Merge pull request FriendsOfSymfony#64 from pyrech/patch-1

alanbem · alanbem · commit 23e76537c4a0 · 2014-11-03T11:21:20.000+01:00
Use scope asked by the client if any
diff --git a/lib/OAuth2.php b/lib/OAuth2.php
@@ -830,13 +830,16 @@ public function grantAccessToken(Request $request = null)
                          'access_token_lifetime' => $this->getVariable(self::CONFIG_ACCESS_LIFETIME),
                          'issue_refresh_token' => true, 'refresh_token_lifetime' => $this->getVariable(self::CONFIG_REFRESH_LIFETIME));
 
-        // Check scope, if provided
-        if ($input["scope"] && (!isset($stored["scope"]) || !$this->checkScope($input["scope"], $stored["scope"]))) {
-            throw new OAuth2ServerException(self::HTTP_BAD_REQUEST, self::ERROR_INVALID_SCOPE, 'An unsupported scope was requested.');
+        $scope = $stored['scope'];
+        if ($input["scope"]) {
+            // Check scope, if provided
+            if (!isset($stored["scope"]) || !$this->checkScope($input["scope"], $stored["scope"])) {
+                throw new OAuth2ServerException(self::HTTP_BAD_REQUEST, self::ERROR_INVALID_SCOPE, 'An unsupported scope was requested.');
+            }
+            $scope = $input["scope"];
         }
 
-        $token = $this->createAccessToken($client, $stored['data'], $stored['scope'], $stored['access_token_lifetime'], $stored['issue_refresh_token'], $stored['refresh_token_lifetime']);
-
+        $token = $this->createAccessToken($client, $stored['data'], $scope, $stored['access_token_lifetime'], $stored['issue_refresh_token'], $stored['refresh_token_lifetime']);
         return new Response(json_encode($token), 200, $this->getJsonHeaders());
     }
 
diff --git a/tests/OAuth2Test.php b/tests/OAuth2Test.php
@@ -525,13 +525,71 @@ public function testGrantAccessTokenWithGrantUserWithReducedScope()
             array('date' => null)
         ));
 
+        $this->assertRegExp('{"access_token":"[^"]+","expires_in":3600,"token_type":"bearer","scope":"scope1"}', $response->getContent());
+
+        $token = $stub->getLastAccessToken();
+        $this->assertSame('cid', $token->getClientId());
+        $this->assertSame('scope1', $token->getScope());
+    }
+
+    public function testGrantAccessTokenWithGrantUserWithNoScope()
+    {
+        $stub = new OAuth2GrantUserStub;
+        $stub->addClient(new OAuth2Client('cid', 'cpass'));
+        $stub->addUser('foo', 'bar', 'scope1 scope2');
+        $stub->setAllowedGrantTypes(array('authorization_code', 'password'));
+
+        $oauth2 = new OAuth2($stub);
+
+        $response = $oauth2->grantAccessToken(new Request(array(
+            'grant_type' => 'password',
+            'client_id' => 'cid',
+            'client_secret' => 'cpass',
+            'username' => 'foo',
+            'password' => 'bar',
+        )));
+
+        $this->assertSame(array(
+            'content-type' => array('application/json'),
+            'cache-control' => array('no-store, private'),
+            'pragma' => array('no-cache'),
+        ), array_diff_key(
+            $response->headers->all(),
+            array('date' => null)
+        ));
+
         $this->assertRegExp('{"access_token":"[^"]+","expires_in":3600,"token_type":"bearer","scope":"scope1 scope2"}', $response->getContent());
 
         $token = $stub->getLastAccessToken();
         $this->assertSame('cid', $token->getClientId());
         $this->assertSame('scope1 scope2', $token->getScope());
     }
 
+    public function testGrantAccessTokenWithGrantUserWithNewScopeThrowsError()
+    {
+        $stub = new OAuth2GrantUserStub;
+        $stub->addClient(new OAuth2Client('cid', 'cpass'));
+        $stub->addUser('foo', 'bar', 'scope1 scope2');
+        $stub->setAllowedGrantTypes(array('authorization_code', 'password'));
+
+        $oauth2 = new OAuth2($stub);
+        
+        try {
+            $response = $oauth2->grantAccessToken(new Request(array(
+                'grant_type' => 'password',
+                'client_id' => 'cid',
+                'client_secret' => 'cpass',
+                'username' => 'foo',
+                'password' => 'bar',
+                'scope' => 'scope3',
+            )));
+            $this->fail('The expected exception OAuth2ServerException was not thrown');
+        } catch (OAuth2ServerException $e) {
+            $this->assertSame('invalid_scope', $e->getMessage());
+            $this->assertSame('An unsupported scope was requested.', $e->getDescription());
+        }
+    }
+
         /**
      * Tests OAuth2->grantAccessToken() with client credentials
      *
