source: branches/2.4/prototype/rest/oauth/OAuth2StorageUserCredential.php @ 6754

<?php

require ROOTPATH . '/library/oauth2/lib/OAuth2.php';
require ROOTPATH . '/library/oauth2/lib/IOAuth2Storage.php';
require ROOTPATH . '/library/oauth2/lib/IOAuth2GrantCode.php';
require ROOTPATH . '/library/oauth2/lib/IOAuth2RefreshTokens.php';

require ROOTPATH . '/library/oauth2/lib/IOAuth2GrantUser.php';


class OAuth2StorageUserCredential implements IOAuth2GrantUser, IOAuth2RefreshTokens {

        public function checkUserCredentials($client_id, $username, $password) {
            
                //Authentica no LDAP
                $usuario =  Controller::find(array('concept'=>'user' , 'service' => 'OpenLDAP'), false , array('filter' => array('AND', array('=' , 'uid' , $username ), array('=' , 'password', '{md5}' . base64_encode(pack("H*",md5($password))))  ) ));

                if(isset($usuario[0]['id']))
                {
                    return array('scope' => 'all' , 'user_id' => $usuario[0]['id']);
                }

                return false;
        }
        
        /**
         * Make sure that the client credentials is valid.
         * 
         * @param $client_id
         * Client identifier to be check with.
         * @param $client_secret
         * (optional) If a secret is required, check that they've given the right one.
         *
         * @return
         * TRUE if the client credentials are valid, and MUST return FALSE if it isn't.
         * @endcode
         *
         * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-3.1
         *
         * @ingroup oauth2_section_3
         */
        public function checkClientCredentials($client_id, $client_secret = NULL) {
                if($client_secret == NULL) {
                        return false;
                }

                $res =  Controller::find(array('concept' => 'oauthCliente'), array('client_secret') , array('filter' => array('=' , 'client_id' , $client_id)) );

                if(isset($res[0]['client_secret']) && $res[0]['client_secret'] == $client_secret) {
                        return true;
                }
                else {
                        return false;
                }
        }

        /**
         * Get client details corresponding client_id.
         *
         * OAuth says we should store request URIs for each registered client.
         * Implement this function to grab the stored URI for a given client id.
         *
         * @param $client_id
         * Client identifier to be check with.
         *
         * @return array
         * Client details. Only mandatory item is the "registered redirect URI", and MUST
         * return FALSE if the given client does not exist or is invalid.
         *
         * @ingroup oauth2_section_4
         */
        public function getClientDetails($client_id) {
                $res =  Controller::find(array('concept' => 'oauthCliente'), array('redirect_uri') , array('filter' => array('=' , 'client_id' , $client_id)));
                if(isset($res[0]['redirect_uri'])) {
                        return $res[0]['redirect_uri'];
                }
                else {
                        return false;
                }
        }

        /**
         * Look up the supplied oauth_token from storage.
         *
         * We need to retrieve access token data as we create and verify tokens.
         *
         * @param $oauth_token
         * oauth_token to be check with.
         *
         * @return
         * An associative array as below, and return NULL if the supplied oauth_token
         * is invalid:
         * - client_id: Stored client identifier.
         * - expires: Stored expiration in unix timestamp.
         * - scope: (optional) Stored scope values in space-separated string.
         *
         * @ingroup oauth2_section_7
         */
        public function getAccessToken($oauth_token) {
                return $this->getToken($oauth_token, false);
        }

        /**
         * Take the provided refresh token values and store them somewhere.
         *
         * This function should be the storage counterpart to getRefreshToken().
         *
         * If storage fails for some reason, we're not currently checking for
         * any sort of success/failure, so you should bail out of the script
         * and provide a descriptive fail message.
         *
         * Required for OAuth2::GRANT_TYPE_REFRESH_TOKEN.
         *
         * @param $refresh_token
         * Refresh token to be stored.
         * @param $client_id
         * Client identifier to be stored.
         * @param $expires
         * expires to be stored.
         * @param $scope
         * (optional) Scopes to be stored in space-separated string.
         *
         * @ingroup oauth2_section_6
         */
        public function setRefreshToken($refresh_token, $client_id, $user_id, $expires, $scope = NULL) {
                
                $data = array();
                $data['refresh_token']  = $refresh_token;
                $data['client_id'] = $client_id;
                $data['user_id'] = $user_id;
                $data['expires'] = $expires;
                $data['scope'] = $scope;

                Controller::create(array('concept' => 'oauthRefreshToken'), $data);
        }
        
        /**
         * Store the supplied access token values to storage.
         *
         * We need to store access token data as we create and verify tokens.
         *
         * @param $oauth_token
         * oauth_token to be stored.
         * @param $client_id
         * Client identifier to be stored.
         * @param $user_id
         * User identifier to be stored.
         * @param $expires
         * Expiration to be stored.
         * @param $scope
         * (optional) Scopes to be stored in space-separated string.
         *
         * @ingroup oauth2_section_4
         */
        public function setAccessToken($oauth_token, $client_id, $user_id, $expires, $scope = NULL, $refresh_token) {
           
                $data = array();
                $data['oauth_token']  = $oauth_token;
                $data['client_id'] = $client_id;
                $data['user_id'] = $user_id;
                $data['expires'] = $expires;
                $data['scope'] = $scope;
                $data['refresh_token'] = $refresh_token;
                
                Controller::create(array('concept' => 'oauthToken'), $data);

        }

        /**
         * Check restricted grant types of corresponding client identifier.
         *
         * If you want to restrict clients to certain grant types, override this
         * function.
         *
         * @param $client_id
         * Client identifier to be check with.
         * @param $grant_type
         * Grant type to be check with, would be one of the values contained in
         * OAuth2::GRANT_TYPE_REGEXP.
         *
         * @return
         * TRUE if the grant type is supported by this client identifier, and
         * FALSE if it isn't.
         *
         * @ingroup oauth2_section_4
         */
        public function checkRestrictedGrantType($client_id, $grant_type) {
                /*TODO: essa função deve verificar se o cliente tem permissao para realizar o login via 'password'
                 * deixe para implementar no prox. sprint, quando trataremos de seguranca. Deve-se criar um campo extra no banco para guardar quais tipos
                 * de grant_type o cliente esta autorizado a fazer
                */

                return true;            
        }

        /**
         * Grant refresh access tokens.
         *
         * Retrieve the stored data for the given refresh token.
         *
         * Required for OAuth2::GRANT_TYPE_REFRESH_TOKEN.
         *
         * @param $refresh_token
         * Refresh token to be check with.
         *
         * @return
         * An associative array as below, and NULL if the refresh_token is
         * invalid:
         * - client_id: Stored client identifier.
         * - expires: Stored expiration unix timestamp.
         * - scope: (optional) Stored scope values in space-separated string.
         *
         * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-6
         *
         * @ingroup oauth2_section_6
         */
        public function getRefreshToken($refresh_token) {
                return $this->getToken($refresh_token, true);
        }

        /**
         * Expire a used refresh token.
         *
         * This is not explicitly required in the spec, but is almost implied.
         * After granting a new refresh token, the old one is no longer useful and
         * so should be forcibly expired in the data store so it can't be used again.
         *
         * If storage fails for some reason, we're not currently checking for
         * any sort of success/failure, so you should bail out of the script
         * and provide a descriptive fail message.
         *
         * @param $refresh_token
         * Refresh token to be expirse.
         *
         * @ingroup oauth2_section_6
         */
        public function unsetRefreshToken($refresh_token) {
                Controller::delete(
                        array('concept' => 'oauthRefreshToken'),
                        false,
                        array('filter' => array('=', 'refresh_token', $refresh_token ))
                );
        }
        public function unsetAccessToken($refresh_token) {
                Controller::delete(
                        array('concept' => 'oauthToken'),
                        false,
                        array('filter' => array('=', 'oauth_token', $refresh_token ))
                );
        }

        /**
         * Retrieves an access or refresh token.
         * 
         * @param string $token
         * @param bool $refresh
         */
        protected function getToken($token, $isRefresh = true) {

                $tokenConcept = $isRefresh ? 'oauthRefreshToken' : 'oauthToken';
                $filter =  $isRefresh ? 'refresh_token' : 'oauth_token';
                
                $res = Controller::find(
                        array('concept' => $tokenConcept), 
                        false, 
                        array('filter' => array('=' , $filter , $token))
                );

                /*return (!empty($res[0]))? $res[0] : false;*/
                if(!empty($res[0])) {
                        return $res[0];
                }
                else {
                        return false;
                }
        }
}