-
Notifications
You must be signed in to change notification settings - Fork 88
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feature #28 Add default scopes (mtarld)
This PR was merged into the 0.1-dev branch. Discussion ---------- Add default scopes - Closes #22 - Replaces `Symfony\Component\EventDispatcher\EventDispatcherInterface` by `Symfony\Contracts\EventDispatcher\EventDispatcherInterface` to be consistent Need to wait for #24 to see the green CI Commits ------- 2ea9d4d Add default scopes
- Loading branch information
Showing
26 changed files
with
376 additions
and
67 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,70 @@ | ||
# Token scopes | ||
|
||
## Setting default scopes | ||
|
||
Having a client with no scope gives the client access to all the scopes. | ||
In most cases, it's a bad idea and could result as security vulnerability. | ||
|
||
That's why you have to specify in the bundle configuration the default scopes that will be applied when no scope is given: | ||
```yaml | ||
# config/packages/league_oauth2_server.yaml | ||
|
||
league_oauth2_server: | ||
scopes: | ||
available: [EMAIL, PREFERENCES] | ||
default: [EMAIL] | ||
``` | ||
If you still want clients without scopes to have access to every scopes, you can use role hierarchy as a workaround: | ||
```yaml | ||
# config/packages/league_oauth2_server.yaml | ||
|
||
league_oauth2_server: | ||
role_prefix: ROLE_OAUTH2_ | ||
|
||
scopes: | ||
available: [EMAIL, PREFERENCES, SUPER_USER] | ||
default: [SUPER_USER] | ||
``` | ||
```yaml | ||
# config/packages/security.yaml | ||
security: | ||
role_hierarchy: | ||
ROLE_OAUTH2_SUPER_USER: [ROLE_OAUTH2_EMAIL, ROLE_OAUTH2_PREFERENCES] | ||
``` | ||
## Controlling token scopes | ||
It's possible to alter issued access token's scopes by subscribing to the `league.oauth2_server.scope_resolve` event. | ||
|
||
### Example | ||
|
||
#### Listener | ||
```php | ||
<?php | ||
namespace App\EventListener; | ||
use League\Bundle\OAuth2ServerBundle\Event\ScopeResolveEvent; | ||
final class ScopeResolveListener | ||
{ | ||
public function onScopeResolve(ScopeResolveEvent $event): void | ||
{ | ||
$requestedScopes = $event->getScopes(); | ||
// ...Make adjustments to the client's requested scopes... | ||
$event->setScopes(...$requestedScopes); | ||
} | ||
} | ||
``` | ||
|
||
#### Service configuration | ||
|
||
```yaml | ||
App\EventListener\ScopeResolveListener: | ||
tags: | ||
- { name: kernel.event_listener, event: league.oauth2_server.scope_resolve, method: onScopeResolve } | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
<?php | ||
|
||
declare(strict_types=1); | ||
|
||
namespace League\Bundle\OAuth2ServerBundle\Event; | ||
|
||
use League\Bundle\OAuth2ServerBundle\Model\AbstractClient; | ||
use Symfony\Contracts\EventDispatcher\Event; | ||
|
||
/** | ||
* @author Mathias Arlaud <mathias.arlaud@gmail.com> | ||
*/ | ||
class PreSaveClientEvent extends Event | ||
{ | ||
/** | ||
* @var AbstractClient | ||
*/ | ||
private $client; | ||
|
||
public function __construct(AbstractClient $client) | ||
{ | ||
$this->client = $client; | ||
} | ||
|
||
public function getClient(): AbstractClient | ||
{ | ||
return $this->client; | ||
} | ||
|
||
public function setClient(AbstractClient $client): void | ||
{ | ||
$this->client = $client; | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
<?php | ||
|
||
declare(strict_types=1); | ||
|
||
namespace League\Bundle\OAuth2ServerBundle\EventListener; | ||
|
||
use League\Bundle\OAuth2ServerBundle\Event\PreSaveClientEvent; | ||
use League\Bundle\OAuth2ServerBundle\Model\Scope; | ||
|
||
/** | ||
* Sets default scopes to the client before being saved by a ClientManager if no scope is specified. | ||
* | ||
* @author Mathias Arlaud <mathias.arlaud@gmail.com> | ||
*/ | ||
class AddClientDefaultScopesListener | ||
{ | ||
/** | ||
* @var list<string> | ||
*/ | ||
private $defaultScopes; | ||
|
||
/** | ||
* @param list<string> $defaultScopes | ||
*/ | ||
public function __construct(array $defaultScopes) | ||
{ | ||
$this->defaultScopes = $defaultScopes; | ||
} | ||
|
||
public function __invoke(PreSaveClientEvent $event): void | ||
{ | ||
$client = $event->getClient(); | ||
if ([] !== $client->getScopes()) { | ||
return; | ||
} | ||
|
||
$client->setScopes(...array_map(static function (string $scope): Scope { | ||
return new Scope($scope); | ||
}, $this->defaultScopes)); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.