nyx\auth\id\protocols\oauth2\Provider

Complexity

Total Complexity

15

Size/Duplication

Total Lines	186
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	6

Importance

Changes

0

9 Methods

Rating	Name	Duplication	Size	Complexity
A	authorize()	0	21	1
A	exchange()	0	14	1
A	identify()	0	6	1
A	request()	0	10	1
A	onRequestSuccess()	0	4	1
A	onRequestError()	0	4	1
A	getDefaultRequestOptions()	0	15	2
B	createToken()	0	27	6
A	createIdentity()	0	6	1

<?php namespace nyx\auth\id\protocols\oauth2;

// External dependencies
use Psr\Http\Message\ResponseInterface as Response;
use GuzzleHttp\Promise\PromiseInterface as Promise;
use nyx\utils;

// Internal dependencies
use nyx\auth\id\protocols\oauth2;
use nyx\auth;

/**
 * OAuth 2.0 Provider
 *
 * @package     Nyx\Auth
 * @version     0.1.0
 * @author      Michal Chojnacki <m.chojnacki@muyo.io>
 * @copyright   2012-2017 Nyx Dev Team
 * @link        https://github.com/unyx/nyx
 */
abstract class Provider extends auth\id\Provider implements interfaces\Provider
{
    /**
     * The character separating different scopes in the request.
     */
    const SCOPE_SEPARATOR = ',';

    /**
     * @var array   The default access scopes to be requested during the authorization step.
     */
    protected $defaultScopes = [];

    /**
     * {@inheritDoc}
     */
    public function authorize(callable $redirect, array $parameters = [])
    {
        $parameters += [
            'scope'         => implode(static::SCOPE_SEPARATOR, $this->defaultScopes),
            'response_type' => 'code'
        ];

        // The explicitly set Client Credentials will always overwrite the keys' values from the optional
        // $parameters if they are present. If you want to use other credentials, either use the getAuthorizeUrl()
        // method directly or instantiate a Provider with different consumer credentials.
        $parameters['client_id']    = $this->consumer->getId();
        $parameters['redirect_uri'] = $this->consumer->getRedirectUri();

        // Only doing an isset here - can't easily predict valid values nor force properly randomized values.
        // Invalid requests will be rejected by the endpoint, after all.
        $parameters['state'] = $parameters['state'] ?? utils\Random::string(16);

        // The state gets passed along explicitly as the second argument since it will *always* need to be persisted
        // in some way by the end-user until it can be discarded after a successful exchange.
        return $redirect($this->getAuthorizeUrl($parameters), $parameters['state'], $parameters);
    }

    /**
     * Exchanges the given authorization code grant for an Access Token.
     *
     * @param   string  $code       The authorization code to exchange.
     * @return  Promise             A Promise for an Access Token.
     */
    public function exchange(string $code) : Promise
    {
        return $this->request('POST', $this->getExchangeUrl(), null, [
            'form_params' => [
                'client_id'     => $this->consumer->getId(),
                'client_secret' => $this->consumer->getSecret(),
                'redirect_uri'  => $this->consumer->getRedirectUri(),
                'grant_type'    => 'authorization_code',
                'code'          => $code
            ]
        ])->then(function (array $data) {
            return $this->createToken($data);
        });
    }

    /**
     * {@inheritDoc}
     */
    public function identify(oauth2\Token $token) : Promise
    {
        return $this->request('GET', $this->getIdentifyUrl(), $token)->then(function (array $data) use ($token) {
            return $this->createIdentity($token, $data);
        });
    }

    /**
     * {@inheritDoc}
     *
     * @param   oauth2\Token    $token
     */
    public function request(string $method, string $url, auth\interfaces\Token $token = null, array $options = []) : Promise
    {
        return $this->getHttpClient()->requestAsync($method, $url, array_merge_recursive($this->getDefaultRequestOptions($token), $options))->then(
            function (Response $response) use($token) {
                return $this->onRequestSuccess($response, $token);
            },
            function(\Exception $exception) use($token) {
                return $this->onRequestError($exception, $token);
            });
    }

    /**
     * Success callback for self::request().
     *
     * Note: Some Providers may return valid HTTP response codes for requests that were actually unsuccessful
     * and instead provide arbitrary responses like "ok => false" or "errors => []". Those misbehaving cases should
     * be caught within specific Providers.
     *
     * @param   Response                $response   The Response received to the Request made.
     * @param   auth\interfaces\Token   $token      The Access Token that was used to authorize the Request, if applicable.
     * @return  mixed
     */
    protected function onRequestSuccess(Response $response, auth\interfaces\Token $token = null)
    {
        return json_decode($response->getBody(), true);
    }

    /**
     * Failure callback for self::request().
     *
     * @param   \Exception              $exception  The Exception that occurred during the Request.
     * @param   auth\interfaces\Token   $token      The Access Token that was used to authorize the Request, if applicable.
     * @throws  \Exception                          Always re-throws the Exception. Child classes may, however, provide
     *                                              recovery paths.
     * @return  mixed
     */
    protected function onRequestError(\Exception $exception, auth\interfaces\Token $token = null)

The parameter $token is not used and could be removed.

    {
        throw $exception;
    }

    /**
     * Returns the default options (in a format recognized by Guzzle) for requests made by this Provider.
     *
     * @param   auth\interfaces\Token   $token      The Access Token that should be used to authorize the Request.
     * @return  array
     */
    protected function getDefaultRequestOptions(auth\interfaces\Token $token = null) : array
    {
        $options = [
            'headers' => [
                'Accept' => 'application/json'
            ]
        ];

        // If the $token is explicitly given, it will override the respective authorization header.
        if (isset($token)) {
            $options['headers']['Authorization'] = 'Bearer '.$token;
        }

        return $options;
    }

    /**
     * Creates an OAuth 2.0 Access Token instance based on raw response data.
     *
     * @param   array           $data   The raw (response) data to base on.
     * @return  oauth2\Token            The resulting OAuth 2.0 Access Token instance.
     * @throws  \RuntimeException       When the data did not contain an access token in a recognized format.
     */
    protected function createToken(array $data) : oauth2\Token
    {
        // The HTTP Client will throw on an unsuccessful response, but we'll double check that we actually got
        // an access token in response.
        if (empty($data['access_token'])) {
            throw new \RuntimeException('The Provider did not return an access token or it was in an unrecognized format.');
        }

        $token = new oauth2\Token($data['access_token']);

        if (!empty($data['refresh_token'])) {
            $token->setRefreshToken($data['refresh_token']);
        }

        if (!empty($data['expires_in'])) {
            $token->setExpiry($data['expires_in']);
        }

        // Some providers, like Github or Slack, return the granted scopes along with the Tokens. Let's make
        // use of that in the base class since an isset isn't exactly expensive and if other providers happen
        // to return the scopes under a different key, child classes can just remap the value.
        if (isset($data['scope'])) {
            $token->setScopes(is_array($data['scope']) ? $data['scope'] : explode(static::SCOPE_SEPARATOR, $data['scope']));
        }

        return $token;
    }

    /**
     * Creates an Identity instance of a type specific to the Provider, using an Access Token and raw data also
     * specific to the Provider.
     *
     * @param   oauth2\Token    $token  The Access Token that had been used to retrieve information about the entity.
     * @param   array           $data   The raw data about the entity given by the Provider.
     * @return  oauth2\Identity         The resulting OAuth 2.0 Identity instance.
     */
    protected function createIdentity(oauth2\Token $token, array $data) : oauth2\Identity
    {
        $class = static::IDENTITY;

        return new $class($token, $data);
    }
}