Rinvex\Oauth\Grants\RefreshTokenGrant

Complexity

Total Complexity

7

Size/Duplication

Total Lines	71
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	9

Importance

Changes

0

2 Methods

Rating	Name	Duplication	Size	Complexity
A	respondToAccessTokenRequest()	0	41	4
A	validateUser()	0	8	3

<?php

declare(strict_types=1);

namespace Rinvex\Oauth\Grants;

use DateInterval;
use League\OAuth2\Server\RequestEvent;
use Psr\Http\Message\ServerRequestInterface;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
use League\OAuth2\Server\Grant\RefreshTokenGrant as BaseRefreshTokenGrant;

class RefreshTokenGrant extends BaseRefreshTokenGrant
{
    /**
     * Respond to an access token request.
     *
     * @param ServerRequestInterface $request
     * @param ResponseTypeInterface  $responseType
     * @param DateInterval           $accessTokenTTL
     *
     * @throws OAuthServerException
     *
     * @return ResponseTypeInterface
     */
    public function respondToAccessTokenRequest(ServerRequestInterface $request, ResponseTypeInterface $responseType, DateInterval $accessTokenTTL)
    {
        // Validate request
        $client = $this->validateClient($request);
        $oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier());
        $this->validateUser($oldRefreshToken);
        $scopes = $this->validateScopes(
            $this->getRequestParameter(
                'scope',
                $request,
                implode(self::SCOPE_DELIMITER_STRING, $oldRefreshToken['scopes'])
            )
        );

        // The OAuth spec says that a refreshed access token can have the original scopes or fewer so ensure
        // the request doesn't include any new scopes
        foreach ($scopes as $scope) {
            if (in_array($scope->getIdentifier(), $oldRefreshToken['scopes'], true) === false) {
                throw OAuthServerException::invalidScope($scope->getIdentifier());
            }
        }

        // Expire old tokens
        $this->accessTokenRepository->revokeAccessToken($oldRefreshToken['access_token_id']);
        $this->refreshTokenRepository->revokeRefreshToken($oldRefreshToken['refresh_token_id']);

        // Issue and persist new access token
        $accessToken = $this->issueAccessToken($accessTokenTTL, $client, $oldRefreshToken['user_id'], $scopes);
        $this->getEmitter()->emit(new RequestEvent(RequestEvent::ACCESS_TOKEN_ISSUED, $request));
        $responseType->setAccessToken($accessToken);

It seems like $accessToken defined by $this->issueAccessToken($accessTokenTTL, $client, $oldRefreshToken['user_id'], $scopes) on line 54 can be null; however, League\OAuth2\Server\ResponseTypes\ResponseTypeInterface::setAccessToken() does not accept null, maybe add an additional type check?

        // Issue and persist new refresh token if given
        $refreshToken = $this->issueRefreshToken($accessToken);

It seems like $accessToken defined by $this->issueAccessToken($accessTokenTTL, $client, $oldRefreshToken['user_id'], $scopes) on line 54 can be null; however, League\OAuth2\Server\Grant\AbstractGrant::issueRefreshToken() does not accept null, maybe add an additional type check?

        if ($refreshToken !== null) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::REFRESH_TOKEN_ISSUED, $request));
            $responseType->setRefreshToken($refreshToken);
        }

        return $responseType;
    }

    /**
     * Validate the authorization code user.
     *
     * @param array $oldRefreshToken
     *
     * @throws \League\OAuth2\Server\Exception\OAuthServerException
     */
    protected function validateUser($oldRefreshToken)
    {
        [$userType, $userId] = explode(':', $oldRefreshToken['user_id']);

The variable $userType does not exist. Did you forget to declare it?

The variable $userId does not exist. Did you forget to declare it?

        if ($userType !== request()->user()->getMorphClass() || $userId !== request()->user()->getRouteKey()) {
            throw OAuthServerException::invalidRequest('user_id', 'Refresh token was not issued to this user');
        }
    }
}