| @@ -14,21 +14,21 @@ | ||
| 14 | 14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | 15 | * See the License for the specific language governing permissions and |
| 16 | 16 | * limitations under the License. |
| 17 | 17 | */ |
| 18 | -namespace Dudlewebs\WPMCS\Google\Auth; | |
| 18 | +namespace Dudlewebs\WPMCS\GCP\Google\Auth; | |
| 19 | 19 | |
| 20 | -use Dudlewebs\WPMCS\Firebase\JWT\JWT; | |
| 21 | -use Dudlewebs\WPMCS\Firebase\JWT\Key; | |
| 22 | -use Dudlewebs\WPMCS\Google\Auth\HttpHandler\HttpClientCache; | |
| 23 | -use Dudlewebs\WPMCS\Google\Auth\HttpHandler\HttpHandlerFactory; | |
| 24 | -use Dudlewebs\WPMCS\GuzzleHttp\Psr7\Query; | |
| 25 | -use Dudlewebs\WPMCS\GuzzleHttp\Psr7\Request; | |
| 26 | -use Dudlewebs\WPMCS\GuzzleHttp\Psr7\Utils; | |
| 20 | +use Dudlewebs\WPMCS\GCP\Firebase\JWT\JWT; | |
| 21 | +use Dudlewebs\WPMCS\GCP\Firebase\JWT\Key; | |
| 22 | +use Dudlewebs\WPMCS\GCP\Google\Auth\HttpHandler\HttpClientCache; | |
| 23 | +use Dudlewebs\WPMCS\GCP\Google\Auth\HttpHandler\HttpHandlerFactory; | |
| 24 | +use Dudlewebs\WPMCS\GCP\GuzzleHttp\Psr7\Query; | |
| 25 | +use Dudlewebs\WPMCS\GCP\GuzzleHttp\Psr7\Request; | |
| 26 | +use Dudlewebs\WPMCS\GCP\GuzzleHttp\Psr7\Utils; | |
| 27 | 27 | use InvalidArgumentException; |
| 28 | -use Dudlewebs\WPMCS\Psr\Http\Message\RequestInterface; | |
| 29 | -use Dudlewebs\WPMCS\Psr\Http\Message\ResponseInterface; | |
| 30 | -use Dudlewebs\WPMCS\Psr\Http\Message\UriInterface; | |
| 28 | +use Dudlewebs\WPMCS\GCP\Psr\Http\Message\RequestInterface; | |
| 29 | +use Dudlewebs\WPMCS\GCP\Psr\Http\Message\ResponseInterface; | |
| 30 | +use Dudlewebs\WPMCS\GCP\Psr\Http\Message\UriInterface; | |
| 31 | 31 | /** |
| 32 | 32 | * OAuth2 supports authentication by OAuth2 2-legged flows. |
| 33 | 33 | * |
| 34 | 34 | * It primary supports |
| @@ -373,9 +373,9 @@ | ||
| 373 | 373 | * @param array<mixed> $config Configuration array |
| 374 | 374 | */ |
| 375 | 375 | public function __construct(array $config) |
| 376 | 376 | { |
| 377 | - $opts = array_merge(['expiry' => self::DEFAULT_EXPIRY_SECONDS, 'extensionParams' => [], 'authorizationUri' => null, 'redirectUri' => null, 'tokenCredentialUri' => null, 'state' => null, 'username' => null, 'password' => null, 'clientId' => null, 'clientSecret' => null, 'issuer' => null, 'sub' => null, 'audience' => null, 'signingKey' => null, 'signingKeyId' => null, 'signingAlgorithm' => null, 'scope' => null, 'additionalClaims' => [], 'codeVerifier' => null, 'resource' => null, 'subjectTokenFetcher' => null, 'subjectTokenType' => null, 'actorToken' => null, 'actorTokenType' => null, 'additionalOptions' => []], $config); | |
| 377 | + $opts = \array_merge(['expiry' => self::DEFAULT_EXPIRY_SECONDS, 'extensionParams' => [], 'authorizationUri' => null, 'redirectUri' => null, 'tokenCredentialUri' => null, 'state' => null, 'username' => null, 'password' => null, 'clientId' => null, 'clientSecret' => null, 'issuer' => null, 'sub' => null, 'audience' => null, 'signingKey' => null, 'signingKeyId' => null, 'signingAlgorithm' => null, 'scope' => null, 'additionalClaims' => [], 'codeVerifier' => null, 'resource' => null, 'subjectTokenFetcher' => null, 'subjectTokenType' => null, 'actorToken' => null, 'actorTokenType' => null, 'additionalOptions' => []], $config); | |
| 378 | 378 | $this->setAuthorizationUri($opts['authorizationUri']); |
| 379 | 379 | $this->setRedirectUri($opts['redirectUri']); |
| 380 | 380 | $this->setTokenCredentialUri($opts['tokenCredentialUri']); |
| 381 | 381 | $this->setState($opts['state']); |
| @@ -430,13 +430,13 @@ | ||
| 430 | 430 | */ |
| 431 | 431 | public function verifyIdToken($publicKey = null, $allowed_algs = []) |
| 432 | 432 | { |
| 433 | 433 | $idToken = $this->getIdToken(); |
| 434 | - if (is_null($idToken)) { | |
| 434 | + if (\is_null($idToken)) { | |
| 435 | 435 | return null; |
| 436 | 436 | } |
| 437 | 437 | $resp = $this->jwtDecode($idToken, $publicKey, $allowed_algs); |
| 438 | - if (!property_exists($resp, 'aud')) { | |
| 438 | + if (!\property_exists($resp, 'aud')) { | |
| 439 | 439 | throw new \DomainException('No audience found the id token'); |
| 440 | 440 | } |
| 441 | 441 | if ($resp->aud != $this->getAudience()) { |
| 442 | 442 | throw new \DomainException('Wrong audience present in the id token'); |
| @@ -450,32 +450,32 @@ | ||
| 450 | 450 | * @return string |
| 451 | 451 | */ |
| 452 | 452 | public function toJwt(array $config = []) |
| 453 | 453 | { |
| 454 | - if (is_null($this->getSigningKey())) { | |
| 454 | + if (\is_null($this->getSigningKey())) { | |
| 455 | 455 | throw new \DomainException('No signing key available'); |
| 456 | 456 | } |
| 457 | - if (is_null($this->getSigningAlgorithm())) { | |
| 457 | + if (\is_null($this->getSigningAlgorithm())) { | |
| 458 | 458 | throw new \DomainException('No signing algorithm specified'); |
| 459 | 459 | } |
| 460 | - $now = time(); | |
| 461 | - $opts = array_merge(['skew' => self::DEFAULT_SKEW_SECONDS], $config); | |
| 460 | + $now = \time(); | |
| 461 | + $opts = \array_merge(['skew' => self::DEFAULT_SKEW_SECONDS], $config); | |
| 462 | 462 | $assertion = ['iss' => $this->getIssuer(), 'exp' => $now + $this->getExpiry(), 'iat' => $now - $opts['skew']]; |
| 463 | 463 | foreach ($assertion as $k => $v) { |
| 464 | - if (is_null($v)) { | |
| 464 | + if (\is_null($v)) { | |
| 465 | 465 | throw new \DomainException($k . ' should not be null'); |
| 466 | 466 | } |
| 467 | 467 | } |
| 468 | - if (!is_null($this->getAudience())) { | |
| 468 | + if (!\is_null($this->getAudience())) { | |
| 469 | 469 | $assertion['aud'] = $this->getAudience(); |
| 470 | 470 | } |
| 471 | - if (!is_null($this->getScope())) { | |
| 471 | + if (!\is_null($this->getScope())) { | |
| 472 | 472 | $assertion['scope'] = $this->getScope(); |
| 473 | 473 | } |
| 474 | 474 | if (empty($assertion['scope']) && empty($assertion['aud'])) { |
| 475 | 475 | throw new \DomainException('one of scope or aud should not be null'); |
| 476 | 476 | } |
| 477 | - if (!is_null($this->getSub())) { | |
| 477 | + if (!\is_null($this->getSub())) { | |
| 478 | 478 | $assertion['sub'] = $this->getSub(); |
| 479 | 479 | } |
| 480 | 480 | $assertion += $this->getAdditionalClaims(); |
| 481 | 481 | return JWT::encode($assertion, $this->getSigningKey(), $this->getSigningAlgorithm(), $this->getSigningKeyId()); |
| @@ -482,15 +482,17 @@ | ||
| 482 | 482 | } |
| 483 | 483 | /** |
| 484 | 484 | * Generates a request for token credentials. |
| 485 | 485 | * |
| 486 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 486 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 487 | + * @param array<mixed> $headers [optional] Additional headers to pass to | |
| 488 | + * the token endpoint request. | |
| 487 | 489 | * @return RequestInterface the authorization Url. |
| 488 | 490 | */ |
| 489 | - public function generateCredentialsRequest(callable $httpHandler = null) | |
| 491 | + public function generateCredentialsRequest(?callable $httpHandler = null, array $headers = []) | |
| 490 | 492 | { |
| 491 | 493 | $uri = $this->getTokenCredentialUri(); |
| 492 | - if (is_null($uri)) { | |
| 494 | + if (\is_null($uri)) { | |
| 493 | 495 | throw new \DomainException('No token credential URI was set.'); |
| 494 | 496 | } |
| 495 | 497 | $grantType = $this->getGrantType(); |
| 496 | 498 | $params = ['grant_type' => $grantType]; |
| @@ -509,8 +511,11 @@ | ||
| 509 | 511 | $this->addClientCredentials($params); |
| 510 | 512 | break; |
| 511 | 513 | case 'refresh_token': |
| 512 | 514 | $params['refresh_token'] = $this->getRefreshToken(); |
| 515 | + if (isset($this->getAdditionalClaims()['target_audience'])) { | |
| 516 | + $params['target_audience'] = $this->getAdditionalClaims()['target_audience']; | |
| 517 | + } | |
| 513 | 518 | $this->addClientCredentials($params); |
| 514 | 519 | break; |
| 515 | 520 | case self::JWT_URN: |
| 516 | 521 | $params['assertion'] = $this->toJwt(); |
| @@ -518,40 +523,42 @@ | ||
| 518 | 523 | case self::STS_URN: |
| 519 | 524 | $token = $this->subjectTokenFetcher->fetchSubjectToken($httpHandler); |
| 520 | 525 | $params['subject_token'] = $token; |
| 521 | 526 | $params['subject_token_type'] = $this->subjectTokenType; |
| 522 | - $params += array_filter(['resource' => $this->resource, 'audience' => $this->audience, 'scope' => $this->getScope(), 'requested_token_type' => self::STS_REQUESTED_TOKEN_TYPE, 'actor_token' => $this->actorToken, 'actor_token_type' => $this->actorTokenType]); | |
| 527 | + $params += \array_filter(['resource' => $this->resource, 'audience' => $this->audience, 'scope' => $this->getScope(), 'requested_token_type' => self::STS_REQUESTED_TOKEN_TYPE, 'actor_token' => $this->actorToken, 'actor_token_type' => $this->actorTokenType]); | |
| 523 | 528 | if ($this->additionalOptions) { |
| 524 | - $params['options'] = json_encode($this->additionalOptions); | |
| 529 | + $params['options'] = \json_encode($this->additionalOptions); | |
| 525 | 530 | } |
| 526 | 531 | break; |
| 527 | 532 | default: |
| 528 | - if (!is_null($this->getRedirectUri())) { | |
| 533 | + if (!\is_null($this->getRedirectUri())) { | |
| 529 | 534 | # Grant type was supposed to be 'authorization_code', as there |
| 530 | 535 | # is a redirect URI. |
| 531 | 536 | throw new \DomainException('Missing authorization code'); |
| 532 | 537 | } |
| 533 | 538 | unset($params['grant_type']); |
| 534 | - if (!is_null($grantType)) { | |
| 539 | + if (!\is_null($grantType)) { | |
| 535 | 540 | $params['grant_type'] = $grantType; |
| 536 | 541 | } |
| 537 | - $params = array_merge($params, $this->getExtensionParams()); | |
| 542 | + $params = \array_merge($params, $this->getExtensionParams()); | |
| 538 | 543 | } |
| 539 | - $headers = ['Cache-Control' => 'no-store', 'Content-Type' => 'application/x-www-form-urlencoded']; | |
| 544 | + $headers = ['Cache-Control' => 'no-store', 'Content-Type' => 'application/x-www-form-urlencoded'] + $headers; | |
| 540 | 545 | return new Request('POST', $uri, $headers, Query::build($params)); |
| 541 | 546 | } |
| 542 | 547 | /** |
| 543 | 548 | * Fetches the auth tokens based on the current state. |
| 544 | 549 | * |
| 545 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 550 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 551 | + * @param array<mixed> $headers [optional] If present, add these headers to the token | |
| 552 | + * endpoint request. | |
| 546 | 553 | * @return array<mixed> the response |
| 547 | 554 | */ |
| 548 | - public function fetchAuthToken(callable $httpHandler = null) | |
| 555 | + public function fetchAuthToken(?callable $httpHandler = null, array $headers = []) | |
| 549 | 556 | { |
| 550 | - if (is_null($httpHandler)) { | |
| 557 | + if (\is_null($httpHandler)) { | |
| 551 | 558 | $httpHandler = HttpHandlerFactory::build(HttpClientCache::getHttpClient()); |
| 552 | 559 | } |
| 553 | - $response = $httpHandler($this->generateCredentialsRequest($httpHandler)); | |
| 560 | + $response = $httpHandler($this->generateCredentialsRequest($httpHandler, $headers)); | |
| 554 | 561 | $credentials = $this->parseTokenResponse($response); |
| 555 | 562 | $this->updateToken($credentials); |
| 556 | 563 | if (isset($credentials['scope'])) { |
| 557 | 564 | $this->setGrantedScope($credentials['scope']); |
| @@ -558,8 +565,10 @@ | ||
| 558 | 565 | } |
| 559 | 566 | return $credentials; |
| 560 | 567 | } |
| 561 | 568 | /** |
| 569 | + * @deprecated | |
| 570 | + * | |
| 562 | 571 | * Obtains a key that can used to cache the results of #fetchAuthToken. |
| 563 | 572 | * |
| 564 | 573 | * The key is derived from the scopes. |
| 565 | 574 | * |
| @@ -566,10 +575,10 @@ | ||
| 566 | 575 | * @return ?string a key that may be used to cache the auth token. |
| 567 | 576 | */ |
| 568 | 577 | public function getCacheKey() |
| 569 | 578 | { |
| 570 | - if (is_array($this->scope)) { | |
| 571 | - return implode(':', $this->scope); | |
| 579 | + if (\is_array($this->scope)) { | |
| 580 | + return \implode(':', $this->scope); | |
| 572 | 581 | } |
| 573 | 582 | if ($this->audience) { |
| 574 | 583 | return $this->audience; |
| 575 | 584 | } |
| @@ -576,8 +585,17 @@ | ||
| 576 | 585 | // If scope has not set, return null to indicate no caching. |
| 577 | 586 | return null; |
| 578 | 587 | } |
| 579 | 588 | /** |
| 589 | + * Gets this instance's SubjectTokenFetcher | |
| 590 | + * | |
| 591 | + * @return null|ExternalAccountCredentialSourceInterface | |
| 592 | + */ | |
| 593 | + public function getSubjectTokenFetcher() : ?ExternalAccountCredentialSourceInterface | |
| 594 | + { | |
| 595 | + return $this->subjectTokenFetcher; | |
| 596 | + } | |
| 597 | + /** | |
| 580 | 598 | * Parses the fetched tokens. |
| 581 | 599 | * |
| 582 | 600 | * @param ResponseInterface $resp the response. |
| 583 | 601 | * @return array<mixed> the tokens parsed from the response body. |
| @@ -587,13 +605,13 @@ | ||
| 587 | 605 | { |
| 588 | 606 | $body = (string) $resp->getBody(); |
| 589 | 607 | if ($resp->hasHeader('Content-Type') && $resp->getHeaderLine('Content-Type') == 'application/x-www-form-urlencoded') { |
| 590 | 608 | $res = []; |
| 591 | - parse_str($body, $res); | |
| 609 | + \parse_str($body, $res); | |
| 592 | 610 | return $res; |
| 593 | 611 | } |
| 594 | 612 | // Assume it's JSON; if it's not throw an exception |
| 595 | - if (null === $res = json_decode($body, \true)) { | |
| 613 | + if (null === ($res = \json_decode($body, \true))) { | |
| 596 | 614 | throw new \Exception('Invalid JSON response'); |
| 597 | 615 | } |
| 598 | 616 | return $res; |
| 599 | 617 | } |
| @@ -633,14 +651,14 @@ | ||
| 633 | 651 | * @return void |
| 634 | 652 | */ |
| 635 | 653 | public function updateToken(array $config) |
| 636 | 654 | { |
| 637 | - $opts = array_merge(['extensionParams' => [], 'access_token' => null, 'id_token' => null, 'expires_in' => null, 'expires_at' => null, 'issued_at' => null, 'scope' => null], $config); | |
| 655 | + $opts = \array_merge(['extensionParams' => [], 'access_token' => null, 'id_token' => null, 'expires_in' => null, 'expires_at' => null, 'issued_at' => null, 'scope' => null], $config); | |
| 638 | 656 | $this->setExpiresAt($opts['expires_at']); |
| 639 | 657 | $this->setExpiresIn($opts['expires_in']); |
| 640 | 658 | // By default, the token is issued at `Time.now` when `expiresIn` is set, |
| 641 | 659 | // but this can be used to supply a more precise time. |
| 642 | - if (!is_null($opts['issued_at'])) { | |
| 660 | + if (!\is_null($opts['issued_at'])) { | |
| 643 | 661 | $this->setIssuedAt($opts['issued_at']); |
| 644 | 662 | } |
| 645 | 663 | $this->setAccessToken($opts['access_token']); |
| 646 | 664 | $this->setIdToken($opts['id_token']); |
| @@ -646,14 +664,14 @@ | ||
| 646 | 664 | $this->setIdToken($opts['id_token']); |
| 647 | 665 | // The refresh token should only be updated if a value is explicitly |
| 648 | 666 | // passed in, as some access token responses do not include a refresh |
| 649 | 667 | // token. |
| 650 | - if (array_key_exists('refresh_token', $opts)) { | |
| 668 | + if (\array_key_exists('refresh_token', $opts)) { | |
| 651 | 669 | $this->setRefreshToken($opts['refresh_token']); |
| 652 | 670 | } |
| 653 | 671 | // Required for STS response. An identifier for the representation of |
| 654 | 672 | // the issued security token. |
| 655 | - if (array_key_exists('issued_token_type', $opts)) { | |
| 673 | + if (\array_key_exists('issued_token_type', $opts)) { | |
| 656 | 674 | $this->issuedTokenType = $opts['issued_token_type']; |
| 657 | 675 | } |
| 658 | 676 | } |
| 659 | 677 | /** |
| @@ -664,17 +682,17 @@ | ||
| 664 | 682 | * @throws InvalidArgumentException |
| 665 | 683 | */ |
| 666 | 684 | public function buildFullAuthorizationUri(array $config = []) |
| 667 | 685 | { |
| 668 | - if (is_null($this->getAuthorizationUri())) { | |
| 686 | + if (\is_null($this->getAuthorizationUri())) { | |
| 669 | 687 | throw new InvalidArgumentException('requires an authorizationUri to have been set'); |
| 670 | 688 | } |
| 671 | - $params = array_merge(['response_type' => 'code', 'access_type' => 'offline', 'client_id' => $this->clientId, 'redirect_uri' => $this->redirectUri, 'state' => $this->state, 'scope' => $this->getScope()], $config); | |
| 689 | + $params = \array_merge(['response_type' => 'code', 'access_type' => 'offline', 'client_id' => $this->clientId, 'redirect_uri' => $this->redirectUri, 'state' => $this->state, 'scope' => $this->getScope()], $config); | |
| 672 | 690 | // Validate the auth_params |
| 673 | - if (is_null($params['client_id'])) { | |
| 691 | + if (\is_null($params['client_id'])) { | |
| 674 | 692 | throw new InvalidArgumentException('missing the required client identifier'); |
| 675 | 693 | } |
| 676 | - if (is_null($params['redirect_uri'])) { | |
| 694 | + if (\is_null($params['redirect_uri'])) { | |
| 677 | 695 | throw new InvalidArgumentException('missing the required redirect URI'); |
| 678 | 696 | } |
| 679 | 697 | if (!empty($params['prompt']) && !empty($params['approval_prompt'])) { |
| 680 | 698 | throw new InvalidArgumentException('prompt and approval_prompt are mutually exclusive'); |
| @@ -685,9 +703,9 @@ | ||
| 685 | 703 | } |
| 686 | 704 | // Construct the uri object; return it if it is valid. |
| 687 | 705 | $result = clone $this->authorizationUri; |
| 688 | 706 | $existingParams = Query::parse($result->getQuery()); |
| 689 | - $result = $result->withQuery(Query::build(array_merge($existingParams, $params))); | |
| 707 | + $result = $result->withQuery(Query::build(\array_merge($existingParams, $params))); | |
| 690 | 708 | if ($result->getScheme() != 'https') { |
| 691 | 709 | throw new InvalidArgumentException('Authorization endpoint must be protected by TLS'); |
| 692 | 710 | } |
| 693 | 711 | return $result; |
| @@ -694,9 +712,9 @@ | ||
| 694 | 712 | } |
| 695 | 713 | /** |
| 696 | 714 | * @return string|null |
| 697 | 715 | */ |
| 698 | - public function getCodeVerifier(): ?string | |
| 716 | + public function getCodeVerifier() : ?string | |
| 699 | 717 | { |
| 700 | 718 | return $this->codeVerifier; |
| 701 | 719 | } |
| 702 | 720 | /** |
| @@ -710,9 +728,9 @@ | ||
| 710 | 728 | * @see https://datatracker.ietf.org/doc/html/rfc7636 |
| 711 | 729 | * |
| 712 | 730 | * @param string|null $codeVerifier |
| 713 | 731 | */ |
| 714 | - public function setCodeVerifier(?string $codeVerifier): void | |
| 732 | + public function setCodeVerifier(?string $codeVerifier) : void | |
| 715 | 733 | { |
| 716 | 734 | $this->codeVerifier = $codeVerifier; |
| 717 | 735 | } |
| 718 | 736 | /** |
| @@ -724,28 +742,28 @@ | ||
| 724 | 742 | * When this method is called, the code verifier is set on the object. |
| 725 | 743 | * |
| 726 | 744 | * @return string |
| 727 | 745 | */ |
| 728 | - public function generateCodeVerifier(): string | |
| 746 | + public function generateCodeVerifier() : string | |
| 729 | 747 | { |
| 730 | 748 | return $this->codeVerifier = $this->generateRandomString(128); |
| 731 | 749 | } |
| 732 | - private function getCodeChallenge(string $randomString): string | |
| 750 | + private function getCodeChallenge(string $randomString) : string | |
| 733 | 751 | { |
| 734 | - return rtrim(strtr(base64_encode(hash('sha256', $randomString, \true)), '+/', '-_'), '='); | |
| 752 | + return \rtrim(\strtr(\base64_encode(\hash('sha256', $randomString, \true)), '+/', '-_'), '='); | |
| 735 | 753 | } |
| 736 | - private function getCodeChallengeMethod(): string | |
| 754 | + private function getCodeChallengeMethod() : string | |
| 737 | 755 | { |
| 738 | 756 | return 'S256'; |
| 739 | 757 | } |
| 740 | - private function generateRandomString(int $length): string | |
| 758 | + private function generateRandomString(int $length) : string | |
| 741 | 759 | { |
| 742 | 760 | $validChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'; |
| 743 | - $validCharsLen = strlen($validChars); | |
| 761 | + $validCharsLen = \strlen($validChars); | |
| 744 | 762 | $str = ''; |
| 745 | 763 | $i = 0; |
| 746 | 764 | while ($i++ < $length) { |
| 747 | - $str .= $validChars[random_int(0, $validCharsLen - 1)]; | |
| 765 | + $str .= $validChars[\random_int(0, $validCharsLen - 1)]; | |
| 748 | 766 | } |
| 749 | 767 | return $str; |
| 750 | 768 | } |
| 751 | 769 | /** |
| @@ -806,9 +824,9 @@ | ||
| 806 | 824 | * @return void |
| 807 | 825 | */ |
| 808 | 826 | public function setRedirectUri($uri) |
| 809 | 827 | { |
| 810 | - if (is_null($uri)) { | |
| 828 | + if (\is_null($uri)) { | |
| 811 | 829 | $this->redirectUri = null; |
| 812 | 830 | return; |
| 813 | 831 | } |
| 814 | 832 | // redirect URI must be absolute |
| @@ -827,14 +845,23 @@ | ||
| 827 | 845 | * @return ?string |
| 828 | 846 | */ |
| 829 | 847 | public function getScope() |
| 830 | 848 | { |
| 831 | - if (is_null($this->scope)) { | |
| 849 | + if (\is_null($this->scope)) { | |
| 832 | 850 | return $this->scope; |
| 833 | 851 | } |
| 834 | - return implode(' ', $this->scope); | |
| 852 | + return \implode(' ', $this->scope); | |
| 835 | 853 | } |
| 836 | 854 | /** |
| 855 | + * Gets the subject token type | |
| 856 | + * | |
| 857 | + * @return ?string | |
| 858 | + */ | |
| 859 | + public function getSubjectTokenType() : ?string | |
| 860 | + { | |
| 861 | + return $this->subjectTokenType; | |
| 862 | + } | |
| 863 | + /** | |
| 837 | 864 | * Sets the scope of the access request, expressed either as an Array or as |
| 838 | 865 | * a space-delimited String. |
| 839 | 866 | * |
| 840 | 867 | * @param string|array<string>|null $scope |
| @@ -842,15 +869,15 @@ | ||
| 842 | 869 | * @throws InvalidArgumentException |
| 843 | 870 | */ |
| 844 | 871 | public function setScope($scope) |
| 845 | 872 | { |
| 846 | - if (is_null($scope)) { | |
| 873 | + if (\is_null($scope)) { | |
| 847 | 874 | $this->scope = null; |
| 848 | - } elseif (is_string($scope)) { | |
| 849 | - $this->scope = explode(' ', $scope); | |
| 850 | - } elseif (is_array($scope)) { | |
| 875 | + } elseif (\is_string($scope)) { | |
| 876 | + $this->scope = \explode(' ', $scope); | |
| 877 | + } elseif (\is_array($scope)) { | |
| 851 | 878 | foreach ($scope as $s) { |
| 852 | - $pos = strpos($s, ' '); | |
| 879 | + $pos = \strpos($s, ' '); | |
| 853 | 880 | if ($pos !== \false) { |
| 854 | 881 | throw new InvalidArgumentException('array scope values should not contain spaces'); |
| 855 | 882 | } |
| 856 | 883 | } |
| @@ -865,26 +892,26 @@ | ||
| 865 | 892 | * @return ?string |
| 866 | 893 | */ |
| 867 | 894 | public function getGrantType() |
| 868 | 895 | { |
| 869 | - if (!is_null($this->grantType)) { | |
| 896 | + if (!\is_null($this->grantType)) { | |
| 870 | 897 | return $this->grantType; |
| 871 | 898 | } |
| 872 | 899 | // Returns the inferred grant type, based on the current object instance |
| 873 | 900 | // state. |
| 874 | - if (!is_null($this->code)) { | |
| 901 | + if (!\is_null($this->code)) { | |
| 875 | 902 | return 'authorization_code'; |
| 876 | 903 | } |
| 877 | - if (!is_null($this->refreshToken)) { | |
| 904 | + if (!\is_null($this->refreshToken)) { | |
| 878 | 905 | return 'refresh_token'; |
| 879 | 906 | } |
| 880 | - if (!is_null($this->username) && !is_null($this->password)) { | |
| 907 | + if (!\is_null($this->username) && !\is_null($this->password)) { | |
| 881 | 908 | return 'password'; |
| 882 | 909 | } |
| 883 | - if (!is_null($this->issuer) && !is_null($this->signingKey)) { | |
| 910 | + if (!\is_null($this->issuer) && !\is_null($this->signingKey)) { | |
| 884 | 911 | return self::JWT_URN; |
| 885 | 912 | } |
| 886 | - if (!is_null($this->subjectTokenFetcher) && !is_null($this->subjectTokenType)) { | |
| 913 | + if (!\is_null($this->subjectTokenFetcher) && !\is_null($this->subjectTokenType)) { | |
| 887 | 914 | return self::STS_URN; |
| 888 | 915 | } |
| 889 | 916 | return null; |
| 890 | 917 | } |
| @@ -896,9 +923,9 @@ | ||
| 896 | 923 | * @throws InvalidArgumentException |
| 897 | 924 | */ |
| 898 | 925 | public function setGrantType($grantType) |
| 899 | 926 | { |
| 900 | - if (in_array($grantType, self::$knownGrantTypes)) { | |
| 927 | + if (\in_array($grantType, self::$knownGrantTypes)) { | |
| 901 | 928 | $this->grantType = $grantType; |
| 902 | 929 | } else { |
| 903 | 930 | // validate URI |
| 904 | 931 | if (!$this->isAbsoluteUri($grantType)) { |
| @@ -1136,11 +1163,11 @@ | ||
| 1136 | 1163 | * @return void |
| 1137 | 1164 | */ |
| 1138 | 1165 | public function setSigningAlgorithm($signingAlgorithm) |
| 1139 | 1166 | { |
| 1140 | - if (is_null($signingAlgorithm)) { | |
| 1167 | + if (\is_null($signingAlgorithm)) { | |
| 1141 | 1168 | $this->signingAlgorithm = null; |
| 1142 | - } elseif (!in_array($signingAlgorithm, self::$knownSigningAlgorithms)) { | |
| 1169 | + } elseif (!\in_array($signingAlgorithm, self::$knownSigningAlgorithms)) { | |
| 1143 | 1170 | throw new InvalidArgumentException('unknown signing algorithm'); |
| 1144 | 1171 | } else { |
| 1145 | 1172 | $this->signingAlgorithm = $signingAlgorithm; |
| 1146 | 1173 | } |
| @@ -1201,13 +1228,13 @@ | ||
| 1201 | 1228 | * @return void |
| 1202 | 1229 | */ |
| 1203 | 1230 | public function setExpiresIn($expiresIn) |
| 1204 | 1231 | { |
| 1205 | - if (is_null($expiresIn)) { | |
| 1232 | + if (\is_null($expiresIn)) { | |
| 1206 | 1233 | $this->expiresIn = null; |
| 1207 | 1234 | $this->issuedAt = null; |
| 1208 | 1235 | } else { |
| 1209 | - $this->issuedAt = time(); | |
| 1236 | + $this->issuedAt = \time(); | |
| 1210 | 1237 | $this->expiresIn = (int) $expiresIn; |
| 1211 | 1238 | } |
| 1212 | 1239 | } |
| 1213 | 1240 | /** |
| @@ -1216,12 +1243,12 @@ | ||
| 1216 | 1243 | * @return ?int |
| 1217 | 1244 | */ |
| 1218 | 1245 | public function getExpiresAt() |
| 1219 | 1246 | { |
| 1220 | - if (!is_null($this->expiresAt)) { | |
| 1247 | + if (!\is_null($this->expiresAt)) { | |
| 1221 | 1248 | return $this->expiresAt; |
| 1222 | 1249 | } |
| 1223 | - if (!is_null($this->issuedAt) && !is_null($this->expiresIn)) { | |
| 1250 | + if (!\is_null($this->issuedAt) && !\is_null($this->expiresIn)) { | |
| 1224 | 1251 | return $this->issuedAt + $this->expiresIn; |
| 1225 | 1252 | } |
| 1226 | 1253 | return null; |
| 1227 | 1254 | } |
| @@ -1232,10 +1259,10 @@ | ||
| 1232 | 1259 | */ |
| 1233 | 1260 | public function isExpired() |
| 1234 | 1261 | { |
| 1235 | 1262 | $expiration = $this->getExpiresAt(); |
| 1236 | - $now = time(); | |
| 1237 | - return !is_null($expiration) && $now >= $expiration; | |
| 1263 | + $now = \time(); | |
| 1264 | + return !\is_null($expiration) && $now >= $expiration; | |
| 1238 | 1265 | } |
| 1239 | 1266 | /** |
| 1240 | 1267 | * Sets the time the current access token expires at. |
| 1241 | 1268 | * |
| @@ -1398,15 +1425,15 @@ | ||
| 1398 | 1425 | } |
| 1399 | 1426 | /** |
| 1400 | 1427 | * Get the client ID. |
| 1401 | 1428 | * |
| 1402 | - * Alias of {@see Google\Auth\OAuth2::getClientId()}. | |
| 1429 | + * Alias of {@see OAuth2::getClientId()}. | |
| 1403 | 1430 | * |
| 1404 | - * @param callable $httpHandler | |
| 1431 | + * @param callable|null $httpHandler | |
| 1405 | 1432 | * @return string |
| 1406 | 1433 | * @access private |
| 1407 | 1434 | */ |
| 1408 | - public function getClientName(callable $httpHandler = null) | |
| 1435 | + public function getClientName(?callable $httpHandler = null) | |
| 1409 | 1436 | { |
| 1410 | 1437 | return $this->getClientId(); |
| 1411 | 1438 | } |
| 1412 | 1439 | /** |
| @@ -1416,9 +1443,9 @@ | ||
| 1416 | 1443 | * @return null|UriInterface |
| 1417 | 1444 | */ |
| 1418 | 1445 | private function coerceUri($uri) |
| 1419 | 1446 | { |
| 1420 | - if (is_null($uri)) { | |
| 1447 | + if (\is_null($uri)) { | |
| 1421 | 1448 | return null; |
| 1422 | 1449 | } |
| 1423 | 1450 | return Utils::uriFor($uri); |
| 1424 | 1451 | } |
| @@ -1459,9 +1486,9 @@ | ||
| 1459 | 1486 | if (empty($allowedAlgs)) { |
| 1460 | 1487 | $keys = []; |
| 1461 | 1488 | foreach ((array) $publicKey as $kid => $pubKey) { |
| 1462 | 1489 | if (!$pubKey instanceof Key) { |
| 1463 | - throw new \InvalidArgumentException(sprintf('When allowed algorithms is empty, the public key must' . 'be an instance of %s or an array of %s objects', Key::class, Key::class)); | |
| 1490 | + throw new \InvalidArgumentException(\sprintf('When allowed algorithms is empty, the public key must' . 'be an instance of %s or an array of %s objects', Key::class, Key::class)); | |
| 1464 | 1491 | } |
| 1465 | 1492 | $keys[$kid] = $pubKey; |
| 1466 | 1493 | } |
| 1467 | 1494 | return $keys; |
| @@ -1466,19 +1493,19 @@ | ||
| 1466 | 1493 | } |
| 1467 | 1494 | return $keys; |
| 1468 | 1495 | } |
| 1469 | 1496 | $allowedAlg = null; |
| 1470 | - if (is_string($allowedAlgs)) { | |
| 1497 | + if (\is_string($allowedAlgs)) { | |
| 1471 | 1498 | $allowedAlg = $allowedAlgs; |
| 1472 | - } elseif (is_array($allowedAlgs)) { | |
| 1473 | - if (count($allowedAlgs) > 1) { | |
| 1474 | - throw new \InvalidArgumentException('To have multiple allowed algorithms, You must provide an' . ' array of Firebase\JWT\Key objects.' . ' See https://github.com/firebase/php-jwt for more information.'); | |
| 1499 | + } elseif (\is_array($allowedAlgs)) { | |
| 1500 | + if (\count($allowedAlgs) > 1) { | |
| 1501 | + throw new \InvalidArgumentException('To have multiple allowed algorithms, You must provide an' . ' array of Firebase\\JWT\\Key objects.' . ' See https://github.com/firebase/php-jwt for more information.'); | |
| 1475 | 1502 | } |
| 1476 | - $allowedAlg = array_pop($allowedAlgs); | |
| 1503 | + $allowedAlg = \array_pop($allowedAlgs); | |
| 1477 | 1504 | } else { |
| 1478 | 1505 | throw new \InvalidArgumentException('allowed algorithms must be a string or array.'); |
| 1479 | 1506 | } |
| 1480 | - if (is_array($publicKey)) { | |
| 1507 | + if (\is_array($publicKey)) { | |
| 1481 | 1508 | // When publicKey is greater than 1, create keys with the single alg. |
| 1482 | 1509 | $keys = []; |
| 1483 | 1510 | foreach ($publicKey as $kid => $pubKey) { |
| 1484 | 1511 | if ($pubKey instanceof Key) { |
