Skip to content

Commit 0ba5443

Browse files
karserkarser
committed
Added OAuth2 interface
1 parent b37dd31 commit 0ba5443

File tree

2 files changed

+157
-108
lines changed

2 files changed

+157
-108
lines changed

‎lib/IOAuth2.php‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
<?php
2+
3+
namespace OAuth2;
4+
5+
use OAuth2\Model\IOAuth2AccessToken;
6+
use OAuth2\Model\IOAuth2Client;
7+
use Symfony\Component\HttpFoundation\Request;
8+
use Symfony\Component\HttpFoundation\Response;
9+
10+
/**
11+
* @author Originally written by Dmitrii Poddubnyi <[email protected]>.
12+
*/
13+
interface IOAuth2
14+
{
15+
/**
16+
* Returns a persistent variable.
17+
*
18+
* @param string $name The name of the variable to return.
19+
* @param mixed $default The default value to use if this variable has never been set.
20+
*
21+
* @return mixed The value of the variable.
22+
*/
23+
public function getVariable($name, $default = null);
24+
25+
/**
26+
* Sets a persistent variable.
27+
*
28+
* @param string $name The name of the variable to set.
29+
* @param mixed $value The value to set.
30+
*
31+
* @return OAuth2 The application (for chained calls of this method)
32+
*/
33+
public function setVariable($name, $value);
34+
35+
/**
36+
* Check that a valid access token has been provided.
37+
* The token is returned (as an associative array) if valid.
38+
*
39+
* The scope parameter defines any required scope that the token must have.
40+
* If a scope param is provided and the token does not have the required
41+
* scope, we bounce the request.
42+
*
43+
* Some implementations may choose to return a subset of the protected
44+
* resource (i.e. "public" data) if the user has not provided an access
45+
* token or if the access token is invalid or expired.
46+
*
47+
* The IETF spec says that we should send a 401 Unauthorized header and
48+
* bail immediately so that's what the defaults are set to. You can catch
49+
* the exception thrown and behave differently if you like (log errors, allow
50+
* public access for missing tokens, etc)
51+
*
52+
* @param string $tokenParam
53+
* @param string $scope A space-separated string of required scope(s), if you want to check for scope.
54+
*
55+
* @return IOAuth2AccessToken Token
56+
*
57+
* @throws OAuth2AuthenticateException
58+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-7
59+
*
60+
* @ingroup oauth2_section_7
61+
*/
62+
public function verifyAccessToken($tokenParam, $scope = null);
63+
64+
/**
65+
* This is a convenience function that can be used to get the token, which can then
66+
* be passed to verifyAccessToken(). The constraints specified by the draft are
67+
* attempted to be adheared to in this method.
68+
*
69+
* As per the Bearer spec (draft 8, section 2) - there are three ways for a client
70+
* to specify the bearer token, in order of preference: Authorization Header,
71+
* POST and GET.
72+
*
73+
* NB: Resource servers MUST accept tokens via the Authorization scheme
74+
* (http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2).
75+
*
76+
* @param Request $request
77+
* @param bool $removeFromRequest
78+
*
79+
* @return string|null
80+
* @throws OAuth2AuthenticateException
81+
* @todo Should we enforce TLS/SSL in this function?
82+
*
83+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2.1
84+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2.2
85+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2.3
86+
*
87+
*/
88+
public function getBearerToken(Request $request = null, $removeFromRequest = false);
89+
90+
/**
91+
* Grant or deny a requested access token.
92+
*
93+
* This would be called from the "/token" endpoint as defined in the spec.
94+
* Obviously, you can call your endpoint whatever you want.
95+
* Draft specifies that the authorization parameters should be retrieved from POST, but you can override to whatever method you like.
96+
*
97+
* @param Request $request (optional) The request
98+
*
99+
* @return Response
100+
* @throws OAuth2ServerException
101+
*
102+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-4
103+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-10.6
104+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-4.1.3
105+
*
106+
* @ingroup oauth2_section_4
107+
*/
108+
public function grantAccessToken(Request $request = null);
109+
110+
/**
111+
* Redirect the user appropriately after approval.
112+
*
113+
* After the user has approved or denied the access request the authorization server should call this function to
114+
* redirect the user appropriately.
115+
*
116+
* @param bool $isAuthorized true or false depending on whether the user authorized the access.
117+
* @param mixed $data Application data
118+
* @param Request $request
119+
* @param string|null $scope
120+
*
121+
* @return Response
122+
* @throws OAuth2RedirectException
123+
*
124+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-4
125+
*
126+
* @ingroup oauth2_section_4
127+
*/
128+
public function finishClientAuthorization($isAuthorized, $data = null, Request $request = null, $scope = null);
129+
130+
/**
131+
* Handle the creation of access token, also issue refresh token if support.
132+
*
133+
* This belongs in a separate factory, but to keep it simple, I'm just keeping it here.
134+
*
135+
* @param IOAuth2Client $client
136+
* @param mixed $data
137+
* @param string|null $scope
138+
* @param int|null $access_token_lifetime How long the access token should live in seconds
139+
* @param bool $issue_refresh_token Issue a refresh tokeniIf true and the storage mechanism supports it
140+
* @param int|null $refresh_token_lifetime How long the refresh token should life in seconds
141+
*
142+
* @return array
143+
*
144+
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-5
145+
*
146+
* @ingroup oauth2_section_5
147+
*/
148+
public function createAccessToken(IOAuth2Client $client, $data, $scope = null, $access_token_lifetime = null, $issue_refresh_token = true, $refresh_token_lifetime = null);
149+
}

‎lib/OAuth2.php‎

Lines changed: 8 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
* @author Debug, coding style clean up and documented by Edison Wong <[email protected]>.
4848
* @author Refactored (including separating from raw POST/GET) and updated to draft v20 by David Rochwerger <[email protected]>.
4949
*/
50-
class OAuth2
50+
class OAuth2 implements IOAuth2
5151
{
5252
/**
5353
* Array of persistent variables stored.
@@ -430,12 +430,7 @@ protected function setDefaultOptions()
430430
}
431431

432432
/**
433-
* Returns a persistent variable.
434-
*
435-
* @param string $name The name of the variable to return.
436-
* @param mixed $default The default value to use if this variable has never been set.
437-
*
438-
* @return mixed The value of the variable.
433+
* {@inheritdoc}
439434
*/
440435
public function getVariable($name, $default = null)
441436
{
@@ -445,12 +440,7 @@ public function getVariable($name, $default = null)
445440
}
446441

447442
/**
448-
* Sets a persistent variable.
449-
*
450-
* @param string $name The name of the variable to set.
451-
* @param mixed $value The value to set.
452-
*
453-
* @return OAuth2 The application (for chained calls of this method)
443+
* {@inheritdoc}
454444
*/
455445
public function setVariable($name, $value)
456446
{
@@ -464,31 +454,7 @@ public function setVariable($name, $value)
464454
// Resource protecting (Section 5).
465455

466456
/**
467-
* Check that a valid access token has been provided.
468-
* The token is returned (as an associative array) if valid.
469-
*
470-
* The scope parameter defines any required scope that the token must have.
471-
* If a scope param is provided and the token does not have the required
472-
* scope, we bounce the request.
473-
*
474-
* Some implementations may choose to return a subset of the protected
475-
* resource (i.e. "public" data) if the user has not provided an access
476-
* token or if the access token is invalid or expired.
477-
*
478-
* The IETF spec says that we should send a 401 Unauthorized header and
479-
* bail immediately so that's what the defaults are set to. You can catch
480-
* the exception thrown and behave differently if you like (log errors, allow
481-
* public access for missing tokens, etc)
482-
*
483-
* @param string $tokenParam
484-
* @param string $scope A space-separated string of required scope(s), if you want to check for scope.
485-
*
486-
* @throws OAuth2AuthenticateException
487-
* @return IOAuth2AccessToken Token
488-
*
489-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-7
490-
*
491-
* @ingroup oauth2_section_7
457+
* {@inheritdoc}
492458
*/
493459
public function verifyAccessToken($tokenParam, $scope = null)
494460
{
@@ -520,28 +486,7 @@ public function verifyAccessToken($tokenParam, $scope = null)
520486
}
521487

522488
/**
523-
* This is a convenience function that can be used to get the token, which can then
524-
* be passed to verifyAccessToken(). The constraints specified by the draft are
525-
* attempted to be adheared to in this method.
526-
*
527-
* As per the Bearer spec (draft 8, section 2) - there are three ways for a client
528-
* to specify the bearer token, in order of preference: Authorization Header,
529-
* POST and GET.
530-
*
531-
* NB: Resource servers MUST accept tokens via the Authorization scheme
532-
* (http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2).
533-
*
534-
* @todo Should we enforce TLS/SSL in this function?
535-
*
536-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2.1
537-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2.2
538-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08#section-2.3
539-
*
540-
* @param Request $request
541-
* @param bool $removeFromRequest
542-
*
543-
* @return string|null
544-
* @throws OAuth2AuthenticateException
489+
* {@inheritdoc}
545490
*/
546491
public function getBearerToken(Request $request = null, $removeFromRequest = false)
547492
{
@@ -734,22 +679,7 @@ protected function checkScope($requiredScope, $availableScope)
734679
// Access token granting (Section 4).
735680

736681
/**
737-
* Grant or deny a requested access token.
738-
*
739-
* This would be called from the "/token" endpoint as defined in the spec.
740-
* Obviously, you can call your endpoint whatever you want.
741-
* Draft specifies that the authorization parameters should be retrieved from POST, but you can override to whatever method you like.
742-
*
743-
* @param Request $request (optional) The request
744-
*
745-
* @return Response
746-
* @throws OAuth2ServerException
747-
*
748-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-4
749-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-10.6
750-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-4.1.3
751-
*
752-
* @ingroup oauth2_section_4
682+
* {@inheritdoc}
753683
*/
754684
public function grantAccessToken(Request $request = null)
755685
{
@@ -1194,22 +1124,7 @@ protected function getRedirectUri($redirectUri, IOAuth2Client $client)
11941124
}
11951125

11961126
/**
1197-
* Redirect the user appropriately after approval.
1198-
*
1199-
* After the user has approved or denied the access request the authorization server should call this function to
1200-
* redirect the user appropriately.
1201-
*
1202-
* @param bool $isAuthorized true or false depending on whether the user authorized the access.
1203-
* @param mixed $data Application data
1204-
* @param Request $request
1205-
* @param string|null $scope
1206-
*
1207-
* @throws OAuth2RedirectException
1208-
*
1209-
* @return Response
1210-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-4
1211-
*
1212-
* @ingroup oauth2_section_4
1127+
* {@inheritdoc}
12131128
*/
12141129
public function finishClientAuthorization($isAuthorized, $data = null, Request $request = null, $scope = null)
12151130
{
@@ -1314,22 +1229,7 @@ private function buildUri($uri, $params)
13141229
}
13151230

13161231
/**
1317-
* Handle the creation of access token, also issue refresh token if support.
1318-
*
1319-
* This belongs in a separate factory, but to keep it simple, I'm just keeping it here.
1320-
*
1321-
* @param IOAuth2Client $client
1322-
* @param mixed $data
1323-
* @param string|null $scope
1324-
* @param int|null $access_token_lifetime How long the access token should live in seconds
1325-
* @param bool $issue_refresh_token Issue a refresh tokeniIf true and the storage mechanism supports it
1326-
* @param int|null $refresh_token_lifetime How long the refresh token should life in seconds
1327-
*
1328-
* @return array
1329-
*
1330-
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-5
1331-
*
1332-
* @ingroup oauth2_section_5
1232+
* {@inheritdoc}
13331233
*/
13341234
public function createAccessToken(IOAuth2Client $client, $data, $scope = null, $access_token_lifetime = null, $issue_refresh_token = true, $refresh_token_lifetime = null)
13351235
{

0 commit comments

Comments
 (0)