parameter $audience of Lcobucci\JWT\Validation\Constraint\PermittedFor::__construct() does only seem to accept string, maybe add an additional type check?

                    throw new UnauthorizedHttpException('Invalid "aud" claim in `id_token_hint`.');
                }
            } else {
                $audiences = $idToken->claims()->get('aud');
                if (count($audiences) === 1) {

It seems like $audiences can also be of type null; however, parameter $value of count() does only seem to accept Countable|array, maybe add an additional type check?

                    $clientIdentifier = $audiences[0];
                } else {
                    throw new BadRequestHttpException(
                        'The `client_id` parameter is required when there are multiple audiences'
                        . ' in the "aud" claim of the `id_token_hint`.'
                    );
                }
            }

            if ($identity) {

$identity is of type null, thus it always evaluated to false.

                if (!$validator->validate($idToken, new RelatedTo((string)$identity->getIdentifier()))) {
                    $logoutVerificationRequired = true;
                }
            }
        } else {
            if (!$module->openIdConnectAllowAnonymousEndSession) {
                throw new BadRequestHttpException('The `id_token_hint` parameter is required.');
            }
            $logoutVerificationRequired = true;
        }

        if ($clientIdentifier) {
            $client = $module->getClientRepository()->getClientEntity($clientIdentifier);
            if (!$client || !$client->isEnabled()) {

$client is of type rhertogh\Yii2Oauth2Server\interfaces\models\Oauth2ClientInterface, thus it always evaluated to true.

                throw new ForbiddenHttpException('Client "' . $clientIdentifier . '" not found or disabled.');
            }
        }

        if (!$logoutVerificationRequired) {
            if (isset($client)) {
                if (!$client->getOpenIdConnectSkipLogoutValidation()) {

The variable $client does not seem to be defined for all execution paths leading up to this point.

                    $logoutVerificationRequired = true;
                }
            } else {
                $logoutVerificationRequired = true;
            }
        }

        if ($logoutVerificationRequired) {
            throw new \LogicException('Not yet implemented');
        }

        $module->logoutUser();

        if (empty($client) || empty($postLogoutRedirectUri)) {
            return $this->controller->goHome();
        }

        $allowedPostLogoutRedirectUris = $client->getPostLogoutRedirectUris();
        $validatePostLogoutRedirectUri = $postLogoutRedirectUri;
        if ($client->isVariableRedirectUriQueryAllowed()) {
            $validatePostLogoutRedirectUri = UrlHelper::stripQueryAndFragment($validatePostLogoutRedirectUri);
        }

        $validator = new RedirectUriValidator($allowedPostLogoutRedirectUris);
        if (!$validator->validateRedirectUri($validatePostLogoutRedirectUri)) {

It seems like $validatePostLogoutRedirectUri can also be of type array; however, parameter $redirectUri of League\OAuth2\Server\RedirectUriValidators\RedirectUriValidator::validateRedirectUri() does only seem to accept string, maybe add an additional type check?

            throw new UnauthorizedHttpException('Invalid `post_logout_redirect_uri`.');
        }

        $redirectUri = UrlHelper::addQueryParams($postLogoutRedirectUri, ['state' => $state]);

It seems like $postLogoutRedirectUri can also be of type array; however, parameter $url of rhertogh\Yii2Oauth2Server\helpers\UrlHelper::addQueryParams() does only seem to accept string, maybe add an additional type check?

        return $this->controller->redirect($redirectUri);
    }
}