vendor/league/oauth2-server/src/Grant/RefreshTokenGrant.php line 79

  1. <?php
  2. /**
  3.  * OAuth 2.0 Refresh token grant.
  4.  *
  5.  * @author      Alex Bilbie <hello@alexbilbie.com>
  6.  * @copyright   Copyright (c) Alex Bilbie
  7.  * @license     http://mit-license.org/
  8.  *
  9.  * @link        https://github.com/thephpleague/oauth2-server
  10.  */
  12. namespace League\OAuth2\Server\Grant;
  14. use DateInterval;
  15. use Exception;
  16. use League\OAuth2\Server\Exception\OAuthServerException;
  17. use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
  18. use League\OAuth2\Server\RequestAccessTokenEvent;
  19. use League\OAuth2\Server\RequestEvent;
  20. use League\OAuth2\Server\RequestRefreshTokenEvent;
  21. use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
  22. use Psr\Http\Message\ServerRequestInterface;
  24. /**
  25.  * Refresh token grant.
  26.  */
  27. class RefreshTokenGrant extends AbstractGrant
  28. {
  29.     /**
  30.      * @param RefreshTokenRepositoryInterface $refreshTokenRepository
  31.      */
  32.     public function __construct(RefreshTokenRepositoryInterface $refreshTokenRepository)
  33.     {
  34.         $this->setRefreshTokenRepository($refreshTokenRepository);
  36.         $this->refreshTokenTTL = new DateInterval('P1M');
  37.     }
  39.     /**
  40.      * {@inheritdoc}
  41.      */
  42.     public function respondToAccessTokenRequest(
  43.         ServerRequestInterface $request,
  44.         ResponseTypeInterface $responseType,
  45.         DateInterval $accessTokenTTL
  46.     ) {
  47.         // Validate request
  48.         $client = $this->validateClient($request);
  49.         $oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier());
  50.         $scopes = $this->validateScopes(
  51.             $this->getRequestParameter(
  52.                 'scope',
  53.                 $request,
  54.                 \implode(self::SCOPE_DELIMITER_STRING, $oldRefreshToken['scopes'])
  55.             )
  56.         );
  58.         // The OAuth spec says that a refreshed access token can have the original scopes or fewer so ensure
  59.         // the request doesn't include any new scopes
  60.         foreach ($scopes as $scope) {
  61.             if (\in_array($scope->getIdentifier(), $oldRefreshToken['scopes'], true) === false) {
  62.                 throw OAuthServerException::invalidScope($scope->getIdentifier());
  63.             }
  64.         }
  66.         // Expire old tokens
  67.         $this->accessTokenRepository->revokeAccessToken($oldRefreshToken['access_token_id']);
  68.         if ($this->revokeRefreshTokens) {
  69.             $this->refreshTokenRepository->revokeRefreshToken($oldRefreshToken['refresh_token_id']);
  70.         }
  72.         // Issue and persist new access token
  73.         $accessToken = $this->issueAccessToken($accessTokenTTL, $client, $oldRefreshToken['user_id'], $scopes);
  74.         $this->getEmitter()->emit(new RequestAccessTokenEvent(RequestEvent::ACCESS_TOKEN_ISSUED, $request, $accessToken));
  75.         $responseType->setAccessToken($accessToken);
  77.         // Issue and persist new refresh token if given
  78.         if ($this->revokeRefreshTokens) {
  79.             $refreshToken = $this->issueRefreshToken($accessToken);
  81.             if ($refreshToken !== null) {
  82.                 $this->getEmitter()->emit(new RequestRefreshTokenEvent(RequestEvent::REFRESH_TOKEN_ISSUED, $request, $refreshToken));
  83.                 $responseType->setRefreshToken($refreshToken);
  84.             }
  85.         }
  87.         return $responseType;
  88.     }
  90.     /**
  91.      * @param ServerRequestInterface $request
  92.      * @param string                 $clientId
  93.      *
  94.      * @throws OAuthServerException
  95.      *
  96.      * @return array
  97.      */
  98.     protected function validateOldRefreshToken(ServerRequestInterface $request, $clientId)
  99.     {
  100.         $encryptedRefreshToken = $this->getRequestParameter('refresh_token', $request);
  101.         if (!\is_string($encryptedRefreshToken)) {
  102.             throw OAuthServerException::invalidRequest('refresh_token');
  103.         }
  105.         // Validate refresh token
  106.         try {
  107.             $refreshToken = $this->decrypt($encryptedRefreshToken);
  108.         } catch (Exception $e) {
  109.             throw OAuthServerException::invalidRefreshToken('Cannot decrypt the refresh token', $e);
  110.         }
  112.         $refreshTokenData = \json_decode($refreshToken, true);
  113.         if ($refreshTokenData['client_id'] !== $clientId) {
  114.             $this->getEmitter()->emit(new RequestEvent(RequestEvent::REFRESH_TOKEN_CLIENT_FAILED, $request));
  115.             throw OAuthServerException::invalidRefreshToken('Token is not linked to client');
  116.         }
  118.         if ($refreshTokenData['expire_time'] < \time()) {
  119.             throw OAuthServerException::invalidRefreshToken('Token has expired');
  120.         }
  122.         if ($this->refreshTokenRepository->isRefreshTokenRevoked($refreshTokenData['refresh_token_id']) === true) {
  123.             throw OAuthServerException::invalidRefreshToken('Token has been revoked');
  124.         }
  126.         return $refreshTokenData;
  127.     }
  129.     /**
  130.      * {@inheritdoc}
  131.      */
  132.     public function getIdentifier()
  133.     {
  134.         return 'refresh_token';
  135.     }
  136. }