League\OAuth2\Server\Grant\AuthCodeGrant::respondToAccessTokenRequest()

Complexity

Conditions	20
Paths	4628

Size

Total Lines	120
Code Lines	63

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	56
CRAP Score	20.3628

Importance

Changes	2
Bugs	0	Features	0

<?php
    public function respondToAccessTokenRequest(
        ServerRequestInterface $request,
        ResponseTypeInterface $responseType,
        DateInterval $accessTokenTTL
    ): ResponseTypeInterface {
        list($clientId) = $this->getClientCredentials($request);

        $client = $this->getClientEntityOrFail($clientId, $request);

        // Only validate the client if it is confidential
        if ($client->isConfidential()) {
            $this->validateClient($request);
        }

        $code = $this->getRequestParameter('code', $request);

        if ($code === null) {
            throw OAuthServerException::invalidRequest('code');
        }

        if ($this->canUseCrypt()) {
            try {
                $authCodePayload = json_decode($this->decrypt($code));

                $ace = $this->authCodeRepository->getNewAuthCode();

                if ($ace == null) {
                    // Probably should throw an exception here instead
                    return $responseType;
                }

                if (isset($authCodePayload->auth_code_id))
                    $ace->setIdentifier($authCodePayload->auth_code_id);

                if (isset($authCodePayload->client_id))
                    $ace->setClient($this->getClientEntityOrFail($authCodePayload->client_id, $request));

                if (isset($authCodePayload->user_id))
                    $ace->setUserIdentifier((string)$authCodePayload->user_id);

                if (isset($authCodePayload->code_challenge))
                    $ace->setCodeChallenge($authCodePayload->code_challenge);

                if (isset($authCodePayload->code_challenge_method))
                    $ace->setCodeChallengeMethod($authCodePayload->code_challenge_method);

                if (isset($authCodePayload->redirect_uri))
                    $ace->setRedirectUri($authCodePayload->redirect_uri);

                if (isset($authCodePayload->expire_time)) {
                    $expire = new DateTimeImmutable();
                    $expire = $expire->setTimestamp($authCodePayload->expire_time);

                    $ace->setExpiryDateTime($expire);
                }

                if (isset($authCodePayload->scopes)) {
                    $scopes = $this->validateScopes($authCodePayload->scopes);

                    $ace->setScopes($scopes);
                }

                
                
            } catch (InvalidArgumentException $e) {
                throw OAuthServerException::invalidGrant('Cannot validate the provided authorization code');
            } catch (LogicException $e) {
                throw OAuthServerException::invalidRequest('code', 'Issue decrypting the authorization code', $e);
            }
        }
        else {
            // Get the Auth Code Payload from Repository
            $ace = $this->authCodeRepository->getAuthCodeEntity($code);

            if (empty($ace)) {
                throw OAuthServerException::invalidRequest('code', 'Cannot find authorization code');
            }
        }

        $this->validateAuthorizationCode($ace, $client, $request);

        $scopes = $this->scopeRepository->finalizeScopes(
            $ace->getScopes(),
            $this->getIdentifier(),
            $client,
            $ace->getUserIdentifier(),
            $ace->getIdentifier()
        );

        $codeVerifier = $this->getRequestParameter('code_verifier', $request);

        // If a code challenge isn't present but a code verifier is, reject the request to block PKCE downgrade attack
        if ($ace->getCodeChallenge() === null && $codeVerifier !== null) {
            throw OAuthServerException::invalidRequest(
                'code_challenge',
                'code_verifier received when no code_challenge is present'
            );
        }

        if ($ace->getCodeChallenge() !== null) {
            $this->validateCodeChallenge($ace, $codeVerifier);
        }

        // Issue and persist new access token
        $accessToken = $this->issueAccessToken($accessTokenTTL, $client, $ace->getUserIdentifier(), $scopes);
        $this->getEmitter()->emit(new RequestAccessTokenEvent(RequestEvent::ACCESS_TOKEN_ISSUED, $request, $accessToken));
        $responseType->setAccessToken($accessToken);

        // Issue and persist new refresh token if given
        $refreshToken = $this->issueRefreshToken($accessToken);

        if ($refreshToken !== null) {
            $this->getEmitter()->emit(new RequestRefreshTokenEvent(RequestEvent::REFRESH_TOKEN_ISSUED, $request, $refreshToken));
            $responseType->setRefreshToken($refreshToken);
        }

        // Revoke used auth code
        $this->authCodeRepository->revokeAuthCode($ace->getIdentifier());

        return $responseType;
    }