Skip to content

Commit 7e748a8

Browse files
taylorotwelltaylorotwell
authored
Merge pull request #1112 from gdebrauwer/check-client-credentials-use-psr
[9.x] Use psr request attributes in 'check client credentials' middleware
2 parents 2bba0d6 + c829d03 commit 7e748a8

4 files changed

+56
-95
lines changed

‎src/Http/Middleware/CheckClientCredentials.php

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44

55
use Closure;
66
use Illuminate\Auth\AuthenticationException;
7+
use Laravel\Passport\ClientRepository;
78
use Laravel\Passport\Exceptions\MissingScopeException;
8-
use Laravel\Passport\TokenRepository;
99
use League\OAuth2\Server\Exception\OAuthServerException;
1010
use League\OAuth2\Server\ResourceServer;
1111
use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
@@ -24,20 +24,20 @@ class CheckClientCredentials
2424
protected $server;
2525

2626
/**
27-
* Token Repository.
27+
* Client Repository.
2828
*
29-
* @var \Laravel\Passport\TokenRepository
29+
* @var \Laravel\Passport\ClientRepository
3030
*/
3131
protected $repository;
3232

3333
/**
3434
* Create a new middleware instance.
3535
*
3636
* @param \League\OAuth2\Server\ResourceServer $server
37-
* @param \Laravel\Passport\TokenRepository $repository
37+
* @param \Laravel\Passport\ClientRepository $repository
3838
* @return void
3939
*/
40-
public function __construct(ResourceServer $server, TokenRepository $repository)
40+
public function __construct(ResourceServer $server, ClientRepository $repository)
4141
{
4242
$this->server = $server;
4343
$this->repository = $repository;
@@ -82,18 +82,18 @@ public function handle($request, Closure $next, ...$scopes)
8282
*/
8383
protected function validate($psr, $scopes)
8484
{
85-
$token = $this->repository->find($psr->getAttribute('oauth_access_token_id'));
85+
$client = $this->repository->find($psr->getAttribute('oauth_client_id'));
8686

87-
if (! $token || $token->client->firstParty()) {
87+
if (! $client || $client->firstParty()) {
8888
throw new AuthenticationException;
8989
}
9090

91-
if (in_array('*', $token->scopes)) {
91+
if (in_array('*', $tokenScopes = $psr->getAttribute('oauth_scopes'))) {
9292
return;
9393
}
9494

9595
foreach ($scopes as $scope) {
96-
if ($token->cant($scope)) {
96+
if (! in_array($scope, $tokenScopes)) {
9797
throw new MissingScopeException($scope);
9898
}
9999
}

‎src/Http/Middleware/CheckClientCredentialsForAnyScope.php

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44

55
use Closure;
66
use Illuminate\Auth\AuthenticationException;
7+
use Laravel\Passport\ClientRepository;
78
use Laravel\Passport\Exceptions\MissingScopeException;
8-
use Laravel\Passport\TokenRepository;
99
use League\OAuth2\Server\Exception\OAuthServerException;
1010
use League\OAuth2\Server\ResourceServer;
1111
use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
@@ -24,20 +24,20 @@ class CheckClientCredentialsForAnyScope
2424
protected $server;
2525

2626
/**
27-
* Token Repository.
27+
* Client Repository.
2828
*
29-
* @var \Laravel\Passport\TokenRepository
29+
* @var \Laravel\Passport\ClientRepository
3030
*/
3131
protected $repository;
3232

3333
/**
3434
* Create a new middleware instance.
3535
*
3636
* @param \League\OAuth2\Server\ResourceServer $server
37-
* @param \Laravel\Passport\TokenRepository $repository
37+
* @param \Laravel\Passport\ClientRepository $repository
3838
* @return void
3939
*/
40-
public function __construct(ResourceServer $server, TokenRepository $repository)
40+
public function __construct(ResourceServer $server, ClientRepository $repository)
4141
{
4242
$this->server = $server;
4343
$this->repository = $repository;
@@ -84,18 +84,18 @@ public function handle($request, Closure $next, ...$scopes)
8484
*/
8585
protected function validate($psr, $scopes)
8686
{
87-
$token = $this->repository->find($psr->getAttribute('oauth_access_token_id'));
87+
$client = $this->repository->find($psr->getAttribute('oauth_client_id'));
8888

89-
if (! $token || $token->client->firstParty()) {
89+
if (! $client || $client->firstParty()) {
9090
throw new AuthenticationException;
9191
}
9292

93-
if (in_array('*', $token->scopes)) {
93+
if (in_array('*', $tokenScopes = $psr->getAttribute('oauth_scopes'))) {
9494
return true;
9595
}
9696

9797
foreach ($scopes as $scope) {
98-
if ($token->can($scope)) {
98+
if (in_array($scope, $tokenScopes)) {
9999
return true;
100100
}
101101
}

‎tests/CheckClientCredentialsForAnyScopeTest.php

Lines changed: 19 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,8 @@
44

55
use Illuminate\Http\Request;
66
use Laravel\Passport\Client;
7+
use Laravel\Passport\ClientRepository;
78
use Laravel\Passport\Http\Middleware\CheckClientCredentialsForAnyScope;
8-
use Laravel\Passport\Token;
9-
use Laravel\Passport\TokenRepository;
109
use League\OAuth2\Server\Exception\OAuthServerException;
1110
use League\OAuth2\Server\ResourceServer;
1211
use Mockery as m;
@@ -24,21 +23,17 @@ public function test_request_is_passed_along_if_token_is_valid()
2423
$resourceServer = m::mock(ResourceServer::class);
2524
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
2625
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
27-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
26+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
2827
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
2928
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['*']);
3029

3130
$client = m::mock(Client::class);
3231
$client->shouldReceive('firstParty')->andReturnFalse();
3332

34-
$token = m::mock(Token::class);
35-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
36-
$token->shouldReceive('getAttribute')->with('scopes')->andReturn(['*']);
33+
$clientRepository = m::mock(ClientRepository::class);
34+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
3735

38-
$tokenRepository = m::mock(TokenRepository::class);
39-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
40-
41-
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $tokenRepository);
36+
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $clientRepository);
4237

4338
$request = Request::create('/');
4439
$request->headers->set('Authorization', 'Bearer token');
@@ -55,23 +50,17 @@ public function test_request_is_passed_along_if_token_has_any_required_scope()
5550
$resourceServer = m::mock(ResourceServer::class);
5651
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
5752
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
58-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
53+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
5954
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
6055
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['foo', 'bar', 'baz']);
6156

6257
$client = m::mock(Client::class);
6358
$client->shouldReceive('firstParty')->andReturnFalse();
6459

65-
$token = m::mock(Token::class);
66-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
67-
$token->shouldReceive('getAttribute')->with('scopes')->andReturn(['foo', 'bar', 'baz']);
68-
$token->shouldReceive('can')->with('notfoo')->andReturnFalse();
69-
$token->shouldReceive('can')->with('bar')->andReturnTrue();
70-
71-
$tokenRepository = m::mock(TokenRepository::class);
72-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
60+
$clientRepository = m::mock(ClientRepository::class);
61+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
7362

74-
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $tokenRepository);
63+
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $clientRepository);
7564

7665
$request = Request::create('/');
7766
$request->headers->set('Authorization', 'Bearer token');
@@ -88,13 +77,13 @@ public function test_request_is_passed_along_if_token_has_any_required_scope()
8877
*/
8978
public function test_exception_is_thrown_when_oauth_throws_exception()
9079
{
91-
$tokenRepository = m::mock(TokenRepository::class);
80+
$clientRepository = m::mock(ClientRepository::class);
9281
$resourceServer = m::mock(ResourceServer::class);
9382
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andThrow(
9483
new OAuthServerException('message', 500, 'error type')
9584
);
9685

97-
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $tokenRepository);
86+
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $clientRepository);
9887

9988
$request = Request::create('/');
10089
$request->headers->set('Authorization', 'Bearer token');
@@ -112,23 +101,17 @@ public function test_exception_is_thrown_if_token_does_not_have_required_scope()
112101
$resourceServer = m::mock(ResourceServer::class);
113102
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
114103
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
115-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
104+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
116105
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
117106
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['foo', 'bar']);
118107

119108
$client = m::mock(Client::class);
120109
$client->shouldReceive('firstParty')->andReturnFalse();
121110

122-
$token = m::mock(Token::class);
123-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
124-
$token->shouldReceive('getAttribute')->with('scopes')->andReturn(['foo', 'bar']);
125-
$token->shouldReceive('can')->with('baz')->andReturnFalse();
126-
$token->shouldReceive('can')->with('notbar')->andReturnFalse();
111+
$clientRepository = m::mock(ClientRepository::class);
112+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
127113

128-
$tokenRepository = m::mock(TokenRepository::class);
129-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
130-
131-
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $tokenRepository);
114+
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $clientRepository);
132115

133116
$request = Request::create('/');
134117
$request->headers->set('Authorization', 'Bearer token');
@@ -146,20 +129,17 @@ public function test_exception_is_thrown_if_token_belongs_to_first_party_client(
146129
$resourceServer = m::mock(ResourceServer::class);
147130
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
148131
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
149-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
132+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
150133
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
151134
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['*']);
152135

153136
$client = m::mock(Client::class);
154137
$client->shouldReceive('firstParty')->andReturnTrue();
155138

156-
$token = m::mock(Token::class);
157-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
158-
159-
$tokenRepository = m::mock(TokenRepository::class);
160-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
139+
$clientRepository = m::mock(ClientRepository::class);
140+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
161141

162-
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $tokenRepository);
142+
$middleware = new CheckClientCredentialsForAnyScope($resourceServer, $clientRepository);
163143

164144
$request = Request::create('/');
165145
$request->headers->set('Authorization', 'Bearer token');

‎tests/CheckClientCredentialsTest.php

Lines changed: 19 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,8 @@
44

55
use Illuminate\Http\Request;
66
use Laravel\Passport\Client;
7+
use Laravel\Passport\ClientRepository;
78
use Laravel\Passport\Http\Middleware\CheckClientCredentials;
8-
use Laravel\Passport\Token;
9-
use Laravel\Passport\TokenRepository;
109
use League\OAuth2\Server\Exception\OAuthServerException;
1110
use League\OAuth2\Server\ResourceServer;
1211
use Mockery as m;
@@ -24,21 +23,17 @@ public function test_request_is_passed_along_if_token_is_valid()
2423
$resourceServer = m::mock(ResourceServer::class);
2524
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
2625
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
27-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
26+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
2827
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
2928
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['*']);
3029

3130
$client = m::mock(Client::class);
3231
$client->shouldReceive('firstParty')->andReturnFalse();
3332

34-
$token = m::mock(Token::class);
35-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
36-
$token->shouldReceive('getAttribute')->with('scopes')->andReturn(['*']);
33+
$clientRepository = m::mock(ClientRepository::class);
34+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
3735

38-
$tokenRepository = m::mock(TokenRepository::class);
39-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
40-
41-
$middleware = new CheckClientCredentials($resourceServer, $tokenRepository);
36+
$middleware = new CheckClientCredentials($resourceServer, $clientRepository);
4237

4338
$request = Request::create('/');
4439
$request->headers->set('Authorization', 'Bearer token');
@@ -55,22 +50,17 @@ public function test_request_is_passed_along_if_token_and_scope_are_valid()
5550
$resourceServer = m::mock(ResourceServer::class);
5651
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
5752
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
58-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
53+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
5954
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
6055
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['see-profile']);
6156

6257
$client = m::mock(Client::class);
6358
$client->shouldReceive('firstParty')->andReturnFalse();
6459

65-
$token = m::mock(Token::class);
66-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
67-
$token->shouldReceive('getAttribute')->with('scopes')->andReturn(['see-profile']);
68-
$token->shouldReceive('cant')->with('see-profile')->andReturnFalse();
69-
70-
$tokenRepository = m::mock(TokenRepository::class);
71-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
60+
$clientRepository = m::mock(ClientRepository::class);
61+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
7262

73-
$middleware = new CheckClientCredentials($resourceServer, $tokenRepository);
63+
$middleware = new CheckClientCredentials($resourceServer, $clientRepository);
7464

7565
$request = Request::create('/');
7666
$request->headers->set('Authorization', 'Bearer token');
@@ -87,13 +77,13 @@ public function test_request_is_passed_along_if_token_and_scope_are_valid()
8777
*/
8878
public function test_exception_is_thrown_when_oauth_throws_exception()
8979
{
90-
$tokenRepository = m::mock(TokenRepository::class);
80+
$clientRepository = m::mock(ClientRepository::class);
9181
$resourceServer = m::mock(ResourceServer::class);
9282
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andThrow(
9383
new OAuthServerException('message', 500, 'error type')
9484
);
9585

96-
$middleware = new CheckClientCredentials($resourceServer, $tokenRepository);
86+
$middleware = new CheckClientCredentials($resourceServer, $clientRepository);
9787

9888
$request = Request::create('/');
9989
$request->headers->set('Authorization', 'Bearer token');
@@ -111,23 +101,17 @@ public function test_exception_is_thrown_if_token_does_not_have_required_scopes(
111101
$resourceServer = m::mock(ResourceServer::class);
112102
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
113103
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
114-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
104+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
115105
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
116106
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['foo', 'notbar']);
117107

118108
$client = m::mock(Client::class);
119109
$client->shouldReceive('firstParty')->andReturnFalse();
120110

121-
$token = m::mock(Token::class);
122-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
123-
$token->shouldReceive('getAttribute')->with('scopes')->andReturn(['foo', 'notbar']);
124-
$token->shouldReceive('cant')->with('foo')->andReturnFalse();
125-
$token->shouldReceive('cant')->with('bar')->andReturnTrue();
111+
$clientRepository = m::mock(ClientRepository::class);
112+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
126113

127-
$tokenRepository = m::mock(TokenRepository::class);
128-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
129-
130-
$middleware = new CheckClientCredentials($resourceServer, $tokenRepository);
114+
$middleware = new CheckClientCredentials($resourceServer, $clientRepository);
131115

132116
$request = Request::create('/');
133117
$request->headers->set('Authorization', 'Bearer token');
@@ -145,20 +129,17 @@ public function test_exception_is_thrown_if_token_belongs_to_first_party_client(
145129
$resourceServer = m::mock(ResourceServer::class);
146130
$resourceServer->shouldReceive('validateAuthenticatedRequest')->andReturn($psr = m::mock());
147131
$psr->shouldReceive('getAttribute')->with('oauth_user_id')->andReturn(1);
148-
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(1);
132+
$psr->shouldReceive('getAttribute')->with('oauth_client_id')->andReturn(2);
149133
$psr->shouldReceive('getAttribute')->with('oauth_access_token_id')->andReturn('token');
150134
$psr->shouldReceive('getAttribute')->with('oauth_scopes')->andReturn(['*']);
151135

152136
$client = m::mock(Client::class);
153137
$client->shouldReceive('firstParty')->andReturnTrue();
154138

155-
$token = m::mock(Token::class);
156-
$token->shouldReceive('getAttribute')->with('client')->andReturn($client);
157-
158-
$tokenRepository = m::mock(TokenRepository::class);
159-
$tokenRepository->shouldReceive('find')->with('token')->andReturn($token);
139+
$clientRepository = m::mock(ClientRepository::class);
140+
$clientRepository->shouldReceive('find')->with(2)->andReturn($client);
160141

161-
$middleware = new CheckClientCredentials($resourceServer, $tokenRepository);
142+
$middleware = new CheckClientCredentials($resourceServer, $clientRepository);
162143

163144
$request = Request::create('/');
164145
$request->headers->set('Authorization', 'Bearer token');

0 commit comments

Comments
 (0)