/**
* @param \OAuth2\Token\AccessTokenInterface $access_token
*
* @throws \OAuth2\Exception\BaseExceptionInterface
*
* @return \OAuth2\Client\ClientInterface
*/
private function getClient(AccessTokenInterface $access_token)
{
$client = $this->getClientManager()->getClient($access_token->getClientPublicId());
if (null === $client) {
throw new BadCredentialsException('Unknown client');
}
return $client;
}
/**
* @param \OAuth2\Token\AccessTokenInterface $access_token
*
* @throws \OAuth2\Exception\BadRequestExceptionInterface
*
* @return null|\OAuth2\Client\ClientInterface
*/
private function getClient(AccessTokenInterface $access_token)
{
$client = $this->getClientManager()->getClient($access_token->getClientPublicId());
if (null === $client) {
throw $this->getExceptionManager()->getBadRequestException(ExceptionManagerInterface::ERROR_INVALID_REQUEST, 'Unable to find the client.');
}
return $client;
}
/**
* @param \OAuth2\Token\AccessTokenInterface|\OAuth2\Token\RefreshTokenInterface $token
* @param \OAuth2\Client\ClientInterface|null $client
*
* @return bool
*/
private function isClientVerified($token, ClientInterface $client = null)
{
if (null !== $client) {
// The client ID of the token is the same as client authenticated
return $token->getClientPublicId() === $client->getPublicId();
} else {
// We try to get the client
$client = $this->getClientManagerSupervisor()->getClient($token->getClientPublicId());
// Return false if the client is a confidential client (confidential client must be authenticated)
return !$client instanceof ConfidentialClientInterface;
}
}
/**
* @param \OAuth2\Token\AccessTokenInterface $access_token
* @param \OAuth2\Client\ClientInterface|null $resource_server
*
* @return array
*/
protected function preparePayload(AccessTokenInterface $access_token, ClientInterface $resource_server = null)
{
$aud = [$this->getIssuer()];
if (null !== $resource_server) {
$access_token[] = $resource_server->getPublicId();
}
$payload = ['jti' => Base64Url::encode(random_bytes(25)), 'iss' => $this->getIssuer(), 'aud' => $aud, 'iat' => time(), 'nbf' => time(), 'exp' => $access_token->getExpiresAt(), 'sub' => $access_token->getClientPublicId(), 'token_type' => $access_token->getTokenTypeParameter('token_type'), 'scp' => $access_token->getScope(), 'resource_owner' => $access_token->getResourceOwnerPublicId(), 'user_account' => $access_token->getUserAccountPublicId()];
$payload['metadatas'] = $access_token->getMetadatas();
if (0 !== ($expires_at = $access_token->getExpiresAt())) {
$payload['exp'] = $expires_at;
}
if (!empty($access_token->getParameters())) {
$parameters = $access_token->getParameters();
//This part should be updated to support 'cnf' (confirmation) claim (see POP).
$payload['other'] = $parameters;
}
if (null !== $access_token->getRefreshToken()) {
$payload['refresh_token'] = $access_token->getRefreshToken();
}
return $payload;
}
