wordpress-seo / src / myyoast-client / application / token-revocation-handler.php

token-revocation-handler.php in Yoast SEO – Advanced SEO with real-time guidance and built-in AI 28.2, at src/myyoast-client/application/token-revocation-handler.php

133 lines 4.0 KB

Raw Download Zip

1	<?php
2	// phpcs:disable Yoast.NamingConventions.NamespaceName.TooLong -- Needed in the folder structure.
3
4	namespace Yoast\WP\SEO\MyYoast_Client\Application;
5
6	use Exception;
7	use SensitiveParameter;
8	use Yoast\WP\SEO\MyYoast_Client\Application\Ports\Client_Authenticator_Interface;
9	use Yoast\WP\SEO\MyYoast_Client\Application\Ports\Client_Registration_Interface;
10	use Yoast\WP\SEO\MyYoast_Client\Application\Ports\Discovery_Interface;
11	use Yoast\WP\SEO\MyYoast_Client\Application\Ports\OAuth_Server_Client_Interface;
12	use Yoast\WP\SEO\MyYoast_Client\Domain\Token_Type_Hint;
13	use YoastSEO_Vendor\Psr\Log\LoggerAwareInterface;
14	use YoastSEO_Vendor\Psr\Log\LoggerAwareTrait;
15	use YoastSEO_Vendor\Psr\Log\NullLogger;
16
17	/**
18	* Revokes tokens at the authorization server (RFC 7009).
19	*
20	* Token revocation is best-effort: failures are logged as warnings and
21	* signalled to the caller via a `false` return value rather than rethrown.
22	*/
23	class Token_Revocation_Handler implements LoggerAwareInterface {
24	use LoggerAwareTrait;
25
26	/**
27	* The discovery port.
28	*
29	* @var Discovery_Interface
30	*/
31	private $discovery;
32
33	/**
34	* The client registration port.
35	*
36	* @var Client_Registration_Interface
37	*/
38	private $client_registration;
39
40	/**
41	* The client authenticator port.
42	*
43	* @var Client_Authenticator_Interface
44	*/
45	private $client_authenticator;
46
47	/**
48	* The token endpoint client port.
49	*
50	* @var OAuth_Server_Client_Interface
51	*/
52	private $oauth_server_client;
53
54	/**
55	* Token_Revocation_Handler constructor.
56	*
57	* @param Discovery_Interface $discovery The discovery port.
58	* @param Client_Registration_Interface $client_registration The client registration port.
59	* @param Client_Authenticator_Interface $client_authenticator The client authenticator port.
60	* @param OAuth_Server_Client_Interface $oauth_server_client The token endpoint client port.
61	*/
62	public function __construct(
63	Discovery_Interface $discovery,
64	Client_Registration_Interface $client_registration,
65	Client_Authenticator_Interface $client_authenticator,
66	OAuth_Server_Client_Interface $oauth_server_client
67	) {
68	$this->discovery = $discovery;
69	$this->client_registration = $client_registration;
70	$this->client_authenticator = $client_authenticator;
71	$this->oauth_server_client = $oauth_server_client;
72	$this->logger = new NullLogger();
73	}
74
75	/**
76	* Revokes a token at the authorization server.
77	*
78	* @param string $token The token to revoke.
79	* @param string $token_type_hint A Token_Type_Hint constant.
80	*
81	* @return bool True if the revocation request was sent (regardless of server response).
82	*/
83	public function revoke(
84	// phpcs:ignore PHPCompatibility.Attributes.NewAttributes.PHPNativeAttributeFound -- No-op on PHP < 8.2; redacts parameter from stack traces on PHP 8.2+.
85	#[SensitiveParameter]
86	string $token,
87	string $token_type_hint = Token_Type_Hint::REFRESH_TOKEN
88	): bool {
89	try {
90	$registered_client = $this->client_registration->get_registered_client();
91	if ( $registered_client === null ) {
92	return false;
93	}
94	$revocation_endpoint = $this->discovery->get_document()->get_revocation_endpoint();
95
96	$client_assertion = $this->client_authenticator->create_client_assertion(
97	$registered_client->get_client_id(),
98	$revocation_endpoint,
99	);
100
101	$body = [
102	'token' => $token,
103	'token_type_hint' => $token_type_hint,
104	'client_id' => $registered_client->get_client_id(),
105	'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
106	'client_assertion' => $client_assertion,
107	];
108
109	$this->oauth_server_client->request(
110	'POST',
111	$revocation_endpoint,
112	[
113	'headers' => [ 'Content-Type' => 'application/x-www-form-urlencoded' ],
114	'body' => $body,
115	'dpop' => true,
116	],
117	);
118
119	return true;
120	}
121	catch ( Exception $e ) {
122	$this->logger->warning(
123	'Token revocation failed ({token_type_hint}): {error}',
124	[
125	'token_type_hint' => $token_type_hint,
126	'error' => $e->getMessage(),
127	],
128	);
129	return false;
130	}
131	}
132	}
133