Add per grant type configuration options

trikoder · Apr 12, 2020 · 4feaa63 · 4feaa63
1 parent 73cddab
commit 4feaa63
Show file tree

Hide file tree

Showing 5 changed files with 563 additions and 88 deletions.
diff --git a/DependencyInjection/Configuration.php b/DependencyInjection/Configuration.php
@@ -8,6 +8,7 @@
 use Symfony\Component\Config\Definition\Builder\NodeDefinition;
 use Symfony\Component\Config\Definition\Builder\TreeBuilder;
 use Symfony\Component\Config\Definition\ConfigurationInterface;
+use Trikoder\Bundle\OAuth2Bundle\OAuth2Grants;
 
 final class Configuration implements ConfigurationInterface
 {
@@ -27,11 +28,11 @@ public function getConfigTreeBuilder(): TreeBuilder
         $rootNode
             ->children()
                 ->scalarNode('exception_event_listener_priority')
-                    ->info('The priority of the event listener that converts an Exception to a Response')
+                    ->info('The priority of the event listener that converts an Exception to a Response.')
                     ->defaultValue(10)
                 ->end()
                 ->scalarNode('role_prefix')
-                    ->info('Set a custom prefix that replaces the default \'ROLE_OAUTH2_\' role prefix')
+                    ->info('Set a custom prefix that replaces the default "ROLE_OAUTH2_" role prefix.')
                     ->defaultValue('ROLE_OAUTH2_')
                     ->cannotBeEmpty()
                 ->end()
@@ -55,7 +56,7 @@ private function createAuthorizationServerNode(): NodeDefinition
                     ->cannotBeEmpty()
                 ->end()
                 ->scalarNode('private_key_passphrase')
-                    ->info('Passphrase of the private key, if any')
+                    ->info('Passphrase of the private key, if any.')
                     ->defaultValue(null)
                 ->end()
                 ->scalarNode('encryption_key')
@@ -64,48 +65,126 @@ private function createAuthorizationServerNode(): NodeDefinition
                     ->cannotBeEmpty()
                 ->end()
                 ->enumNode('encryption_key_type')
-                    ->info("The type of value of 'encryption_key'")
+                    ->info('The type of value of "encryption_key".')
                     ->values(['plain', 'defuse'])
                     ->defaultValue('plain')
                 ->end()
                 ->scalarNode('access_token_ttl')
-                    ->info("How long the issued access token should be valid for.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
+                    ->info("How long the issued access token should be valid for, used as a default if there is no grant type specific value set.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
                     ->cannotBeEmpty()
                     ->defaultValue('PT1H')
                 ->end()
                 ->scalarNode('refresh_token_ttl')
-                    ->info("How long the issued refresh token should be valid for.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
+                    ->info("How long the issued refresh token should be valid for, used as a default if there is no grant type specific value set.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
                     ->cannotBeEmpty()
                     ->defaultValue('P1M')
                 ->end()
+
+        // @TODO Remove in v4 start
+
                 ->scalarNode('auth_code_ttl')
-                    ->info("How long the issued auth code should be valid for.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
+                    ->info("How long the issued authorization code should be valid for.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
                     ->cannotBeEmpty()
-                    ->defaultValue('PT10M')
-                ->end()
-                ->booleanNode('enable_client_credentials_grant')
-                    ->info('Whether to enable the client credentials grant')
-                    ->defaultTrue()
+                    ->defaultNull()
+                    ->setDeprecated('"%path%.%node%" is deprecated, use "%path%.grant_types.authorization_code.auth_code_ttl" instead.')
+                    ->beforeNormalization()
+                        ->ifNull()
+                        ->thenUnset()
+                    ->end()
                 ->end()
-                ->booleanNode('enable_password_grant')
-                    ->info('Whether to enable the password grant')
-                    ->defaultTrue()
+                ->scalarNode('require_code_challenge_for_public_clients')
+                    ->info('Whether to require code challenge for public clients for the authorization code grant.')
+                    ->defaultNull()
+                    ->setDeprecated('"%path%.%node%" is deprecated, use "%path%.grant_types.authorization_code.require_code_challenge_for_public_clients" instead.')
+                    ->validate()
+                        ->ifNotInArray([true, false, null])
+                        ->thenInvalid('Invalid value %s, allowed values are true, false & null')
+                    ->end()
                 ->end()
-                ->booleanNode('enable_refresh_token_grant')
-                    ->info('Whether to enable the refresh token grant')
-                    ->defaultTrue()
+            ->end()
+        ;
+
+        foreach (OAuth2Grants::MAP as $grantType => $grantTypeName) {
+            $oldGrantType = 'authorization_code' === $grantType ? 'auth_code' : $grantType;
+
+            $node
+                ->isRequired()
+                ->children()
+                    ->scalarNode(sprintf('enable_%s_grant', $oldGrantType))
+                        ->info(sprintf('Whether to enable the %s grant.', $grantTypeName))
+                        ->defaultNull()
+                        ->setDeprecated(sprintf('"%%path%%.%%node%%" is deprecated, use "%%path%%.grant_types.%s.enable" instead.', $grantType))
+                        ->validate()
+                            ->ifNotInArray([true, false, null])
+                            ->thenInvalid('Invalid value %s, allowed values are true, false & null')
+                        ->end()
+                    ->end()
                 ->end()
-                ->booleanNode('enable_auth_code_grant')
-                    ->info('Whether to enable the authorization code grant')
-                    ->defaultTrue()
+            ;
+        }
+
+        // @TODO Remove in v4 end
+
+        $node->append($this->createAuthorizationServerGrantTypesNode());
+
+        return $node;
+    }
+
+    private function createAuthorizationServerGrantTypesNode(): NodeDefinition
+    {
+        $treeBuilder = new TreeBuilder('grant_types');
+        $node = $treeBuilder->getRootNode();
+
+        $node
+            ->info('Enable and configure grant types.')
+            ->addDefaultsIfNotSet()
+        ;
+
+        foreach (OAuth2Grants::MAP as $grantType => $grantTypeName) {
+            $node
+                ->children()
+                    ->arrayNode($grantType)
+                        ->addDefaultsIfNotSet()
+                        ->children()
+                            ->booleanNode('enable')
+                                ->info(sprintf('Whether to enable the %s grant.', $grantTypeName))
+                                ->defaultTrue()
+                            ->end()
+                            ->scalarNode('access_token_ttl')
+                                ->info(sprintf('How long the issued access token should be valid for the %s grant.', $grantTypeName))
+                                ->defaultNull()
+                            ->end()
+                        ->end()
+                    ->end()
                 ->end()
-                ->booleanNode('require_code_challenge_for_public_clients')
-                    ->info('Whether to require code challenge for public clients for the auth code grant')
-                    ->defaultTrue()
+            ;
+        }
+
+        foreach (['authorization_code', 'password', 'refresh_token'] as $grantType) {
+            $node
+                ->find($grantType)
+                    ->children()
+                        ->scalarNode('refresh_token_ttl')
+                            ->info(sprintf('How long the issued refresh token should be valid for the %s grant.', OAuth2Grants::MAP[$grantType]))
+                            ->defaultNull()
+                        ->end()
+                    ->end()
                 ->end()
-                ->booleanNode('enable_implicit_grant')
-                    ->info('Whether to enable the implicit grant')
-                    ->defaultTrue()
+            ;
+        }
+
+        $node
+            ->find('authorization_code')
+                ->children()
+                    ->scalarNode('auth_code_ttl')
+                        ->info("How long the issued authorization code should be valid for.\nThe value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters")
+                        ->cannotBeEmpty()
+                        ->defaultValue('PT10M')
+                    ->end()
+                    ->booleanNode('require_code_challenge_for_public_clients')
+                        ->info('Whether to require code challenge for public clients for the authorization code grant.')
+                        ->defaultTrue()
+                    ->end()
                 ->end()
             ->end()
         ;
@@ -122,7 +201,7 @@ private function createResourceServerNode(): NodeDefinition
             ->isRequired()
             ->children()
                 ->scalarNode('public_key')
-                    ->info("Full path to the public key file\nHow to generate a public key: https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys")
+                    ->info("Full path to the public key file.\nHow to generate a public key: https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys")
                     ->example('/var/oauth/public.key')
                     ->isRequired()
                     ->cannotBeEmpty()

diff --git a/DependencyInjection/TrikoderOAuth2Extension.php b/DependencyInjection/TrikoderOAuth2Extension.php
@@ -57,6 +57,7 @@ public function load(array $configs, ContainerBuilder $container)
         $loader->load('services.xml');
 
         $config = $this->processConfiguration(new Configuration(), $configs);
+        $config = $this->normalizeConfiguration($config);
 
         $this->configurePersistence($loader, $container, $config['persistence']);
         $this->configureAuthorizationServer($container, $config['authorization_server']);
@@ -110,6 +111,46 @@ public function process(ContainerBuilder $container)
         $this->assertRequiredBundlesAreEnabled($container);
     }
 
+    private function normalizeConfiguration(array $config): array
+    {
+        foreach ($config['authorization_server']['grant_types'] as $grantType => &$grantTypeConfig) {
+            $grantTypeConfig['access_token_ttl'] = $grantTypeConfig['access_token_ttl'] ?? $config['authorization_server']['access_token_ttl'];
+
+            if (\array_key_exists('refresh_token_ttl', $grantTypeConfig)) {
+                $grantTypeConfig['refresh_token_ttl'] = $grantTypeConfig['refresh_token_ttl'] ?? $config['authorization_server']['refresh_token_ttl'];
+            }
+
+            // @TODO Remove in v4 start
+
+            $oldGrantType = 'authorization_code' === $grantType ? 'auth_code' : $grantType;
+
+            $grantTypeConfig['enable'] = $config['authorization_server'][sprintf('enable_%s_grant', $oldGrantType)] ?? $grantTypeConfig['enable'];
+
+            if ('authorization_code' === $grantType) {
+                $grantTypeConfig['auth_code_ttl'] = $config['authorization_server']['auth_code_ttl'] ?? $grantTypeConfig['auth_code_ttl'];
+                $grantTypeConfig['require_code_challenge_for_public_clients'] = $config['authorization_server']['require_code_challenge_for_public_clients']
+                    ?? $grantTypeConfig['require_code_challenge_for_public_clients'];
+            }
+
+            // @TODO Remove in v4 end
+        }
+
+        unset($config['authorization_server']['access_token_ttl'], $config['authorization_server']['refresh_token_ttl']);
+
+        // @TODO Remove in v4
+        unset(
+            $config['authorization_server']['enable_auth_code_grant'],
+            $config['authorization_server']['enable_client_credentials_grant'],
+            $config['authorization_server']['enable_implicit_grant'],
+            $config['authorization_server']['enable_password_grant'],
+            $config['authorization_server']['enable_refresh_token_grant'],
+            $config['authorization_server']['auth_code_ttl'],
+            $config['authorization_server']['require_code_challenge_for_public_clients']
+        );
+
+        return $config;
+    }
+
     private function assertRequiredBundlesAreEnabled(ContainerBuilder $container): void
     {
         $requiredBundles = [
@@ -150,38 +191,40 @@ private function configureAuthorizationServer(ContainerBuilder $container, array
             $authorizationServer->replaceArgument('$encryptionKey', new Reference('trikoder.oauth2.defuse_key'));
         }
 
-        if ($config['enable_client_credentials_grant']) {
+        $grantTypes = $config['grant_types'];
+
+        if ($grantTypes['client_credentials']['enable']) {
             $authorizationServer->addMethodCall('enableGrantType', [
                 new Reference(ClientCredentialsGrant::class),
-                new Definition(DateInterval::class, [$config['access_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['client_credentials']['access_token_ttl']]),
             ]);
         }
 
-        if ($config['enable_password_grant']) {
+        if ($grantTypes['password']['enable']) {
             $authorizationServer->addMethodCall('enableGrantType', [
                 new Reference(PasswordGrant::class),
-                new Definition(DateInterval::class, [$config['access_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['password']['access_token_ttl']]),
             ]);
         }
 
-        if ($config['enable_refresh_token_grant']) {
+        if ($grantTypes['refresh_token']['enable']) {
             $authorizationServer->addMethodCall('enableGrantType', [
                 new Reference(RefreshTokenGrant::class),
-                new Definition(DateInterval::class, [$config['access_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['refresh_token']['access_token_ttl']]),
             ]);
         }
 
-        if ($config['enable_auth_code_grant']) {
+        if ($grantTypes['authorization_code']['enable']) {
             $authorizationServer->addMethodCall('enableGrantType', [
                 new Reference(AuthCodeGrant::class),
-                new Definition(DateInterval::class, [$config['access_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['authorization_code']['access_token_ttl']]),
             ]);
         }
 
-        if ($config['enable_implicit_grant']) {
+        if ($grantTypes['implicit']['enable']) {
             $authorizationServer->addMethodCall('enableGrantType', [
                 new Reference(ImplicitGrant::class),
-                new Definition(DateInterval::class, [$config['access_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['implicit']['access_token_ttl']]),
             ]);
         }
 
@@ -190,34 +233,37 @@ private function configureAuthorizationServer(ContainerBuilder $container, array
 
     private function configureGrants(ContainerBuilder $container, array $config): void
     {
+        $grantTypes = $config['grant_types'];
+
         $container
             ->getDefinition(PasswordGrant::class)
             ->addMethodCall('setRefreshTokenTTL', [
-                new Definition(DateInterval::class, [$config['refresh_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['password']['refresh_token_ttl']]),
             ])
         ;
 
         $container
             ->getDefinition(RefreshTokenGrant::class)
             ->addMethodCall('setRefreshTokenTTL', [
-                new Definition(DateInterval::class, [$config['refresh_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['refresh_token']['refresh_token_ttl']]),
             ])
         ;
 
         $authCodeGrantDefinition = $container->getDefinition(AuthCodeGrant::class);
-        $authCodeGrantDefinition->replaceArgument('$authCodeTTL', new Definition(DateInterval::class, [$config['auth_code_ttl']]))
+        $authCodeGrantDefinition
+            ->replaceArgument('$authCodeTTL', new Definition(DateInterval::class, [$grantTypes['authorization_code']['auth_code_ttl']]))
             ->addMethodCall('setRefreshTokenTTL', [
-                new Definition(DateInterval::class, [$config['refresh_token_ttl']]),
+                new Definition(DateInterval::class, [$grantTypes['authorization_code']['refresh_token_ttl']]),
             ])
         ;
 
-        if (false === $config['require_code_challenge_for_public_clients']) {
+        if (false === $grantTypes['authorization_code']['require_code_challenge_for_public_clients']) {
             $authCodeGrantDefinition->addMethodCall('disableRequireCodeChallengeForPublicClients');
         }
 
         $container
             ->getDefinition(ImplicitGrant::class)
-            ->replaceArgument('$accessTokenTTL', new Definition(DateInterval::class, [$config['access_token_ttl']]))
+            ->replaceArgument('$accessTokenTTL', new Definition(DateInterval::class, [$grantTypes['implicit']['access_token_ttl']]))
         ;
     }
 

diff --git a/OAuth2Grants.php b/OAuth2Grants.php
@@ -41,14 +41,21 @@ final class OAuth2Grants
      */
     public const REFRESH_TOKEN = 'refresh_token';
 
+    public const MAP = [
+        self::AUTHORIZATION_CODE => 'authorization code',
+        self::CLIENT_CREDENTIALS => 'client credentials',
+        self::IMPLICIT => 'implicit',
+        self::PASSWORD => 'password',
+        self::REFRESH_TOKEN => 'refresh token',
+    ];
+
+    /**
+     * @deprecated Will be removed in v4, use {@see OAuth2Grants::MAP} instead
+     *
+     * @TODO Remove in v4.
+     */
     public static function has(string $grant): bool
     {
-        return \in_array($grant, [
-            self::CLIENT_CREDENTIALS,
-            self::PASSWORD,
-            self::REFRESH_TOKEN,
-            self::AUTHORIZATION_CODE,
-            self::IMPLICIT,
-        ]);
+        return isset(self::MAP[$grant]);
     }
 }