Thanks to visit codestin.com
Credit goes to github.com

Skip to content
This repository was archived by the owner on Oct 11, 2018. It is now read-only.

Commit 17d1994

Browse files
alanbemalanbem
committed
Merge pull request FriendsOfSymfony#67 from jeffxpx/master
Implementation that would satisfy grant extensions that can specify a time limit on the access token (fixes FriendsOfSymfony#66)
2 parents 137926d + 63784fa commit 17d1994

File tree

3 files changed

+103
-8
lines changed

3 files changed

+103
-8
lines changed

‎lib/OAuth2/OAuth2.php‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -826,14 +826,16 @@ public function grantAccessToken(Request $request = null)
826826

827827
// if no scope provided to check against $input['scope'] then application defaults are set
828828
// if no data is provided than null is set
829-
$stored += array('scope' => $this->getVariable(self::CONFIG_SUPPORTED_SCOPES, null), 'data' => null);
829+
$stored += array('scope' => $this->getVariable(self::CONFIG_SUPPORTED_SCOPES, null), 'data' => null,
830+
'access_token_lifetime' => $this->getVariable(self::CONFIG_ACCESS_LIFETIME),
831+
'issue_refresh_token' => true, 'refresh_token_lifetime' => $this->getVariable(self::CONFIG_REFRESH_LIFETIME));
830832

831833
// Check scope, if provided
832834
if ($input["scope"] && (!isset($stored["scope"]) || !$this->checkScope($input["scope"], $stored["scope"]))) {
833835
throw new OAuth2ServerException(self::HTTP_BAD_REQUEST, self::ERROR_INVALID_SCOPE, 'An unsupported scope was requested.');
834836
}
835837

836-
$token = $this->createAccessToken($client, $stored['data'], $stored['scope']);
838+
$token = $this->createAccessToken($client, $stored['data'], $stored['scope'], $stored['access_token_lifetime'], $stored['issue_refresh_token'], $stored['refresh_token_lifetime']);
837839

838840
return new Response(json_encode($token), 200, $this->getJsonHeaders());
839841
}
@@ -1287,19 +1289,22 @@ private function buildUri($uri, $params)
12871289
*
12881290
* @param IOAuth2Client $client
12891291
* @param mixed $data
1290-
* @param null $scope
1292+
* @param string|null $scope
1293+
* @param int|null $access_token_lifetime How long the access token should live in seconds
1294+
* @param bool $issue_refresh_token Issue a refresh tokeniIf true and the storage mechanism supports it
1295+
* @param int|null $refresh_token_lifetime How long the refresh token should life in seconds
12911296
*
12921297
* @return array
12931298
*
12941299
* @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-5
12951300
*
12961301
* @ingroup oauth2_section_5
12971302
*/
1298-
public function createAccessToken(IOAuth2Client $client, $data, $scope = null)
1303+
public function createAccessToken(IOAuth2Client $client, $data, $scope = null, $access_token_lifetime = null, $issue_refresh_token = true, $refresh_token_lifetime = null)
12991304
{
13001305
$token = array(
13011306
"access_token" => $this->genAccessToken(),
1302-
"expires_in" => $this->getVariable(self::CONFIG_ACCESS_LIFETIME),
1307+
"expires_in" => ($access_token_lifetime ?: $this->getVariable(self::CONFIG_ACCESS_LIFETIME)),
13031308
"token_type" => $this->getVariable(self::CONFIG_TOKEN_TYPE),
13041309
"scope" => $scope,
13051310
);
@@ -1308,18 +1313,18 @@ public function createAccessToken(IOAuth2Client $client, $data, $scope = null)
13081313
$token["access_token"],
13091314
$client,
13101315
$data,
1311-
time() + $this->getVariable(self::CONFIG_ACCESS_LIFETIME),
1316+
time() + ($access_token_lifetime ?: $this->getVariable(self::CONFIG_ACCESS_LIFETIME)),
13121317
$scope
13131318
);
13141319

13151320
// Issue a refresh token also, if we support them
1316-
if ($this->storage instanceof IOAuth2RefreshTokens) {
1321+
if ($this->storage instanceof IOAuth2RefreshTokens && $issue_refresh_token === true) {
13171322
$token["refresh_token"] = $this->genAccessToken();
13181323
$this->storage->createRefreshToken(
13191324
$token["refresh_token"],
13201325
$client,
13211326
$data,
1322-
time() + $this->getVariable(self::CONFIG_REFRESH_LIFETIME),
1327+
time() + ($refresh_token_lifetime ?: $this->getVariable(self::CONFIG_REFRESH_LIFETIME)),
13231328
$scope
13241329
);
13251330

‎tests/OAuth2/Tests/Fixtures/OAuth2GrantExtensionLifetimeStub.php‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?php
2+
3+
namespace OAuth2\Tests\Fixtures;
4+
5+
use OAuth2\OAuth2;
6+
use OAuth2\IOAuth2GrantExtension;
7+
use OAuth2\OAuth2ServerException;
8+
use OAuth2\Model\IOAuth2Client;
9+
10+
class OAuth2GrantExtensionLifetimeStub extends OAuth2StorageStub implements IOAuth2GrantExtension
11+
{
12+
protected $facebookIds = array();
13+
14+
public function checkGrantExtension(IOAuth2Client $client, $uri, array $inputData, array $authHeaders)
15+
{
16+
if ('http://company.com/fb_access_token_time_limited' !== $uri) {
17+
throw new OAuth2ServerException(OAuth2::HTTP_BAD_REQUEST, OAuth2::ERROR_UNSUPPORTED_GRANT_TYPE);
18+
}
19+
20+
if (!isset($inputData['fb_access_token'])) {
21+
return false;
22+
}
23+
24+
$fbAccessToken = $inputData['fb_access_token'];
25+
$fbId = $this->getFacebookIdFromFacebookAccessToken($fbAccessToken);
26+
27+
if (!isset($this->facebookIds[$fbId])) {
28+
return false;
29+
}
30+
31+
return array(
32+
'data' => array('user_id' => $fbId),
33+
'access_token_lifetime' => 86400,
34+
'issue_refresh_token' => false
35+
);
36+
}
37+
38+
public function addFacebookId($id)
39+
{
40+
$this->facebookIds[$id] = $id;
41+
}
42+
43+
/**
44+
* Let's assume a fb access token looks like "something_fbid"
45+
*
46+
* In real life, we would verify the access token is valid, and get the facebook_id of the
47+
* user via GET http://graph.facebook.com/me
48+
*/
49+
protected function getFacebookIdFromFacebookAccessToken($fbAccessToken)
50+
{
51+
return substr($fbAccessToken, strpos($fbAccessToken, '_') + 1);
52+
}
53+
}

‎tests/OAuth2Test.php‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,43 @@ public function testGrantAccessTokenWithGrantExtension()
567567
$this->assertRegExp('{"access_token":"[^"]+","expires_in":3600,"token_type":"bearer"}', $response->getContent());
568568
}
569569

570+
/**
571+
* Tests OAuth2->grantAccessToken() with extension with limited timeframe
572+
*/
573+
public function testGrantAccessTokenWithGrantExtensionLimitedLifetime()
574+
{
575+
$clientId = 'cid';
576+
$clientSecret = 'csecret';
577+
$grantType = 'http://company.com/fb_access_token_time_limited';
578+
$fbId = '35';
579+
$fbAccessToken = 'da4b9237bacccd_35';
580+
581+
$stub = new \OAuth2\Tests\Fixtures\OAuth2GrantExtensionLifetimeStub();
582+
$stub->addClient(new OAuth2Client($clientId, $clientSecret));
583+
$stub->setAllowedGrantTypes(array($grantType));
584+
$stub->addFacebookId($fbId);
585+
$oauth2 = new OAuth2($stub);
586+
587+
$response = $oauth2->grantAccessToken(new Request(array(
588+
'grant_type' => $grantType,
589+
'client_id' => $clientId,
590+
'client_secret' => $clientSecret,
591+
'fb_access_token' => $fbAccessToken,
592+
)));
593+
594+
$this->assertSame(array(
595+
'content-type' => array('application/json'),
596+
'cache-control' => array('no-store, private'),
597+
'pragma' => array('no-cache'),
598+
), array_diff_key(
599+
$response->headers->all(),
600+
array('date' => null)
601+
));
602+
603+
$this->assertRegExp('{"access_token":"[^"]+","expires_in":86400,"token_type":"bearer"}', $response->getContent());
604+
}
605+
606+
570607
/**
571608
* Tests OAuth2->getAuthorizeParams()
572609
*/

0 commit comments

Comments
 (0)