RequestValidatorTrait::getEmitter()

Completed

Pull Request — master (#995)

unknown

created 2019-02-08 20:14 UTC

↳ Parent: RequestValidatorTrait

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	1
ccs	0
cts	0
cp	0
c	0
b	0
f	0
nc	1

<?php
/**
 * @author      Alex Bilbie <[email protected]>
 * @copyright   Copyright (c) Alex Bilbie
 * @license     http://mit-license.org/
 *
 * @link        https://github.com/thephpleague/oauth2-server
 */

namespace League\OAuth2\Server;

use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\Exception\OAuthServerException;
use Psr\Http\Message\ServerRequestInterface;

trait RequestValidatorTrait
{
    /**
     * Get the Emitter.
     *
     * @return EmitterInterface
     */
    abstract public function getEmitter();

    /**
     * @return ClientRepositoryInterface
     */
    abstract public function getClientRepository();

    /**
     * Return the grant identifier that can be used in matching up requests.
     *
     * @return string
     */
    abstract public function getIdentifier();

    /**
     * Validate the client.
     *
     * @param ServerRequestInterface $request
     *
     * @throws OAuthServerException
     *
     * @return ClientEntityInterface
     */
    public function validateClient(ServerRequestInterface $request)
    {
        list($basicAuthUser, $basicAuthPassword) = $this->getBasicAuthCredentials($request);

        $clientId = $this->getRequestParameter('client_id', $request, $basicAuthUser);
        if ($clientId === null) {
            throw OAuthServerException::invalidRequest('client_id');
        }

        // If the client is confidential require the client secret
        $clientSecret = $this->getRequestParameter('client_secret', $request, $basicAuthPassword);

        $client = $this->getClientRepository()->getClientEntity(
            $clientId,
            $this->getIdentifier(),
            $clientSecret,
            true
        );

        if ($client instanceof ClientEntityInterface === false) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
            throw OAuthServerException::invalidClient();
        }

        $redirectUri = $this->getRequestParameter('redirect_uri', $request, null);

        if ($redirectUri !== null) {
            $this->validateRedirectUri($redirectUri, $client, $request);
        }

        return $client;
    }

    /**
     * Validate redirectUri from the request.
     * If a redirect URI is provided ensure it matches what is pre-registered
     *
     * @param string                 $redirectUri
     * @param ClientEntityInterface  $client
     * @param ServerRequestInterface $request
     *
     * @throws OAuthServerException
     */
    public function validateRedirectUri(
        $redirectUri,
        ClientEntityInterface $client,
        ServerRequestInterface $request
    ) {
        if (\is_string($client->getRedirectUri())
            && (strcmp($client->getRedirectUri(), $redirectUri) !== 0)
        ) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
            throw OAuthServerException::invalidClient();
        } elseif (\is_array($client->getRedirectUri())
            && \in_array($redirectUri, $client->getRedirectUri(), true) === false
        ) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
            throw OAuthServerException::invalidClient();
        }
    }

    /**
     * Retrieve request parameter.
     *
     * @param string                 $parameter
     * @param ServerRequestInterface $request
     * @param mixed                  $default
     *
     * @return null|string
     */
    protected function getRequestParameter($parameter, ServerRequestInterface $request, $default = null)
    {
        $requestParameters = (array) $request->getParsedBody();

        return isset($requestParameters[$parameter]) ? $requestParameters[$parameter] : $default;
    }

    /**
     * Retrieve HTTP Basic Auth credentials with the Authorization header
     * of a request. First index of the returned array is the username,
     * second is the password (so list() will work). If the header does
     * not exist, or is otherwise an invalid HTTP Basic header, return
     * [null, null].
     *
     * @param ServerRequestInterface $request
     *
     * @return string[]|null[]
     */
    public function getBasicAuthCredentials(ServerRequestInterface $request)
    {
        if (!$request->hasHeader('Authorization')) {
            return [null, null];
        }

        $header = $request->getHeader('Authorization')[0];
        if (strpos($header, 'Basic ') !== 0) {
            return [null, null];
        }

        if (!($decoded = base64_decode(substr($header, 6)))) {
            return [null, null];
        }

        if (strpos($decoded, ':') === false) {
            return [null, null]; // HTTP Basic header without colon isn't valid
        }

        return explode(':', $decoded, 2);
    }

    /**
     * Retrieve query string parameter.
     *
     * @param string                 $parameter
     * @param ServerRequestInterface $request
     * @param mixed                  $default
     *
     * @return null|string
     */
    protected function getQueryStringParameter($parameter, ServerRequestInterface $request, $default = null)
    {
        return isset($request->getQueryParams()[$parameter]) ? $request->getQueryParams()[$parameter] : $default;
    }

    /**
     * Retrieve cookie parameter.
     *
     * @param string                 $parameter
     * @param ServerRequestInterface $request
     * @param mixed                  $default
     *
     * @return null|string
     */
    protected function getCookieParameter($parameter, ServerRequestInterface $request, $default = null)
    {
        return isset($request->getCookieParams()[$parameter]) ? $request->getCookieParams()[$parameter] : $default;
    }

    /**
     * Retrieve server parameter.
     *
     * @param string                 $parameter
     * @param ServerRequestInterface $request
     * @param mixed                  $default
     *
     * @return null|string
     */
    protected function getServerParameter($parameter, ServerRequestInterface $request, $default = null)
    {
        return isset($request->getServerParams()[$parameter]) ? $request->getServerParams()[$parameter] : $default;
    }
}


1		<?php
2		/**
3		* @author Alex Bilbie <[email protected]>
4		* @copyright Copyright (c) Alex Bilbie
5		* @license http://mit-license.org/
6		*
7		* @link https://github.com/thephpleague/oauth2-server
8		*/
9
10		namespace League\OAuth2\Server;
11
12		use League\OAuth2\Server\Entities\ClientEntityInterface;
13		use League\OAuth2\Server\Exception\OAuthServerException;
14		use Psr\Http\Message\ServerRequestInterface;
15
16		trait RequestValidatorTrait
17		{
18		/**
19		* Get the Emitter.
20		*
21		* @return EmitterInterface
22		*/
23		abstract public function getEmitter();
24
25		/**
26		* @return ClientRepositoryInterface
27		*/
28		abstract public function getClientRepository();
29
30		/**
31		* Return the grant identifier that can be used in matching up requests.
32		*
33		* @return string
34		*/
35		abstract public function getIdentifier();
36
37		/**
38		* Validate the client.
39		*
40		* @param ServerRequestInterface $request
41		*
42		* @throws OAuthServerException
43		*
44		* @return ClientEntityInterface
45		*/
46	54	public function validateClient(ServerRequestInterface $request)
47		{
48	54	list($basicAuthUser, $basicAuthPassword) = $this->getBasicAuthCredentials($request);
49
50	54	$clientId = $this->getRequestParameter('client_id', $request, $basicAuthUser);
51	54	if ($clientId === null) {
52	1	throw OAuthServerException::invalidRequest('client_id');
53		}
54
55		// If the client is confidential require the client secret
56	53	$clientSecret = $this->getRequestParameter('client_secret', $request, $basicAuthPassword);
57
58	53	$client = $this->getClientRepository()->getClientEntity(
59	53	$clientId,
60	53	$this->getIdentifier(),
61	53	$clientSecret,
62	53	true
63		);
64
65	53	if ($client instanceof ClientEntityInterface === false) {
66	4	$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
67	4	throw OAuthServerException::invalidClient();
68		}
69
70	49	$redirectUri = $this->getRequestParameter('redirect_uri', $request, null);
71
72	49	if ($redirectUri !== null) {
73	20	$this->validateRedirectUri($redirectUri, $client, $request);
74		}
75
76	47	return $client;
77		}
78
79		/**
80		* Validate redirectUri from the request.
81		* If a redirect URI is provided ensure it matches what is pre-registered
82		*
83		* @param string $redirectUri
84		* @param ClientEntityInterface $client
85		* @param ServerRequestInterface $request
86		*
87		* @throws OAuthServerException
88		*/
89	34	public function validateRedirectUri(
90		$redirectUri,
91		ClientEntityInterface $client,
92		ServerRequestInterface $request
93		) {
94	34	if (\is_string($client->getRedirectUri())
95	34	&& (strcmp($client->getRedirectUri(), $redirectUri) !== 0)
96		) {
97	3	$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
98	3	throw OAuthServerException::invalidClient();
99	31	} elseif (\is_array($client->getRedirectUri())
100	31	&& \in_array($redirectUri, $client->getRedirectUri(), true) === false
101		) {
102	3	$this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
103	3	throw OAuthServerException::invalidClient();
104		}
105	28	}
106
107		/**
108		* Retrieve request parameter.
109		*
110		* @param string $parameter
111		* @param ServerRequestInterface $request
112		* @param mixed $default
113		*
114		* @return null\|string
115		*/
116	54	protected function getRequestParameter($parameter, ServerRequestInterface $request, $default = null)
117		{
118	54	$requestParameters = (array) $request->getParsedBody();
119
120	54	return isset($requestParameters[$parameter]) ? $requestParameters[$parameter] : $default;
121		}
122
123		/**
124		* Retrieve HTTP Basic Auth credentials with the Authorization header
125		* of a request. First index of the returned array is the username,
126		* second is the password (so list() will work). If the header does
127		* not exist, or is otherwise an invalid HTTP Basic header, return
128		* [null, null].
129		*
130		* @param ServerRequestInterface $request
131		*
132		* @return string[]\|null[]
133		*/
134	59	public function getBasicAuthCredentials(ServerRequestInterface $request)
135		{
136	59	if (!$request->hasHeader('Authorization')) {
137	54	return [null, null];
138		}
139
140	5	$header = $request->getHeader('Authorization')[0];
141	5	if (strpos($header, 'Basic ') !== 0) {
142	1	return [null, null];
143		}
144
145	4	if (!($decoded = base64_decode(substr($header, 6)))) {
146	1	return [null, null];
147		}
148
149	3	if (strpos($decoded, ':') === false) {
150	1	return [null, null]; // HTTP Basic header without colon isn't valid
151		}
152
153	2	return explode(':', $decoded, 2);
154		}
155
156		/**
157		* Retrieve query string parameter.
158		*
159		* @param string $parameter
160		* @param ServerRequestInterface $request
161		* @param mixed $default
162		*
163		* @return null\|string
164		*/
165	21	protected function getQueryStringParameter($parameter, ServerRequestInterface $request, $default = null)
166		{
167	21	return isset($request->getQueryParams()[$parameter]) ? $request->getQueryParams()[$parameter] : $default;
168		}
169
170		/**
171		* Retrieve cookie parameter.
172		*
173		* @param string $parameter
174		* @param ServerRequestInterface $request
175		* @param mixed $default
176		*
177		* @return null\|string
178		*/
179	1	protected function getCookieParameter($parameter, ServerRequestInterface $request, $default = null)
180		{
181	1	return isset($request->getCookieParams()[$parameter]) ? $request->getCookieParams()[$parameter] : $default;
182		}
183
184		/**
185		* Retrieve server parameter.
186		*
187		* @param string $parameter
188		* @param ServerRequestInterface $request
189		* @param mixed $default
190		*
191		* @return null\|string
192		*/
193	20	protected function getServerParameter($parameter, ServerRequestInterface $request, $default = null)
194		{
195	20	return isset($request->getServerParams()[$parameter]) ? $request->getServerParams()[$parameter] : $default;
196		}
197		}
198

thephpleague / oauth2-server

Pull Request — master (#995)

RequestValidatorTrait::getEmitter()

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like