Merge branch '10.x'

driesvints · driesvints · commit 4cee55e3e048 · 2022-08-16T15:34:48.000+02:00
# Conflicts:
#	CHANGELOG.md
#	src/Guards/TokenGuard.php
diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml
@@ -0,0 +1,12 @@
+name: pull requests
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  uneditable:
+    uses: laravel/.github/.github/workflows/pull-requests.yml@main
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -32,6 +32,7 @@ jobs:
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick
+          ini-values: error_reporting=E_ALL
           tools: composer:v2
           coverage: none
 
diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml
@@ -0,0 +1,9 @@
+name: update changelog
+
+on:
+  release:
+    types: [released]
+
+jobs:
+  update:
+    uses: laravel/.github/.github/workflows/update-changelog.yml@main
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/UPGRADE.md b/UPGRADE.md
@@ -16,7 +16,7 @@ Laravel 8.0 is now the minimum required version.
 
 PR: https://github.com/laravel/passport/pull/1325
 
-The personal client configuration methods have been removed from the `Passport` class since they are no longer necessary. You should remove calls to these methods from your `AuthServiceProvider`.
+The personal client configuration methods have been removed from the `Passport` class since they are no longer necessary. You should remove any calls to these methods from your application's service providers.
 
 ## Upgrading To 9.0 From 8.x
 
diff --git a/composer.json b/composer.json
@@ -16,16 +16,16 @@
     "require": {
         "php": "^7.3|^8.0",
         "ext-json": "*",
-        "firebase/php-jwt": "^5.0",
-        "illuminate/auth": "^8.2|^9.0",
-        "illuminate/console": "^8.2|^9.0",
-        "illuminate/container": "^8.2|^9.0",
-        "illuminate/contracts": "^8.2|^9.0",
-        "illuminate/cookie": "^8.2|^9.0",
-        "illuminate/database": "^8.2|^9.0",
-        "illuminate/encryption": "^8.2|^9.0",
-        "illuminate/http": "^8.2|^9.0",
-        "illuminate/support": "^8.2|^9.0",
+        "firebase/php-jwt": "^6.0",
+        "illuminate/auth": "^8.37|^9.0",
+        "illuminate/console": "^8.37|^9.0",
+        "illuminate/container": "^8.37|^9.0",
+        "illuminate/contracts": "^8.37|^9.0",
+        "illuminate/cookie": "^8.37|^9.0",
+        "illuminate/database": "^8.37|^9.0",
+        "illuminate/encryption": "^8.37|^9.0",
+        "illuminate/http": "^8.37|^9.0",
+        "illuminate/support": "^8.37|^9.0",
         "lcobucci/jwt": "^3.4|^4.0",
         "league/oauth2-server": "^8.2",
         "nyholm/psr7": "^1.3",
diff --git a/database/factories/ClientFactory.php b/database/factories/ClientFactory.php
@@ -25,9 +25,9 @@ public function definition()
     {
         return $this->ensurePrimaryKeyIsSet([
             'user_id' => null,
-            'name' => $this->faker->company,
+            'name' => $this->faker->company(),
             'secret' => Str::random(40),
-            'redirect' => $this->faker->url,
+            'redirect' => $this->faker->url(),
             'personal_access_client' => false,
             'password_client' => false,
             'revoked' => false,
diff --git a/database/migrations/2016_06_01_000001_create_oauth_auth_codes_table.php b/database/migrations/2016_06_01_000001_create_oauth_auth_codes_table.php
@@ -4,7 +4,7 @@
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
-class CreateOauthAuthCodesTable extends Migration
+return new class extends Migration
 {
     /**
      * Run the migrations.
@@ -32,4 +32,4 @@ public function down()
     {
         Schema::dropIfExists('oauth_auth_codes');
     }
-}
+};
diff --git a/database/migrations/2016_06_01_000002_create_oauth_access_tokens_table.php b/database/migrations/2016_06_01_000002_create_oauth_access_tokens_table.php
@@ -4,7 +4,7 @@
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
-class CreateOauthAccessTokensTable extends Migration
+return new class extends Migration
 {
     /**
      * Run the migrations.
@@ -34,4 +34,4 @@ public function down()
     {
         Schema::dropIfExists('oauth_access_tokens');
     }
-}
+};
diff --git a/database/migrations/2016_06_01_000003_create_oauth_refresh_tokens_table.php b/database/migrations/2016_06_01_000003_create_oauth_refresh_tokens_table.php
@@ -4,7 +4,7 @@
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
-class CreateOauthRefreshTokensTable extends Migration
+return new class extends Migration
 {
     /**
      * Run the migrations.
@@ -30,4 +30,4 @@ public function down()
     {
         Schema::dropIfExists('oauth_refresh_tokens');
     }
-}
+};
diff --git a/database/migrations/2016_06_01_000004_create_oauth_clients_table.php b/database/migrations/2016_06_01_000004_create_oauth_clients_table.php
@@ -4,7 +4,7 @@
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
-class CreateOauthClientsTable extends Migration
+return new class extends Migration
 {
     /**
      * Run the migrations.
@@ -36,4 +36,4 @@ public function down()
     {
         Schema::dropIfExists('oauth_clients');
     }
-}
+};
diff --git a/database/migrations/2016_06_01_000005_create_oauth_personal_access_clients_table.php b/database/migrations/2016_06_01_000005_create_oauth_personal_access_clients_table.php
@@ -4,7 +4,7 @@
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
-class CreateOauthPersonalAccessClientsTable extends Migration
+return new class extends Migration
 {
     /**
      * Run the migrations.
@@ -29,4 +29,4 @@ public function down()
     {
         Schema::dropIfExists('oauth_personal_access_clients');
     }
-}
+};
diff --git a/src/ApiTokenCookieFactory.php b/src/ApiTokenCookieFactory.php
@@ -77,6 +77,6 @@ protected function createToken($userId, $csrfToken, Carbon $expiration)
             'sub' => $userId,
             'csrf' => $csrfToken,
             'expiry' => $expiration->getTimestamp(),
-        ], Passport::tokenEncryptionKey($this->encrypter));
+        ], Passport::tokenEncryptionKey($this->encrypter), 'HS256');
     }
 }
diff --git a/src/Guards/TokenGuard.php b/src/Guards/TokenGuard.php
@@ -4,6 +4,7 @@
 
 use Exception;
 use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
 use Illuminate\Auth\GuardHelpers;
 use Illuminate\Container\Container;
 use Illuminate\Contracts\Auth\Guard;
@@ -296,8 +297,7 @@ protected function decodeJwtTokenCookie($request)
     {
         return (array) JWT::decode(
             CookieValuePrefix::remove($this->encrypter->decrypt($request->cookie(Passport::cookie()), Passport::$unserializesCookies)),
-            Passport::tokenEncryptionKey($this->encrypter),
-            ['HS256']
+            new Key(Passport::tokenEncryptionKey($this->encrypter), 'HS256')
         );
     }
 
diff --git a/src/Http/Rules/RedirectRule.php b/src/Http/Rules/RedirectRule.php
@@ -31,7 +31,7 @@ public function __construct(Factory $validator)
     public function passes($attribute, $value)
     {
         foreach (explode(',', $value) as $redirect) {
-            $validator = $this->validator->make(['redirect' => $redirect], ['redirect' => 'url']);
+            $validator = $this->validator->make(['redirect' => $redirect], ['redirect' => new UriRule]);
 
             if ($validator->fails()) {
                 return false;
@@ -46,6 +46,6 @@ public function passes($attribute, $value)
      */
     public function message()
     {
-        return 'One or more redirects have an invalid url format.';
+        return 'One or more redirects have an invalid URI format.';
     }
 }
diff --git a/src/Http/Rules/UriRule.php b/src/Http/Rules/UriRule.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace Laravel\Passport\Http\Rules;
+
+use Illuminate\Contracts\Validation\Rule;
+
+class UriRule implements Rule
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function passes($attribute, $value): bool
+    {
+        if (filter_var($value, FILTER_VALIDATE_URL)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function message(): string
+    {
+        return 'The :attribute must be valid URI.';
+    }
+}
diff --git a/tests/Unit/TokenGuardTest.php b/tests/Unit/TokenGuardTest.php
@@ -166,7 +166,7 @@ public function test_users_may_be_retrieved_from_cookies_with_csrf_token_header(
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)), false)
+            ], str_repeat('a', 16), 'HS256'), false)
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -199,7 +199,7 @@ public function test_users_may_be_retrieved_from_cookies_with_xsrf_token_header(
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)), false)
+            ], str_repeat('a', 16), 'HS256'), false)
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -228,7 +228,7 @@ public function test_cookie_xsrf_is_verified_against_csrf_token_header()
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)))
+            ], str_repeat('a', 16), 'HS256'))
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -254,7 +254,7 @@ public function test_cookie_xsrf_is_verified_against_xsrf_token_header()
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)))
+            ], str_repeat('a', 16), 'HS256'))
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -288,7 +288,7 @@ public function test_users_may_be_retrieved_from_cookies_with_xsrf_token_header_
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], Passport::tokenEncryptionKey($encrypter)), false)
+            ], Passport::tokenEncryptionKey($encrypter), 'HS256'), false)
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -320,7 +320,7 @@ public function test_xsrf_token_cookie_without_a_token_header_is_not_accepted()
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)))
+            ], str_repeat('a', 16), 'HS256'))
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -346,7 +346,7 @@ public function test_expired_cookies_may_not_be_used()
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->subMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)))
+            ], str_repeat('a', 16), 'HS256'))
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -376,7 +376,7 @@ public function test_csrf_check_can_be_disabled()
                 'sub' => 1,
                 'aud' => 1,
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)), false)
+            ], str_repeat('a', 16), 'HS256'), false)
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);
@@ -502,7 +502,7 @@ public function test_clients_may_be_retrieved_from_cookies()
                 'aud' => 1,
                 'csrf' => 'token',
                 'expiry' => Carbon::now()->addMinutes(10)->getTimestamp(),
-            ], str_repeat('a', 16)), false)
+            ], str_repeat('a', 16), 'HS256'), false)
         );
 
         $guard = new TokenGuard($resourceServer, $userProvider, $tokens, $clients, $encrypter, $request);

Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`use Illuminate\Database\Schema\Blueprint;`
`5`	`5`	`use Illuminate\Support\Facades\Schema;`
`6`	`6`
`7`		`-class CreateOauthAuthCodesTable extends Migration`
	`7`	`+return new class extends Migration`
`8`	`8`	`{`
`9`	`9`	`/**`
`10`	`10`	`* Run the migrations.`
`@@ -32,4 +32,4 @@ public function down()`
`32`	`32`	`{`
`33`	`33`	`Schema::dropIfExists('oauth_auth_codes');`
`34`	`34`	`}`
`35`		`-}`
	`35`	`+};`