1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
|
<?php
namespace MediaWiki\Extensions\OAuth\Entity;
use Exception;
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\Entities\ScopeEntityInterface;
use League\OAuth2\Server\Exception\OAuthServerException;
use MediaWiki\Extensions\OAuth\Backend\Consumer;
use MediaWiki\Extensions\OAuth\Backend\ConsumerAcceptance;
use MediaWiki\Extensions\OAuth\Backend\MWOAuthException;
use MediaWiki\Extensions\OAuth\Backend\Utils;
use MediaWiki\Extensions\OAuth\Repository\AccessTokenRepository;
use MWException;
use User;
class ClientEntity extends Consumer implements ClientEntityInterface {
/**
* Returns the registered redirect URI (as a string).
*
* Alternatively return an indexed array of redirect URIs.
*
* @return string|string[]
*/
public function getRedirectUri() {
return $this->getCallbackUrl();
}
/**
* Returns true if the client is confidential.
*
* @return bool
*/
public function isConfidential() {
return $this->oauth2IsConfidential;
}
/**
* @return mixed
*/
public function getIdentifier() {
return $this->getConsumerKey();
}
/**
* @param mixed $identifier
*/
public function setIdentifier( $identifier ) {
$this->consumerKey = $identifier;
}
/**
* Get the grant types this client is allowed to use
*
* @return array
*/
public function getAllowedGrants() {
return $this->oauth2GrantTypes;
}
/**
* Convenience function, same as getGrants()
* it just returns array of ScopeEntity-es instead of strings
*
* @return ScopeEntityInterface[]
*/
public function getScopes() {
$scopeEntities = [];
foreach ( $this->getGrants() as $grant ) {
$scopeEntities[] = new ScopeEntity( $grant );
}
return $scopeEntities;
}
/**
* @return bool|User
* @throws MWException
*/
public function getUser() {
return Utils::getLocalUserFromCentralId( $this->getUserId() );
}
/**
* @param null|string $secret
* @param null|string $grantType
* @return bool
*/
public function validate( $secret, $grantType ) {
if ( !$this->isSecretValid( $secret ) ) {
return false;
}
if ( !$this->isGrantAllowed( $grantType ) ) {
return false;
}
return true;
}
/**
* @return int
*/
public function getOAuthVersion() {
return static::OAUTH_VERSION_2;
}
private function isSecretValid( $secret ) {
return hash_equals( $secret, Utils::hmacDBSecret( $this->secretKey ) );
}
/**
* @param string $grantType
* @return bool
*/
public function isGrantAllowed( $grantType ) {
return in_array( $grantType, $this->getAllowedGrants() );
}
/**
* @param User $mwUser
* @param bool $update
* @param array $grants
* @param null $requestTokenKey
* @return bool
* @throws MWException
* @throws MWOAuthException
*/
public function authorize( User $mwUser, $update, $grants, $requestTokenKey = null ) {
$this->conductAuthorizationChecks( $mwUser );
$grants = $this->getVerifiedScopes( $grants );
$this->saveAuthorization( $mwUser, $update, $grants );
return true;
}
/**
* Get the access token to be used with a single user
* Should never be called outside of client registration/manage code
*
* @param ConsumerAcceptance $approval
* @param bool $revokeExisting - Delete all existing tokens
*
* @return AccessTokenEntityInterface
* @throws MWOAuthException
* @throws OAuthServerException
* @throws Exception
*/
public function getOwnerOnlyAccessToken(
ConsumerAcceptance $approval, $revokeExisting = false
) {
if (
count( $this->getAllowedGrants() ) !== 1 ||
$this->getAllowedGrants()[0] !== 'client_credentials'
) {
// sanity - make sure client is allowed *only* client_credentials grant,
// so that this AT cannot be used in other grant type requests
throw new MWOAuthException( 'mwoauth-oauth2-error-owner-only-invalid-grant' );
}
$accessToken = null;
$accessTokenRepo = new AccessTokenRepository();
if ( $revokeExisting ) {
$accessTokenRepo->deleteForApprovalId( $approval->getId() );
}
/** @var AccessTokenEntity $accessToken */
$accessToken = $accessTokenRepo->getNewToken( $this, $this->getScopes(), $approval->getUserId() );
'@phan-var AccessTokenEntity $accessToken';
$accessToken->setExpiryDateTime( ( new \DateTimeImmutable() )->add(
new \DateInterval( 'P292277000000Y' )
) );
$accessToken->setPrivateKeyFromConfig();
$accessToken->setIdentifier( bin2hex( random_bytes( 40 ) ) );
$accessTokenRepo->persistNewAccessToken( $accessToken );
return $accessToken;
}
/**
* Filter out scopes that application cannot use
*
* @param array $requested
* @return array
*/
private function getVerifiedScopes( $requested ) {
return array_intersect( $requested, $this->getGrants() );
}
}
|
GitWeb