PhabricatorOAuthServerTokenController.php
No OneTemporary
Actions

Size

6 KB

Referenced Files

None

Subscribers

None

PhabricatorOAuthServerTokenController.php
View Options

	<?php

	final class PhabricatorOAuthServerTokenController
	extends PhabricatorOAuthServerController {

	public function shouldRequireLogin() {
	return false;
	}

	public function shouldAllowRestrictedParameter($parameter_name) {
	if ($parameter_name == 'code') {
	return true;
	}
	return parent::shouldAllowRestrictedParameter($parameter_name);
	}

	public function handleRequest(AphrontRequest $request) {
	$grant_type = $request->getStr('grant_type');
	$code = $request->getStr('code');
	$redirect_uri = $request->getStr('redirect_uri');
	$response = new PhabricatorOAuthResponse();
	$server = new PhabricatorOAuthServer();

	$client_id_parameter = $request->getStr('client_id');
	$client_id_header = idx($_SERVER, 'PHP_AUTH_USER');
	if (strlen($client_id_parameter) && strlen($client_id_header)) {
	if ($client_id_parameter !== $client_id_header) {
	throw new Exception(
	pht(
	'Request included a client_id parameter and an "Authorization" '.
	'header with a username, but the values "%s" and "%s") disagree. '.
	'The values must match.',
	$client_id_parameter,
	$client_id_header));
	}
	}

	$client_secret_parameter = $request->getStr('client_secret');
	$client_secret_header = idx($_SERVER, 'PHP_AUTH_PW');
	if (strlen($client_secret_parameter)) {
	// If the `client_secret` parameter is present, prefer parameters.
	$client_phid = $client_id_parameter;
	$client_secret = $client_secret_parameter;
	} else {
	// Otherwise, read values from the "Authorization" header.
	$client_phid = $client_id_header;
	$client_secret = $client_secret_header;
	}

	if ($grant_type != 'authorization_code') {
	$response->setError('unsupported_grant_type');
	$response->setErrorDescription(
	pht(
	'Only %s %s is supported.',
	'grant_type',
	'authorization_code'));
	return $response;
	}

	if (!$code) {
	$response->setError('invalid_request');
	$response->setErrorDescription(pht('Required parameter code missing.'));
	return $response;
	}

	if (!$client_phid) {
	$response->setError('invalid_request');
	$response->setErrorDescription(
	pht(
	'Required parameter %s missing.',
	'client_id'));
	return $response;
	}

	if (!$client_secret) {
	$response->setError('invalid_request');
	$response->setErrorDescription(
	pht(
	'Required parameter %s missing.',
	'client_secret'));
	return $response;
	}

	// one giant try / catch around all the exciting database stuff so we
	// can return a 'server_error' response if something goes wrong!
	try {
	$auth_code = id(new PhabricatorOAuthServerAuthorizationCode())
	->loadOneWhere('code = %s',
	$code);
	if (!$auth_code) {
	$response->setError('invalid_grant');
	$response->setErrorDescription(
	pht(
	'Authorization code %s not found.',
	$code));
	return $response;
	}

	// if we have an auth code redirect URI, there must be a redirect_uri
	// in the request and it must match the auth code redirect uri exactly
	$auth_code_redirect_uri = $auth_code->getRedirectURI();
	if ($auth_code_redirect_uri) {
	$auth_code_redirect_uri = new PhutilURI($auth_code_redirect_uri);
	$redirect_uri = new PhutilURI($redirect_uri);
	if (!$redirect_uri->getDomain() \|\|
	$redirect_uri != $auth_code_redirect_uri) {
	$response->setError('invalid_grant');
	$response->setErrorDescription(
	pht(
	'Redirect URI in request must exactly match redirect URI '.
	'from authorization code.'));
	return $response;
	}
	} else if ($redirect_uri) {
	$response->setError('invalid_grant');
	$response->setErrorDescription(
	pht(
	'Redirect URI in request and no redirect URI in authorization '.
	'code. The two must exactly match.'));
	return $response;
	}

	$client = id(new PhabricatorOAuthServerClient())
	->loadOneWhere('phid = %s', $client_phid);
	if (!$client) {
	$response->setError('invalid_client');
	$response->setErrorDescription(
	pht(
	'Client with %s %s not found.',
	'client_id',
	$client_phid));
	return $response;
	}

	if ($client->getIsDisabled()) {
	$response->setError('invalid_client');
	$response->setErrorDescription(
	pht(
	'OAuth application "%s" has been disabled.',
	$client->getName()));

	return $response;
	}

	$server->setClient($client);

	$user_phid = $auth_code->getUserPHID();
	$user = id(new PhabricatorUser())
	->loadOneWhere('phid = %s', $user_phid);
	if (!$user) {
	$response->setError('invalid_grant');
	$response->setErrorDescription(
	pht(
	'User with PHID %s not found.',
	$user_phid));
	return $response;
	}
	$server->setUser($user);

	$test_code = new PhabricatorOAuthServerAuthorizationCode();
	$test_code->setClientSecret($client_secret);
	$test_code->setClientPHID($client_phid);
	$is_good_code = $server->validateAuthorizationCode(
	$auth_code,
	$test_code);
	if (!$is_good_code) {
	$response->setError('invalid_grant');
	$response->setErrorDescription(
	pht(
	'Invalid authorization code %s.',
	$code));
	return $response;
	}

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$access_token = $server->generateAccessToken();
	$auth_code->delete();
	unset($unguarded);
	$result = array(
	'access_token' => $access_token->getToken(),
	'token_type' => 'Bearer',
	);
	return $response->setContent($result);
	} catch (Exception $e) {
	$response->setError('server_error');
	$response->setErrorDescription(
	pht(
	'The authorization server encountered an unexpected condition '.
	'which prevented it from fulfilling the request.'));
	return $response;
	}
	}

	}

File Metadata

Mime Type: text/x-php
Expires: Sun, Jan 19, 18:57 (1 d, 11 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1127618
Default Alt Text: PhabricatorOAuthServerTokenController.php (6 KB)

PhabricatorOAuthServerTokenController.phpNo OneTemporaryActions

PhabricatorOAuthServerTokenController.phpView Options

File Metadata

Event Timeline

PhabricatorOAuthServerTokenController.php
No OneTemporary
Actions

PhabricatorOAuthServerTokenController.php
View Options