tudu-web-1 /library/OpenApi/OAuth/OAuth.php

Language PHP Lines 330
MD5 Hash a13d99a5f915d347de95a4128444b54f
Repository https://github.com/polokk/tudu-web-1.git View Raw File
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
<?php
/**
 * Tudu OpenApi
 *
 * LICENSE
 *
 * @category   OpenApi
 * @package    OpenApi_OAuth
 * @copyright  Copyright (c) 2009-2010 Shanghai Best Oray Information S&T CO., Ltd.
 * @link       http://www.oray.com/
 * @version    $Id$
 */

/**
 * @category   OpenApi
 * @package    OpenApi_OAuth
 * @copyright  Copyright (c) 2009-2010 Shanghai Best Oray Information S&T CO., Ltd.
 */
class OpenApi_OAuth_OAuth
{
    /**
     * 设置项目
     *
     * @var string
     */
    const STORAGE                = 'storageType';            // 存储类型
    const ACCESS_TOKEN_EXPIRES   = 'accessTokenExpires';     // 访问令牌过期时间
    const REFRESH_TOKEN_EXPIRES  = 'refreshTokenExpires';
    const SUPPORT_REFRESH_TOKEN  = 'supportRefreshToken';    // 是否实现刷新令牌
    const TOKEN_TYPE             = 'tokenType';

    /**
     * 获取访问令牌方式类型
     *
     * @var string
     */
    const GRANT_TYPE_AUTH_CODE          = 'authorization_code';
    const GRANT_TYPE_IMPLICIT           = 'token';
    const GRANT_TYPE_USER_CREDENTIALS   = 'password';
    const GRANT_TYPE_CLIENT_CREDENTIALS = 'client_credentials';
    const GRANT_TYPE_REFRESH_TOKEN      = 'refresh_token';
    const GRANT_TYPE_EXTENSIONS         = 'extensions';

    /**
     * 参数名称
     *
     * @var string
     */
    const PARAM_CLIENT_ID     = 'client_id';
    const PARAM_CLIENT_SECRET = 'client_secret';
    const PARAM_REDIRECT_URI  = 'redirect_uri';
    const PARAM_STATE         = 'state';
    const PARAM_SCOPE         = 'scope';

    const PARAM_GRANT_TYPE    = 'grant_type';
    const PARAM_CODE          = 'code';
    const PARAM_USERNAME      = 'username';
    const PARAM_USER_ID       = 'user_id';
    const PARAM_PASSWORD      = 'password';
    const PARAM_REFRESH_TOKEN = 'refresh_token';
    const PARAM_ACCESS_TOKEN  = 'access_token';
    const PARAM_EXPIRES       = 'expires_in';

    /**
     * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-7.1
     *
     * @var string
     */
    const TOKEN_TYPE_BEARER = 'bearer';
    const TOKEN_TYPE_MAC    = 'mac';

    /**
     *
     * @var string
     */
    const REG_GRANT_TYPE = '#^(authorization_code|token|password|client_credentials|refresh_token|http://.*)$#';

    /**
     *
     * @var string
     */
    const ERROR_INTERNAL_EXCEPTION  = 'internal_exception';
    const ERROR_INVALID_REQUEST     = 'invalid_request';
    const ERROR_INVALID_ACCESSTOKEN = 'invalid_access_token';
    const ERROR_ACCESSTOKEN_EXPIRED = 'access_token_expired';

    /**
     *
     * @var array
     */
    protected $_config = array(
        self::STORAGE                => null,
        self::ACCESS_TOKEN_EXPIRES   => 86400,
        self::REFRESH_TOKEN_EXPIRES => 259200,
        self::SUPPORT_REFRESH_TOKEN  => true,
        self::TOKEN_TYPE             => self::TOKEN_TYPE_BEARER
    );

    /**
     *
     * @var array
     */
    protected $_grantClasses = array(
        self::GRANT_TYPE_AUTH_CODE        => 'OpenApi_OAuth_Grant_AuthCode',
        self::GRANT_TYPE_USER_CREDENTIALS => '',
        self::GRANT_TYPE_REFRESH_TOKEN    => 'OpenApi_OAuth_Grant_RefreshToken'
    );

    /**
     *
     * @var OpenApi_OAuth_Storage_Interface
     */
    protected $_storage;

    /**
     * Constructor
     *
     * @param Zend_Config | array $config
     */
    public function __construct($config = null)
    {
        if ($config && $config instanceof Zend_Config) {
            $config = $config->toArray();
        }

        if (null !== $config && !is_array($config)) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception("Invalid config parameter for constructor of OAuth", self::ERROR_INTERNAL_EXCEPTION);
        }

        if (isset($config[self::STORAGE])
            && $config[self::STORAGE] instanceof OpenApi_OAuth_Storage_Interface)
        {
            $this->_storage = $config[self::STORAGE];
        }

        $this->_config = array_merge($this->_config, $config);
    }

    /**
     *
     * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-4
	 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-10.6
	 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-4.1.3
	 *
     * @param array $inputDate
     * @param array $authHeaders
     * @throws OpenApi_OAuth_Exception
     */
    public function grantAccessToken(array $inputData, array $authHeaders = null)
    {
        $filters = array(
            self::PARAM_GRANT_TYPE => array("filter" => FILTER_VALIDATE_REGEXP, "options" => array("regexp" => self::REG_GRANT_TYPE), "flags" => FILTER_REQUIRE_SCALAR),
            self::PARAM_SCOPE => array("flags" => FILTER_REQUIRE_SCALAR),
            self::PARAM_CODE => array("flags" => FILTER_REQUIRE_SCALAR),
            self::PARAM_REDIRECT_URI => array("filter" => FILTER_SANITIZE_URL),
            self::PARAM_USERNAME => array("flags" => FILTER_REQUIRE_SCALAR),
            self::PARAM_PASSWORD => array("flags" => FILTER_REQUIRE_SCALAR),
            self::PARAM_REFRESH_TOKEN => array("flags" => FILTER_REQUIRE_SCALAR),
        );

        if (empty($inputData)) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception(self::ERROR_INVALID_REQUEST);
        }

        $input = filter_var_array($inputData, $filters);

        if (empty($input[self::PARAM_GRANT_TYPE])) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception('Invalid parameter "grant_type"', self::ERROR_INVALID_REQUEST);
        }

        $grant = $this->getGrantObject($input[self::PARAM_GRANT_TYPE]);

        if (!$grant instanceof OpenApi_OAuth_Grant_Abstract) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception('Grant class must extends from class "OpenApi_OAuth_Grant_Abstract"');
        }

        $data = $grant->grant($inputData);

        $data[self::PARAM_CLIENT_ID] = $inputData[self::PARAM_CLIENT_ID];

        return $this->createAccessToken($data);
    }

    /**
     * 设置验证模式对象类
     *
     * @param string $grantType
     * @param string $className
     * @return OpenApi_OAuth_OAuth
     */
    public function setGrantClass($grantType, $className)
    {
        if (empty($className)) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception("Invalid classname for grant type");
        }

        $this->_grantClasses[$grantType] = $className;
    }

    /**
     *
     * @param string $grantType
     */
    public function getGrantObject($grantType)
    {
        require_once 'Zend/Loader.php';
        Zend_Loader::loadClass($this->_grantClasses[$grantType]);

        return new $this->_grantClasses[$grantType]($this);
    }

    /**
     *
     */
    public function createAccessToken(array $params)
    {
        $accessToken = $this->_getToken();

        $ret = array(
            'access_token' => $accessToken,
            'expires_in'   => $this->_config[self::ACCESS_TOKEN_EXPIRES],
            'token_type'   => $this->_config[self::TOKEN_TYPE],
            'scope'        => $params[self::PARAM_SCOPE]
        );

        $token = array(
            self::PARAM_CLIENT_ID => $params[self::PARAM_CLIENT_ID],
            self::PARAM_USER_ID   => $params[self::PARAM_USER_ID],
            self::PARAM_EXPIRES   => time() + $this->_config[self::ACCESS_TOKEN_EXPIRES],
            self::PARAM_SCOPE     => $params[self::PARAM_SCOPE]
        );

        $token = array_merge($params, $token);

        $this->getStorage()->setAccessToken($accessToken, $token);
        $a = $this->getStorage()->getAccessToken($accessToken);

        if ($this->_config[self::SUPPORT_REFRESH_TOKEN]) {
            $refreshToken = $this->_getToken();
            $ret['refresh_token'] = $refreshToken;

            $token[self::PARAM_EXPIRES] = time() + $this->_config[self::REFRESH_TOKEN_EXPIRES];
            $this->getStorage()->setRefreshToken($refreshToken, $token);
        }

        return $ret;
    }

    /**
     * 销毁指定的访问令牌
     *
     * @param string $accessToken
     */
    public function destroyAccessToken($accessToken)
    {
        $storage = $this->getStorage();

        $token = $storage->getAccessToken($accessToken);

        if (null === $token) {
            return ;
        }

        if (!empty($token[self::PARAM_REFRESH_TOKEN])) {
            $storage->unsetRefreshToken($token[self::PARAM_REFRESH_TOKEN]);
        }

        $storage->unsetAccessToken($accessToken);
    }

    /**
     *
     * @param string $accessToken
     * @param string $scope
     */
    public function verifyAccessToken($accessToken, $scope = null)
    {
        $token = $this->getStorage()->getAccessToken($accessToken);

        if (empty($token)) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception("Invalid access token provided", self::ERROR_INVALID_ACCESSTOKEN);
        }

        if (empty($token[self::PARAM_EXPIRES]) || empty($token[self::PARAM_CLIENT_ID])) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception("Invalid access token provided", self::ERROR_INVALID_ACCESSTOKEN);
        }

        if ($token[self::PARAM_EXPIRES] < time()) {
            require_once 'OpenApi/OAuth/Exception.php';
            throw new OpenApi_OAuth_Exception("Invalid access token provided", self::ERROR_ACCESSTOKEN_EXPIRED);
        }

        // 授权范围,未实现
        if (null != $scope) {

        }

        return $token;
    }

    /**
     *
     * 获取保存对象
     */
    public function getStorage()
    {
        return $this->_storage;
    }

    /**
     * 生成新的令牌字符串
     */
    protected function _getToken()
    {
        $tokenLen = 40;
        if (file_exists('/dev/urandom')) { // Get 100 bytes of random data
            $randomData = file_get_contents('/dev/urandom', false, null, 0, 100) . uniqid(mt_rand(), true);
        } else {
            $randomData = mt_rand() . mt_rand() . mt_rand() . mt_rand() . microtime(true) . uniqid(mt_rand(), true);
        }
        return substr(hash('sha512', $randomData), 0, $tokenLen);
    }
}
Back to Top