AuthCodeGrant::validateAuthorizationCode() - Code Metrics - Inspection of "Merge branch 'release/v2.0.7'" - rinvex/laravel-oauth - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( 592d95...c00565 )

by Abdelrahman

created 2021-06-19 19:58 UTC

AuthCodeGrant::validateAuthorizationCode() B

↳ Parent: AuthCodeGrant

Complexity

Conditions	8
Paths	7

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	30
rs	8.1954
c	0
b	0
f	0
cc	8
nc	7
nop	3

<?php

declare(strict_types=1);

namespace Rinvex\Oauth\Grants;

use stdClass;
use DateInterval;
use LogicException;
use League\OAuth2\Server\RequestEvent;
use Psr\Http\Message\ServerRequestInterface;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
use League\OAuth2\Server\Grant\AuthCodeGrant as BaseAuthCodeGrant;
use League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface;

class AuthCodeGrant extends BaseAuthCodeGrant
{
    /**
     * @var CodeChallengeVerifierInterface[]
     */
    private $codeChallengeVerifiers = [];


    /**
     * Respond to an access token request.
     *
     * @param ServerRequestInterface $request
     * @param ResponseTypeInterface  $responseType
     * @param DateInterval           $accessTokenTTL
     *
     * @throws OAuthServerException
     *
     * @return ResponseTypeInterface
     */
    public function respondToAccessTokenRequest(ServerRequestInterface $request, ResponseTypeInterface $responseType, DateInterval $accessTokenTTL)
    {
        [$clientId] = $this->getClientCredentials($request);

        $client = $this->getClientEntityOrFail($clientId, $request);

        // Only validate the client if it is confidential
        if ($client->isConfidential()) {
            $this->validateClient($request);
        }

        $encryptedAuthCode = $this->getRequestParameter('code', $request, null);

        if ($encryptedAuthCode === null) {
            throw OAuthServerException::invalidRequest('code');
        }

        try {
            $authCodePayload = \json_decode($this->decrypt($encryptedAuthCode));

            $this->validateAuthorizationCode($authCodePayload, $client, $request);

            $scopes = $this->scopeRepository->finalizeScopes(
                $this->validateScopes($authCodePayload->scopes),
                $this->getIdentifier(),
                $client,
                $authCodePayload->user_id
            );
        } catch (LogicException $e) {
            throw OAuthServerException::invalidRequest('code', 'Cannot decrypt the authorization code', $e);
        }

        // Validate code challenge
        if (! empty($authCodePayload->code_challenge)) {
            $codeVerifier = $this->getRequestParameter('code_verifier', $request, null);

            if ($codeVerifier === null) {
                throw OAuthServerException::invalidRequest('code_verifier');
            }

            // Validate code_verifier according to RFC-7636
            // @see: https://tools.ietf.org/html/rfc7636#section-4.1
            if (preg_match('/^[A-Za-z0-9-._~]{43,128}$/', $codeVerifier) !== 1) {
                throw OAuthServerException::invalidRequest(
                    'code_verifier',
                    'Code Verifier must follow the specifications of RFC-7636.'
                );
            }

            if (property_exists($authCodePayload, 'code_challenge_method')) {
                if (isset($this->codeChallengeVerifiers[$authCodePayload->code_challenge_method])) {
                    $codeChallengeVerifier = $this->codeChallengeVerifiers[$authCodePayload->code_challenge_method];

                    if ($codeChallengeVerifier->verifyCodeChallenge($codeVerifier, $authCodePayload->code_challenge) === false) {
                        throw OAuthServerException::invalidGrant('Failed to verify `code_verifier`.');
                    }
                } else {
                    throw OAuthServerException::serverError(
                        sprintf(
                            'Unsupported code challenge method `%s`',
                            $authCodePayload->code_challenge_method
                        )
                    );
                }
            }
        }

        // Issue and persist new access token
        $accessToken = $this->issueAccessToken($accessTokenTTL, $client, $authCodePayload->user_id, $scopes);
        $this->getEmitter()->emit(new RequestEvent(RequestEvent::ACCESS_TOKEN_ISSUED, $request));
        $responseType->setAccessToken($accessToken);
/** @return stdClass|null */
function mayReturnNull() { }

function doesNotAcceptNull(stdClass $x) { }

// With potential error.
function withoutCheck() {
    $x = mayReturnNull();
    doesNotAcceptNull($x); // Potential error here.
}

// Safe - Alternative 1
function withCheck1() {
    $x = mayReturnNull();
    if ( ! $x instanceof stdClass) {
        throw new \LogicException('$x must be defined.');
    }
    doesNotAcceptNull($x);
}

// Safe - Alternative 2
function withCheck2() {
    $x = mayReturnNull();
    if ($x instanceof stdClass) {
        doesNotAcceptNull($x);
    }
}

        // Issue and persist new refresh token if given
        $refreshToken = $this->issueRefreshToken($accessToken);
/** @return stdClass|null */
function mayReturnNull() { }

function doesNotAcceptNull(stdClass $x) { }

// With potential error.
function withoutCheck() {
    $x = mayReturnNull();
    doesNotAcceptNull($x); // Potential error here.
}

// Safe - Alternative 1
function withCheck1() {
    $x = mayReturnNull();
    if ( ! $x instanceof stdClass) {
        throw new \LogicException('$x must be defined.');
    }
    doesNotAcceptNull($x);
}

// Safe - Alternative 2
function withCheck2() {
    $x = mayReturnNull();
    if ($x instanceof stdClass) {
        doesNotAcceptNull($x);
    }
}

        if ($refreshToken !== null) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::REFRESH_TOKEN_ISSUED, $request));
            $responseType->setRefreshToken($refreshToken);
        }

        // Revoke used auth code
        $this->authCodeRepository->revokeAuthCode($authCodePayload->auth_code_id);

        return $responseType;
    }

    /**
     * Validate the authorization code.
     *
     * @param stdClass               $authCodePayload
     * @param ClientEntityInterface  $client
     * @param ServerRequestInterface $request
     */
    private function validateAuthorizationCode($authCodePayload, ClientEntityInterface $client, ServerRequestInterface $request)

    {
        if (! property_exists($authCodePayload, 'auth_code_id')) {
            throw OAuthServerException::invalidRequest('code', 'Authorization code malformed');
        }

        if (time() > $authCodePayload->expire_time) {
            throw OAuthServerException::invalidRequest('code', 'Authorization code has expired');
        }

        if ($this->authCodeRepository->isAuthCodeRevoked($authCodePayload->auth_code_id) === true) {
            throw OAuthServerException::invalidRequest('code', 'Authorization code has been revoked');
        }

        if ($authCodePayload->client_id !== $client->getIdentifier()) {
            throw OAuthServerException::invalidRequest('code', 'Authorization code was not issued to this client');
        }

        $this->validateUser($authCodePayload);

        // The redirect URI is required in this request
        $redirectUri = $this->getRequestParameter('redirect_uri', $request, null);
        if (empty($authCodePayload->redirect_uri) === false && $redirectUri === null) {
            throw OAuthServerException::invalidRequest('redirect_uri');
        }

        if ($authCodePayload->redirect_uri !== $redirectUri) {
            throw OAuthServerException::invalidRequest('redirect_uri', 'Invalid redirect URI');
        }
    }

    /**
     * Validate the authorization code user.
     *
     * @param stdClass $authCodePayload
     */
    protected function validateUser(stdClass $authCodePayload)
    {
        [$userType, $userId] = explode(':', $authCodePayload->user_id);


        if ($userType !== request()->user()->getMorphClass() || $userId !== request()->user()->getRouteKey()) {
            throw OAuthServerException::invalidRequest('user_id', 'Authorization code was not issued to this user');
        }
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace Rinvex\Oauth\Grants;
6
7			use stdClass;
8			use DateInterval;
9			use LogicException;
10			use League\OAuth2\Server\RequestEvent;
11			use Psr\Http\Message\ServerRequestInterface;
12			use League\OAuth2\Server\Entities\ClientEntityInterface;
13			use League\OAuth2\Server\Exception\OAuthServerException;
14			use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
15			use League\OAuth2\Server\Grant\AuthCodeGrant as BaseAuthCodeGrant;
16			use League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface;
17
18			class AuthCodeGrant extends BaseAuthCodeGrant
19			{
20			/**
21			* @var CodeChallengeVerifierInterface[]
22			*/
23			private $codeChallengeVerifiers = [];
			0 ignored issues – show Comprehensibility introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report Consider using a different property name as you override a private property of the parent class. Loading history...
24
25			/**
26			* Respond to an access token request.
27			*
28			* @param ServerRequestInterface $request
29			* @param ResponseTypeInterface $responseType
30			* @param DateInterval $accessTokenTTL
31			*
32			* @throws OAuthServerException
33			*
34			* @return ResponseTypeInterface
35			*/
36			public function respondToAccessTokenRequest(ServerRequestInterface $request, ResponseTypeInterface $responseType, DateInterval $accessTokenTTL)
37			{
38			[$clientId] = $this->getClientCredentials($request);
			0 ignored issues – show Bug introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report The variable `$clientId` does not exist. Did you forget to declare it? This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. Loading history...
39			$client = $this->getClientEntityOrFail($clientId, $request);
40
41			// Only validate the client if it is confidential
42			if ($client->isConfidential()) {
43			$this->validateClient($request);
44			}
45
46			$encryptedAuthCode = $this->getRequestParameter('code', $request, null);
47
48			if ($encryptedAuthCode === null) {
49			throw OAuthServerException::invalidRequest('code');
50			}
51
52			try {
53			$authCodePayload = \json_decode($this->decrypt($encryptedAuthCode));
54
55			$this->validateAuthorizationCode($authCodePayload, $client, $request);
56
57			$scopes = $this->scopeRepository->finalizeScopes(
58			$this->validateScopes($authCodePayload->scopes),
59			$this->getIdentifier(),
60			$client,
61			$authCodePayload->user_id
62			);
63			} catch (LogicException $e) {
64			throw OAuthServerException::invalidRequest('code', 'Cannot decrypt the authorization code', $e);
65			}
66
67			// Validate code challenge
68			if (! empty($authCodePayload->code_challenge)) {
69			$codeVerifier = $this->getRequestParameter('code_verifier', $request, null);
70
71			if ($codeVerifier === null) {
72			throw OAuthServerException::invalidRequest('code_verifier');
73			}
74
75			// Validate code_verifier according to RFC-7636
76			// @see: https://tools.ietf.org/html/rfc7636#section-4.1
77			if (preg_match('/^[A-Za-z0-9-._~]{43,128}$/', $codeVerifier) !== 1) {
78			throw OAuthServerException::invalidRequest(
79			'code_verifier',
80			'Code Verifier must follow the specifications of RFC-7636.'
81			);
82			}
83
84			if (property_exists($authCodePayload, 'code_challenge_method')) {
85			if (isset($this->codeChallengeVerifiers[$authCodePayload->code_challenge_method])) {
86			$codeChallengeVerifier = $this->codeChallengeVerifiers[$authCodePayload->code_challenge_method];
87
88			if ($codeChallengeVerifier->verifyCodeChallenge($codeVerifier, $authCodePayload->code_challenge) === false) {
89			throw OAuthServerException::invalidGrant('Failed to verify `code_verifier`.');
90			}
91			} else {
92			throw OAuthServerException::serverError(
93			sprintf(
94			'Unsupported code challenge method `%s`',
95			$authCodePayload->code_challenge_method
96			)
97			);
98			}
99			}
100			}
101
102			// Issue and persist new access token
103			$accessToken = $this->issueAccessToken($accessTokenTTL, $client, $authCodePayload->user_id, $scopes);
104			$this->getEmitter()->emit(new RequestEvent(RequestEvent::ACCESS_TOKEN_ISSUED, $request));
105			$responseType->setAccessToken($accessToken);
			0 ignored issues – show Bug introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report It seems like `$accessToken` defined by `$this->issueAccessToken(...load->user_id, $scopes)` on line `103` can be `null`; however, `League\OAuth2\Server\Res...rface::setAccessToken()` does not accept `null`, maybe add an additional type check? Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass\|null */ function mayReturnNull() { } function doesNotAcceptNull(stdClass $x) { } // With potential error. function withoutCheck() { $x = mayReturnNull(); doesNotAcceptNull($x); // Potential error here. } // Safe - Alternative 1 function withCheck1() { $x = mayReturnNull(); if ( ! $x instanceof stdClass) { throw new \LogicException('$x must be defined.'); } doesNotAcceptNull($x); } // Safe - Alternative 2 function withCheck2() { $x = mayReturnNull(); if ($x instanceof stdClass) { doesNotAcceptNull($x); } } Loading history...
106
107			// Issue and persist new refresh token if given
108			$refreshToken = $this->issueRefreshToken($accessToken);
			0 ignored issues – show Bug introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report It seems like `$accessToken` defined by `$this->issueAccessToken(...load->user_id, $scopes)` on line `103` can be `null`; however, `League\OAuth2\Server\Gra...nt::issueRefreshToken()` does not accept `null`, maybe add an additional type check? Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass\|null */ function mayReturnNull() { } function doesNotAcceptNull(stdClass $x) { } // With potential error. function withoutCheck() { $x = mayReturnNull(); doesNotAcceptNull($x); // Potential error here. } // Safe - Alternative 1 function withCheck1() { $x = mayReturnNull(); if ( ! $x instanceof stdClass) { throw new \LogicException('$x must be defined.'); } doesNotAcceptNull($x); } // Safe - Alternative 2 function withCheck2() { $x = mayReturnNull(); if ($x instanceof stdClass) { doesNotAcceptNull($x); } } Loading history...
109
110			if ($refreshToken !== null) {
111			$this->getEmitter()->emit(new RequestEvent(RequestEvent::REFRESH_TOKEN_ISSUED, $request));
112			$responseType->setRefreshToken($refreshToken);
113			}
114
115			// Revoke used auth code
116			$this->authCodeRepository->revokeAuthCode($authCodePayload->auth_code_id);
117
118			return $responseType;
119			}
120
121			/**
122			* Validate the authorization code.
123			*
124			* @param stdClass $authCodePayload
125			* @param ClientEntityInterface $client
126			* @param ServerRequestInterface $request
127			*/
128			private function validateAuthorizationCode($authCodePayload, ClientEntityInterface $client, ServerRequestInterface $request)
			0 ignored issues – show Bug introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report Consider using a different method name as you override a private method of the parent class. Overwriting private methods is generally fine as long as you also use private visibility. It might still be preferable for understandability to use a different method name. Loading history...
129			{
130			if (! property_exists($authCodePayload, 'auth_code_id')) {
131			throw OAuthServerException::invalidRequest('code', 'Authorization code malformed');
132			}
133
134			if (time() > $authCodePayload->expire_time) {
135			throw OAuthServerException::invalidRequest('code', 'Authorization code has expired');
136			}
137
138			if ($this->authCodeRepository->isAuthCodeRevoked($authCodePayload->auth_code_id) === true) {
139			throw OAuthServerException::invalidRequest('code', 'Authorization code has been revoked');
140			}
141
142			if ($authCodePayload->client_id !== $client->getIdentifier()) {
143			throw OAuthServerException::invalidRequest('code', 'Authorization code was not issued to this client');
144			}
145
146			$this->validateUser($authCodePayload);
147
148			// The redirect URI is required in this request
149			$redirectUri = $this->getRequestParameter('redirect_uri', $request, null);
150			if (empty($authCodePayload->redirect_uri) === false && $redirectUri === null) {
151			throw OAuthServerException::invalidRequest('redirect_uri');
152			}
153
154			if ($authCodePayload->redirect_uri !== $redirectUri) {
155			throw OAuthServerException::invalidRequest('redirect_uri', 'Invalid redirect URI');
156			}
157			}
158
159			/**
160			* Validate the authorization code user.
161			*
162			* @param stdClass $authCodePayload
163			*/
164			protected function validateUser(stdClass $authCodePayload)
165			{
166			[$userType, $userId] = explode(':', $authCodePayload->user_id);
			0 ignored issues – show Bug introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report The variable `$userType` does not exist. Did you forget to declare it? This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. Loading history... Bug introduced 2021-02-28 06:03 UTC by Report Bug Copy Issue Report The variable `$userId` does not exist. Did you forget to declare it? This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. Loading history...
167
168			if ($userType !== request()->user()->getMorphClass() \|\| $userId !== request()->user()->getRouteKey()) {
169			throw OAuthServerException::invalidRequest('user_id', 'Authorization code was not issued to this user');
170			}
171			}
172			}
173

rinvex / laravel-oauth

Push — master ( 592d95...c00565 )

AuthCodeGrant::validateAuthorizationCode() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like