mirror/Arsse
1
1
Fork 0
mirror of https://code.mensbeam.com/MensBeam/Arsse.git synced 2025-01-09 01:12:41 +00:00
Code Issues Activity

Basic token issuance

Browse source 
The auth code verification should be refactored out for efficiency and
accuracy so that a client ID may be easily associated with a token.
This commit is contained in:
J. King 2019-09-14 23:05:30 -04:00
parent c814ce1791
commit a81f2897c8
1 changed files with 31 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
lib/REST/Microsub/Auth.php
View file

@ -21,7 +21,7 @@ class Auth extends \JKingWeb\Arsse\REST\AbstractHandler {
const FUNCTIONS = [
'discovery' => ['GET' => "opDiscovery"],
'login' => ['GET' => "opLogin", 'POST' => "opCodeVerification"],
'issue' => ['POST' => "opIssue"],
'issue' => ['GET' => "opTokenVerification", 'POST' => "opIssueAccessToken"],
];
public function __construct() {
@ -176,12 +176,14 @@ class Auth extends \JKingWeb\Arsse\REST\AbstractHandler {
// check that the token exists
$token = Arsse::$db->tokenLookup("microsub.auth", $code);
if (!$token) {
throw new ExceptionAuth("unsupported_grant_type");
throw new ExceptionAuth("invalid_grant");
}
$data = @json_decode($token['data'], true);
// validate the token
if ($token['user'] !== $user || !is_array($data) || $data['id'] !== $id || $data['url'] !== $url) {
throw new ExceptionAuth("unsupported_grant_type");
if ($token['user'] !== $user || !is_array($data)) {
throw new ExceptionAuth("invalid_grant");
} elseif ($data['id'] !== $id || $data['url'] !== $url) {
throw new ExceptionAuth("invalid_client");
} else {
$out = ['me' => $this->buildIdentifier($req)];
if ($data['type'] === "code") {
@ -191,7 +193,31 @@ class Auth extends \JKingWeb\Arsse\REST\AbstractHandler {
}
}
protected function opIssue(string $user, ServerRequestInterface $req): ResponseInterface {
protected function opIssueAccessToken(string $user, ServerRequestInterface $req): ResponseInterface {
$post = $req->getParsedBody();
$type = $post['grant_type'] ?? "";
$me = $post['me'] ?? "";
if ($type !== "authorization_code") {
throw new ExceptionAuth("unsupported_grant_type");
} elseif ($this->buildIdentifier($req) !== $me) {
throw new ExceptionAuth("invalid_grant");
} else {
$out = $this->opCodeVerification($user, $req)->getPayload();
if (!isset($out['scope'])) {
throw new ExceptionAuth("invalid_scope");
}
// issue an access token
$tr = Arsse::$db->begin();
$token = Arsse::$db->tokenCreate($user, "microsub.access");
Arsse::$db->tokenRevoke($user, "microsub.auth", $post['code']);
$tr->commit();
$out['access_token'] = $token;
$out['token_type'] = "Bearer";
return new JsonResponse($out);
}
}
protected function opTokenVerification(string $user, ServerRequestInterface $req): ResponseInterface {
}
}