Skip to content

Commit d64d1c6

Browse files
PothercaPotherca
committed
Add Repository classes to be used with League\OAuth2\Server.
1 parent 56aaa52 commit d64d1c6

5 files changed

Lines changed: 411 additions & 0 deletions

File tree

‎src/Repository/AccessToken.php‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace Pdsinterop\Solid\Auth\Repository;
4+
5+
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
6+
use League\OAuth2\Server\Entities\ClientEntityInterface;
7+
use League\OAuth2\Server\Entities\ScopeEntityInterface;
8+
use League\OAuth2\Server\Exception\UniqueTokenIdentifierConstraintViolationException;
9+
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
10+
use Pdsinterop\Solid\Auth\Entity\AccessToken as AccessTokenEntity;
11+
12+
class AccessToken implements AccessTokenRepositoryInterface
13+
{
14+
/**
15+
* Create a new access token
16+
*
17+
* @param ClientEntityInterface $clientEntity
18+
* @param ScopeEntityInterface[] $scopes
19+
* @param mixed $userIdentifier
20+
*
21+
* @return AccessTokenEntityInterface
22+
*/
23+
public function getNewToken(
24+
ClientEntityInterface $clientEntity,
25+
array $scopes,
26+
$userIdentifier = null
27+
) : AccessTokenEntityInterface {
28+
return new AccessTokenEntity($clientEntity);
29+
}
30+
31+
/**
32+
* Persists a new access token to permanent storage.
33+
*
34+
* @param AccessTokenEntityInterface $accessTokenEntity
35+
*
36+
* @throws UniqueTokenIdentifierConstraintViolationException
37+
*/
38+
public function persistNewAccessToken(AccessTokenEntityInterface $accessTokenEntity) : void
39+
{
40+
// throw new UniqueTokenIdentifierConstraintViolationException()
41+
/*/
42+
When a new access token is created this method will be called. You don’t have to do anything here but for auditing you probably want to.
43+
44+
The access token entity passed in has a number of methods you can call which contain data worth saving to a database:
45+
46+
getIdentifier() : string this is randomly generated unique identifier (of 80+ characters in length) for the access token.
47+
getExpiryDateTime() : \DateTime the expiry date and time of the access token.
48+
getUserIdentifier() : string|null the user identifier represented by the access token.
49+
getScopes() : ScopeEntityInterface[] an array of scope entities
50+
getClient()->getIdentifier() : string the identifier of the client who requested the access token.
51+
52+
JWT access tokens contain an expiry date and so will be rejected automatically when used. You can safely clean up expired access tokens from your database.
53+
/*/
54+
}
55+
56+
/**
57+
* Revoke an access token.
58+
*
59+
* @param string $tokenId
60+
*/
61+
public function revokeAccessToken($tokenId) : void
62+
{
63+
/*/
64+
This method is called when a refresh token is used to reissue an access token.
65+
66+
The original access token is revoked a new access token is issued.
67+
/*/
68+
}
69+
70+
/**
71+
* Check if the access token has been revoked.
72+
*
73+
* @param string $tokenId
74+
*
75+
* @return bool Return true if this token has been revoked
76+
*/
77+
public function isAccessTokenRevoked($tokenId) : bool
78+
{
79+
/*/
80+
This method is called when an access token is validated by the resource server middleware.
81+
82+
Return true if the access token has been manually revoked before it expired.
83+
84+
If the token is still valid return false.
85+
/*/
86+
return false;
87+
}
88+
}

‎src/Repository/AuthCode.php‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace Pdsinterop\Solid\Auth\Repository;
4+
5+
use League\OAuth2\Server\Entities\AuthCodeEntityInterface;
6+
use League\OAuth2\Server\Exception\UniqueTokenIdentifierConstraintViolationException;
7+
use League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface;
8+
use Pdsinterop\Solid\Auth\Entity\AuthCode as AuthCodeEntity;
9+
use Pdsinterop\Solid\Auth\Entity\ClientEntityTrait;
10+
11+
class AuthCode implements AuthCodeRepositoryInterface
12+
{
13+
use ClientEntityTrait;
14+
15+
/**
16+
* Creates a new AuthCode
17+
*
18+
* @return AuthCodeEntityInterface
19+
*/
20+
public function getNewAuthCode() : AuthCodeEntityInterface
21+
{
22+
return new AuthCodeEntity($this->getClientEntity());
23+
}
24+
25+
/**
26+
* Persists a new auth code to permanent storage.
27+
*
28+
* @param AuthCodeEntityInterface $authCodeEntity
29+
*
30+
* @throws UniqueTokenIdentifierConstraintViolationException
31+
*/
32+
public function persistNewAuthCode(AuthCodeEntityInterface $authCodeEntity) : void
33+
{
34+
/*/
35+
When a new auth code is created this method will be called. You don’t
36+
have to do anything here but for auditing you probably want to.
37+
38+
The auth code entity passed in has a number of methods you can call
39+
which contain data worth saving to a database:
40+
41+
getIdentifier() : string this is randomly generated unique identifier (of 80+ characters in length) for the auth code.
42+
getExpiryDateTime() : \DateTime the expiry date and time of the auth code.
43+
getUserIdentifier() : string|null the user identifier represented by the auth code.
44+
getScopes() : ScopeEntityInterface[] an array of scope entities
45+
getClient()->getIdentifier() : string the identifier of the client who requested the auth code.
46+
47+
The auth codes contain an expiry date and so will be rejected
48+
automatically if used when expired. You can safely clean up expired
49+
auth codes from your database.
50+
/*/
51+
}
52+
53+
/**
54+
* Revoke an auth code.
55+
*
56+
* @param string $codeId
57+
*/
58+
public function revokeAuthCode($codeId) : void
59+
{
60+
/*/
61+
This method is called when an authorization code is exchanged for an
62+
access token. You can also use it in your own business logic.
63+
/*/
64+
}
65+
66+
/**
67+
* Check if the auth code has been revoked.
68+
*
69+
* @param string $codeId
70+
*
71+
* @return bool Return true if this code has been revoked
72+
*/
73+
public function isAuthCodeRevoked($codeId) : bool
74+
{
75+
/*/
76+
This method is called before an authorization code is exchanged for an
77+
access token by the authorization server. Return true if the auth code
78+
has been manually revoked before it expired. If the auth code is still
79+
valid return false.
80+
/*/
81+
return false;
82+
}
83+
}

‎src/Repository/Client.php‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace Pdsinterop\Solid\Auth\Repository;
4+
5+
use League\OAuth2\Server\Entities\ClientEntityInterface;
6+
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
7+
use Pdsinterop\Solid\Auth\Entity\Client as ClientEntity;
8+
9+
class Client implements ClientRepositoryInterface
10+
{
11+
////////////////////////////// CLASS PROPERTIES \\\\\\\\\\\\\\\\\\\\\\\\\\\\
12+
13+
/** @var array */
14+
private $grantTypes;
15+
/** @var string */
16+
private $identifier;
17+
/** @var string */
18+
private $secret;
19+
20+
//////////////////////////// GETTERS AND SETTERS \\\\\\\\\\\\\\\\\\\\\\\\\\\
21+
22+
//////////////////////////////// PUBLIC API \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
23+
/**
24+
* @var string
25+
*/
26+
private $name;
27+
/**
28+
* @var array
29+
*/
30+
private $redirectUri;
31+
32+
public function __construct(
33+
string $identifier,
34+
string $secret = '',
35+
string $name = '',
36+
array $grants = [],
37+
array $redirectUri = []
38+
) {
39+
$this->grantTypes = $grants;
40+
$this->identifier = $identifier;
41+
$this->name = $name;
42+
$this->redirectUri = $redirectUri;
43+
$this->secret = $secret;
44+
}
45+
46+
public function createClientEntity($identifier = null) : ClientEntityInterface
47+
{
48+
$client = new ClientEntity(
49+
$identifier,
50+
$this->name,
51+
$this->redirectUri,
52+
$this->secret !== ''
53+
);
54+
55+
return $client;
56+
}
57+
58+
/**
59+
* Get a client.
60+
*
61+
* @param mixed $identifier The client's identifier
62+
*
63+
* @return ClientEntityInterface|null
64+
*/
65+
public function getClientEntity($identifier) : ?ClientEntityInterface
66+
{
67+
return $this->createClientEntity($identifier);
68+
}
69+
70+
/**
71+
* Validate a client's secret.
72+
*
73+
* @param string $clientIdentifier The client's identifier
74+
* @param null|string $clientSecret The client's secret (if sent)
75+
* @param null|string $grantType The type of grant the client is using (if sent)
76+
*
77+
* @return bool
78+
*/
79+
public function validateClient($clientIdentifier, $clientSecret, $grantType) : bool
80+
{
81+
/*/
82+
This method is called to validate a client’s credentials.
83+
84+
The client secret may or may not be provided depending on the request sent by the client.
85+
86+
If the client is confidential (i.e. is capable of securely storing a secret) then the secret must be validated.
87+
88+
You can use the grant type to determine if the client is permitted to use the grant type.
89+
90+
If the client’s credentials are validated you should return true, otherwise return false.
91+
/*/
92+
93+
return $this->identifier === $clientIdentifier
94+
&& ($this->secret === '' || $this->secret === $clientSecret)
95+
&& ($this->grantTypes === [] || in_array($grantType, $this->grantTypes, true))
96+
;
97+
}
98+
99+
////////////////////////////// UTILITY METHODS \\\\\\\\\\\\\\\\\\\\\\\\\\\\\
100+
}

‎src/Repository/RefreshToken.php‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace Pdsinterop\Solid\Auth\Repository;
4+
5+
use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
6+
use League\OAuth2\Server\Exception\UniqueTokenIdentifierConstraintViolationException;
7+
use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
8+
use Pdsinterop\Solid\Auth\Entity\RefreshToken as RefreshTokenEntity;
9+
10+
class RefreshToken implements RefreshTokenRepositoryInterface
11+
{
12+
/**
13+
* Creates a new refresh token
14+
*
15+
* @return RefreshTokenEntityInterface|null
16+
*/
17+
public function getNewRefreshToken() : ?RefreshTokenEntityInterface
18+
{
19+
return new RefreshTokenEntity();
20+
}
21+
22+
/**
23+
* Called when a new refresh token is created
24+
*
25+
* @param RefreshTokenEntityInterface $refreshTokenEntity
26+
*
27+
* @throws UniqueTokenIdentifierConstraintViolationException
28+
*/
29+
public function persistNewRefreshToken(RefreshTokenEntityInterface $refreshTokenEntity) : void
30+
{
31+
// throw new UniqueTokenIdentifierConstraintViolationException;
32+
/*/
33+
When a new refresh token is created this method will be called. You don’t have to do anything here but for
34+
auditing you might want to.
35+
36+
The refresh token entity passed in has a number of methods you can call which contain data worth saving to
37+
a database:
38+
39+
getIdentifier() : string this is randomly generated unique identifier (of 80+ characters in length) for the refresh token.
40+
getExpiryDateTime() : \DateTime the expiry date and time of the refresh token.
41+
getAccessToken()->getIdentifier() : string the linked access token’s identifier.
42+
43+
JWT access tokens contain an expiry date and so will be rejected automatically when used. You can safely
44+
clean up expired access tokens from your database.
45+
/*/
46+
}
47+
48+
/**
49+
* Revoke the refresh token.
50+
*
51+
* @param string $tokenId
52+
*/
53+
public function revokeRefreshToken($tokenId) : void
54+
{
55+
/*/
56+
This method is called when a refresh token is used to reissue an access token.
57+
58+
The original refresh token is revoked a new refresh token is issued.
59+
/*/
60+
}
61+
62+
/**
63+
* Check if the refresh token has been revoked.
64+
*
65+
* @param string $tokenId
66+
*
67+
* @return bool Return true if this token has been revoked
68+
*/
69+
public function isRefreshTokenRevoked($tokenId) : bool
70+
{
71+
/*/
72+
This method is called when an refresh token is used to issue a new access token.
73+
74+
Return true if the refresh token has been manually revoked before it expired.
75+
If the token is still valid return false.
76+
/*/
77+
return false;
78+
}
79+
}

0 commit comments

Comments
 (0)