AbstractHandler::getClientCredentials() - Code Metrics - Inspection of "Support token revocation and introspection" - thephpleague/oauth2-server - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Pull Request — master (#1473)

unknown

created 2025-02-14 20:17 UTC

AbstractHandler::getClientCredentials() A

↳ Parent: AbstractHandler

Complexity

Conditions	2
Paths	2

Size

Total Lines	13
Code Lines	6

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
cc	2
eloc	6
nc	2
nop	1
dl	0
loc	13
rs	10
c	1
b	0
f	0

<?php

declare(strict_types=1);

namespace League\OAuth2\Server;

use Exception;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\EventEmitting\EmitterAwareInterface;
use League\OAuth2\Server\EventEmitting\EmitterAwarePolyfill;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\Grant\GrantTypeInterface;
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
use Psr\Http\Message\ServerRequestInterface;

use function base64_decode;
use function explode;
use function json_decode;
use function substr;
use function time;
use function trim;

abstract class AbstractHandler implements EmitterAwareInterface
{
    use EmitterAwarePolyfill;
    use CryptTrait;

    protected ClientRepositoryInterface $clientRepository;

    protected AccessTokenRepositoryInterface $accessTokenRepository;

    protected RefreshTokenRepositoryInterface $refreshTokenRepository;

    public function setClientRepository(ClientRepositoryInterface $clientRepository): void
    {
        $this->clientRepository = $clientRepository;
    }

    public function setAccessTokenRepository(AccessTokenRepositoryInterface $accessTokenRepository): void
    {
        $this->accessTokenRepository = $accessTokenRepository;
    }

    public function setRefreshTokenRepository(RefreshTokenRepositoryInterface $refreshTokenRepository): void
    {
        $this->refreshTokenRepository = $refreshTokenRepository;
    }

    /**
     * Validate the client.
     *
     * @throws OAuthServerException
     */
    protected function validateClient(ServerRequestInterface $request): ClientEntityInterface
    {
        [$clientId, $clientSecret] = $this->getClientCredentials($request);

        $client = $this->getClientEntityOrFail($clientId, $request);

        if ($client->isConfidential()) {
            if ($clientSecret === '') {
                throw OAuthServerException::invalidRequest('client_secret');
            }

            if (
                $this->clientRepository->validateClient(
                    $clientId,
                    $clientSecret,
                    $this instanceof GrantTypeInterface ? $this->getIdentifier() : null
                ) === false
            ) {
                $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));

                throw OAuthServerException::invalidClient($request);
            }
        }

        return $client;
    }

    /**
     * Wrapper around ClientRepository::getClientEntity() that ensures we emit
     * an event and throw an exception if the repo doesn't return a client
     * entity.
     *
     * This is a bit of defensive coding because the interface contract
     * doesn't actually enforce non-null returns/exception-on-no-client so
     * getClientEntity might return null. By contrast, this method will
     * always either return a ClientEntityInterface or throw.
     *
     * @throws OAuthServerException
     */
    protected function getClientEntityOrFail(string $clientId, ServerRequestInterface $request): ClientEntityInterface
    {
        $client = $this->clientRepository->getClientEntity($clientId);

        if ($client instanceof ClientEntityInterface === false) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
            throw OAuthServerException::invalidClient($request);
        }

        return $client;
    }

    /**
     * Gets the client credentials from the request from the request body or
     * the Http Basic Authorization header
     *
     * @return array{0:non-empty-string,1:string}

     *
     * @throws OAuthServerException
     */
    protected function getClientCredentials(ServerRequestInterface $request): array
    {
        [$basicAuthUser, $basicAuthPassword] = $this->getBasicAuthCredentials($request);

        $clientId = $this->getRequestParameter('client_id', $request, $basicAuthUser);

        if ($clientId === null) {
            throw OAuthServerException::invalidRequest('client_id');
        }

        $clientSecret = $this->getRequestParameter('client_secret', $request, $basicAuthPassword);

        return [$clientId, $clientSecret ?? ''];
    }
    /**
     * Parse request parameter.
     *
     * @param array<array-key, mixed> $request

     *
     * @return non-empty-string|null

     *
     * @throws OAuthServerException
     */
    private static function parseParam(string $parameter, array $request, ?string $default = null): ?string
    {
        $value = $request[$parameter] ?? '';

        if (is_scalar($value)) {
            $value = trim((string) $value);
        } else {
            throw OAuthServerException::invalidRequest($parameter);
        }

        if ($value === '') {
            $value = $default === null ? null : trim($default);

            if ($value === '') {
                $value = null;
            }
        }

        return $value;
    }

    /**
     * Retrieve request parameter.
     *
     * @return non-empty-string|null

     *
     * @throws OAuthServerException
     */
    protected function getRequestParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
    {
        return self::parseParam($parameter, (array) $request->getParsedBody(), $default);
    }

    /**
     * Retrieve HTTP Basic Auth credentials with the Authorization header
     * of a request. First index of the returned array is the username,
     * second is the password (so list() will work). If the header does
     * not exist, or is otherwise an invalid HTTP Basic header, return
     * [null, null].
     *
     * @return array{0:non-empty-string,1:string}|array{0:null,1:null}

     */
    protected function getBasicAuthCredentials(ServerRequestInterface $request): array
    {
        if (!$request->hasHeader('Authorization')) {
            return [null, null];
        }

        $header = $request->getHeader('Authorization')[0];
        if (stripos($header, 'Basic ') !== 0) {
            return [null, null];
        }

        $decoded = base64_decode(substr($header, 6), true);

        if ($decoded === false) {
            return [null, null];
        }

        if (str_contains($decoded, ':') === false) {
            return [null, null]; // HTTP Basic header without colon isn't valid
        }

        [$username, $password] = explode(':', $decoded, 2);

        if ($username === '') {
            return [null, null];
        }

        return [$username, $password];
    }

    /**
     * Retrieve query string parameter.
     *
     * @return non-empty-string|null

     *
     * @throws OAuthServerException
     */
    protected function getQueryStringParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
    {
        return self::parseParam($parameter, $request->getQueryParams(), $default);
    }

    /**
     * Retrieve cookie parameter.
     *
     * @return non-empty-string|null

     *
     * @throws OAuthServerException
     */
    protected function getCookieParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
    {
        return self::parseParam($parameter, $request->getCookieParams(), $default);
    }

    /**
     * Retrieve server parameter.
     *
     * @return non-empty-string|null

     *
     * @throws OAuthServerException
     */
    protected function getServerParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
    {
        return self::parseParam($parameter, $request->getServerParams(), $default);
    }

    /**
     * Validate the given encrypted refresh token.
     *
     * @throws OAuthServerException
     *
     * @return array<string, mixed>
     */
    protected function validateEncryptedRefreshToken(
        ServerRequestInterface $request,
        string $encryptedRefreshToken,
        string $clientId
    ): array {
        try {
            $refreshToken = $this->decrypt($encryptedRefreshToken);
        } catch (Exception $e) {
            throw OAuthServerException::invalidRefreshToken('Cannot decrypt the refresh token', $e);
        }

        $refreshTokenData = json_decode($refreshToken, true);

        if ($refreshTokenData['client_id'] !== $clientId) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::REFRESH_TOKEN_CLIENT_FAILED, $request));
            throw OAuthServerException::invalidRefreshToken('Token is not linked to client');
        }

        if ($refreshTokenData['expire_time'] < time()) {
            throw OAuthServerException::invalidRefreshToken('Token has expired');
        }

        if ($this->refreshTokenRepository->isRefreshTokenRevoked($refreshTokenData['refresh_token_id']) === true) {
            throw OAuthServerException::invalidRefreshToken('Token has been revoked');
        }

        return $refreshTokenData;
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace League\OAuth2\Server;
6
7			use Exception;
8			use League\OAuth2\Server\Entities\ClientEntityInterface;
9			use League\OAuth2\Server\EventEmitting\EmitterAwareInterface;
10			use League\OAuth2\Server\EventEmitting\EmitterAwarePolyfill;
11			use League\OAuth2\Server\Exception\OAuthServerException;
12			use League\OAuth2\Server\Grant\GrantTypeInterface;
13			use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
14			use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
15			use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
16			use Psr\Http\Message\ServerRequestInterface;
17
18			use function base64_decode;
19			use function explode;
20			use function json_decode;
21			use function substr;
22			use function time;
23			use function trim;
24
25			abstract class AbstractHandler implements EmitterAwareInterface
26			{
27			use EmitterAwarePolyfill;
28			use CryptTrait;
29
30			protected ClientRepositoryInterface $clientRepository;
31
32			protected AccessTokenRepositoryInterface $accessTokenRepository;
33
34			protected RefreshTokenRepositoryInterface $refreshTokenRepository;
35
36			public function setClientRepository(ClientRepositoryInterface $clientRepository): void
37			{
38			$this->clientRepository = $clientRepository;
39			}
40
41			public function setAccessTokenRepository(AccessTokenRepositoryInterface $accessTokenRepository): void
42			{
43			$this->accessTokenRepository = $accessTokenRepository;
44			}
45
46			public function setRefreshTokenRepository(RefreshTokenRepositoryInterface $refreshTokenRepository): void
47			{
48			$this->refreshTokenRepository = $refreshTokenRepository;
49			}
50
51			/**
52			* Validate the client.
53			*
54			* @throws OAuthServerException
55			*/
56			protected function validateClient(ServerRequestInterface $request): ClientEntityInterface
57			{
58			[$clientId, $clientSecret] = $this->getClientCredentials($request);
59
60			$client = $this->getClientEntityOrFail($clientId, $request);
61
62			if ($client->isConfidential()) {
63			if ($clientSecret === '') {
64			throw OAuthServerException::invalidRequest('client_secret');
65			}
66
67			if (
68			$this->clientRepository->validateClient(
69			$clientId,
70			$clientSecret,
71			$this instanceof GrantTypeInterface ? $this->getIdentifier() : null
72			) === false
73			) {
74			$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
75
76			throw OAuthServerException::invalidClient($request);
77			}
78			}
79
80			return $client;
81			}
82
83			/**
84			* Wrapper around ClientRepository::getClientEntity() that ensures we emit
85			* an event and throw an exception if the repo doesn't return a client
86			* entity.
87			*
88			* This is a bit of defensive coding because the interface contract
89			* doesn't actually enforce non-null returns/exception-on-no-client so
90			* getClientEntity might return null. By contrast, this method will
91			* always either return a ClientEntityInterface or throw.
92			*
93			* @throws OAuthServerException
94			*/
95			protected function getClientEntityOrFail(string $clientId, ServerRequestInterface $request): ClientEntityInterface
96			{
97			$client = $this->clientRepository->getClientEntity($clientId);
98
99			if ($client instanceof ClientEntityInterface === false) {
100			$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
101			throw OAuthServerException::invalidClient($request);
102			}
103
104			return $client;
105			}
106
107			/**
108			* Gets the client credentials from the request from the request body or
109			* the Http Basic Authorization header
110			*
111			* @return array{0:non-empty-string,1:string}
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `array{0:non-empty-string,1:string}` at position `4` could not be parsed: Unknown type name 'non-empty-string' at position 4 in array{0:non-empty-string,1:string}. Loading history...
112			*
113			* @throws OAuthServerException
114			*/
115			protected function getClientCredentials(ServerRequestInterface $request): array
116			{
117			[$basicAuthUser, $basicAuthPassword] = $this->getBasicAuthCredentials($request);
118
119			$clientId = $this->getRequestParameter('client_id', $request, $basicAuthUser);
120
121			if ($clientId === null) {
122			throw OAuthServerException::invalidRequest('client_id');
123			}
124
125			$clientSecret = $this->getRequestParameter('client_secret', $request, $basicAuthPassword);
126
127			return [$clientId, $clientSecret ?? ''];
128			}
129			/**
130			* Parse request parameter.
131			*
132			* @param array<array-key, mixed> $request
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `array<array-key, mixed>` at position `2` could not be parsed: Unknown type name 'array-key' at position 2 in array<array-key, mixed>. Loading history...
133			*
134			* @return non-empty-string\|null
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `non-empty-string\|null` at position `0` could not be parsed: Unknown type name 'non-empty-string' at position 0 in non-empty-string\|null. Loading history...
135			*
136			* @throws OAuthServerException
137			*/
138			private static function parseParam(string $parameter, array $request, ?string $default = null): ?string
139			{
140			$value = $request[$parameter] ?? '';
141
142			if (is_scalar($value)) {
143			$value = trim((string) $value);
144			} else {
145			throw OAuthServerException::invalidRequest($parameter);
146			}
147
148			if ($value === '') {
149			$value = $default === null ? null : trim($default);
150
151			if ($value === '') {
152			$value = null;
153			}
154			}
155
156			return $value;
157			}
158
159			/**
160			* Retrieve request parameter.
161			*
162			* @return non-empty-string\|null
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `non-empty-string\|null` at position `0` could not be parsed: Unknown type name 'non-empty-string' at position 0 in non-empty-string\|null. Loading history...
163			*
164			* @throws OAuthServerException
165			*/
166			protected function getRequestParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
167			{
168			return self::parseParam($parameter, (array) $request->getParsedBody(), $default);
169			}
170
171			/**
172			* Retrieve HTTP Basic Auth credentials with the Authorization header
173			* of a request. First index of the returned array is the username,
174			* second is the password (so list() will work). If the header does
175			* not exist, or is otherwise an invalid HTTP Basic header, return
176			* [null, null].
177			*
178			* @return array{0:non-empty-string,1:string}\|array{0:null,1:null}
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `array{0:non-empty-string...g}\|array{0:null,1:null}` at position `4` could not be parsed: Unknown type name 'non-empty-string' at position 4 in array{0:non-empty-string,1:string}\|array{0:null,1:null}. Loading history...
179			*/
180			protected function getBasicAuthCredentials(ServerRequestInterface $request): array
181			{
182			if (!$request->hasHeader('Authorization')) {
183			return [null, null];
184			}
185
186			$header = $request->getHeader('Authorization')[0];
187			if (stripos($header, 'Basic ') !== 0) {
188			return [null, null];
189			}
190
191			$decoded = base64_decode(substr($header, 6), true);
192
193			if ($decoded === false) {
194			return [null, null];
195			}
196
197			if (str_contains($decoded, ':') === false) {
198			return [null, null]; // HTTP Basic header without colon isn't valid
199			}
200
201			[$username, $password] = explode(':', $decoded, 2);
202
203			if ($username === '') {
204			return [null, null];
205			}
206
207			return [$username, $password];
208			}
209
210			/**
211			* Retrieve query string parameter.
212			*
213			* @return non-empty-string\|null
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `non-empty-string\|null` at position `0` could not be parsed: Unknown type name 'non-empty-string' at position 0 in non-empty-string\|null. Loading history...
214			*
215			* @throws OAuthServerException
216			*/
217			protected function getQueryStringParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
218			{
219			return self::parseParam($parameter, $request->getQueryParams(), $default);
220			}
221
222			/**
223			* Retrieve cookie parameter.
224			*
225			* @return non-empty-string\|null
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `non-empty-string\|null` at position `0` could not be parsed: Unknown type name 'non-empty-string' at position 0 in non-empty-string\|null. Loading history...
226			*
227			* @throws OAuthServerException
228			*/
229			protected function getCookieParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
230			{
231			return self::parseParam($parameter, $request->getCookieParams(), $default);
232			}
233
234			/**
235			* Retrieve server parameter.
236			*
237			* @return non-empty-string\|null
			0 ignored issues – show Documentation Bug introduced 2024-05-13 21:07 UTC by Report Bug Copy Issue Report The doc comment `non-empty-string\|null` at position `0` could not be parsed: Unknown type name 'non-empty-string' at position 0 in non-empty-string\|null. Loading history...
238			*
239			* @throws OAuthServerException
240			*/
241			protected function getServerParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
242			{
243			return self::parseParam($parameter, $request->getServerParams(), $default);
244			}
245
246			/**
247			* Validate the given encrypted refresh token.
248			*
249			* @throws OAuthServerException
250			*
251			* @return array<string, mixed>
252			*/
253			protected function validateEncryptedRefreshToken(
254			ServerRequestInterface $request,
255			string $encryptedRefreshToken,
256			string $clientId
257			): array {
258			try {
259			$refreshToken = $this->decrypt($encryptedRefreshToken);
260			} catch (Exception $e) {
261			throw OAuthServerException::invalidRefreshToken('Cannot decrypt the refresh token', $e);
262			}
263
264			$refreshTokenData = json_decode($refreshToken, true);
265
266			if ($refreshTokenData['client_id'] !== $clientId) {
267			$this->getEmitter()->emit(new RequestEvent(RequestEvent::REFRESH_TOKEN_CLIENT_FAILED, $request));
268			throw OAuthServerException::invalidRefreshToken('Token is not linked to client');
269			}
270
271			if ($refreshTokenData['expire_time'] < time()) {
272			throw OAuthServerException::invalidRefreshToken('Token has expired');
273			}
274
275			if ($this->refreshTokenRepository->isRefreshTokenRevoked($refreshTokenData['refresh_token_id']) === true) {
276			throw OAuthServerException::invalidRefreshToken('Token has been revoked');
277			}
278
279			return $refreshTokenData;
280			}
281			}
282

thephpleague / oauth2-server

Pull Request — master (#1473)

AbstractHandler::getClientCredentials() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like