diff -u b/simple_oauth_extras/src/Controller/Oauth2AuthorizeController.php b/simple_oauth_extras/src/Controller/Oauth2AuthorizeController.php --- b/simple_oauth_extras/src/Controller/Oauth2AuthorizeController.php +++ b/simple_oauth_extras/src/Controller/Oauth2AuthorizeController.php @@ -93,19 +93,9 @@ $client_drupal_entity = reset($client_drupal_entities); $is_third_party = $client_drupal_entity->get('third_party')->value; - if ($request->get('scope')) { - $scope_ids = explode(' ', $request->get('scope')); - } - else { - $scopes = $client_drupal_entity->get('roles')->getValue(); - $scope_ids = array_column($scopes, 'target_id'); - } - $access_confirmed = $this->wasAccessConfirmed($client_drupal_entity->id(), $scope_ids); - // Login user may skip the grant step if the client is not third party or - // the client was access the same (or broader) set - // of scopes confirmed before. - if ($this->currentUser()->isAuthenticated() && (!$is_third_party || $access_confirmed)) { + // Login user may skip the grant step if the client is not third party + if ($this->currentUser()->isAuthenticated() && !$is_third_party) { if ($request->get('response_type') == 'code') { $grant_type = 'code'; } @@ -148,36 +138,2 @@ - /** - * Check the client was access same scopes confirmed before. - * - * @param string $client_id - * Client ID. - * @param array $scopes - * Scopes. - * - * @return bool - */ - protected function wasAccessConfirmed($client_id, array $scopes) { - if (!empty($scopes)) { - try { - $token_storage = $this->entityTypeManager()->getStorage('oauth2_token'); - } - catch (InvalidPluginDefinitionException $e) { - return FALSE; - } - $previous_token_entities = $token_storage - ->loadByProperties([ - 'bundle' => 'access_token', - 'auth_user_id' => $this->currentUser()->id(), - 'client' => $client_id, - 'scopes' => $scopes, - 'status' => 1, - ]); - if (!empty($previous_token_entities)) { - return TRUE; - } - } - - return FALSE; - } - } diff -u b/simple_oauth_extras/tests/src/Functional/AuthCodeFunctionalTest.php b/simple_oauth_extras/tests/src/Functional/AuthCodeFunctionalTest.php --- b/simple_oauth_extras/tests/src/Functional/AuthCodeFunctionalTest.php +++ b/simple_oauth_extras/tests/src/Functional/AuthCodeFunctionalTest.php @@ -120,7 +120,7 @@ ]); $assert_session = $this->assertSession(); $assert_session->buttonExists(t('Login')); - $assert_session->responseContains('An external client application is requesting access'); + $assert_session->responseContains(t('An external client application is requesting access')); // 2. Log the user in and try again. This time we should get a code // immediately without granting, because the consumer is not 3rd party. @@ -140,84 +140,6 @@ $this->assertValidTokenResponse($response, TRUE); } - /** - * Test the valid AuthCode grant if the client was access confirmed before. - */ - public function testAccessConfirmedClientAuthCodeGrant() { - // 1. The user does not grant so we can test that a subsequent request to - // this page still shows the grant form. - $valid_params = [ - 'response_type' => 'code', - 'client_id' => $this->client->uuid(), - 'client_secret' => $this->clientSecret, - ]; - $this->drupalGet($this->authorizeUrl->toString(), [ - 'query' => $valid_params, - ]); - $this->drupalLogin($this->user); - $this->drupalGet($this->authorizeUrl->toString(), [ - 'query' => $valid_params, - ]); - $this->assertGrantForm(); - // 2. The user did not accept before then display grant page. - $this->drupalGet($this->authorizeUrl->toString(), [ - 'query' => $valid_params, - ]); - $this->assertGrantForm(); - // 3. The user grant and get the token. - $this->drupalPostForm($this->authorizeUrl, [], 'Grant', [ - 'query' => $valid_params, - ]); - // Store the code for the second part of the flow. - $code = $this->getAndValidateCodeFromResponse(); - $response = $this->postGrantedCodeWithScopes($code, $this->scope); - $this->assertValidTokenResponse($response, TRUE); - // 4. The user accepted before for a more limited set of scopes then display - // grant page. - $new_role = Role::create([ - 'id' => $this->getRandomGenerator()->name(8, TRUE), - 'label' => $this->getRandomGenerator()->word(5), - 'is_admin' => FALSE, - ]); - $new_role->save(); - $this->user->addRole($new_role->id()); - $this->user->save(); - $valid_params = [ - 'response_type' => 'code', - 'client_id' => $this->client->uuid(), - 'client_secret' => $this->clientSecret, - 'scope' => $this->scope . " " . $new_role->id(), - ]; - $this->drupalGet($this->authorizeUrl->toString(), [ - 'query' => $valid_params, - ]); - $this->assertGrantForm(); - // 5. The user grant and get the token. - $this->drupalPostForm($this->authorizeUrl, [], 'Grant', [ - 'query' => $valid_params, - ]); - // Store the code for the second part of the flow. - $code = $this->getAndValidateCodeFromResponse(); - $response = $this->postGrantedCodeWithScopes( - $code, - $this->scope . " " . $new_role->id() - ); - $this->assertValidTokenResponse($response, TRUE); - // 6. The user accepted before for a broader set of scopes then get code - // directly. - $valid_params = [ - 'response_type' => 'code', - 'client_id' => $this->client->uuid(), - 'client_secret' => $this->clientSecret, - // Select one of the previously selected scopes. - 'scope' => explode(' ', $this->scope)[0], - ]; - $this->drupalGet($this->authorizeUrl->toString(), [ - 'query' => $valid_params, - ]); - // Validate the code from the response. - $this->getAndValidateCodeFromResponse(); - } /** * Helper function to assert the current page is a valid grant form. @@ -275,2 +197,3 @@ } + } diff -u b/simple_oauth_extras/tests/src/Functional/ImplicitFunctionalTest.php b/simple_oauth_extras/tests/src/Functional/ImplicitFunctionalTest.php --- b/simple_oauth_extras/tests/src/Functional/ImplicitFunctionalTest.php +++ b/simple_oauth_extras/tests/src/Functional/ImplicitFunctionalTest.php @@ -106,7 +106,7 @@ ]); $assert_session = $this->assertSession(); $assert_session->buttonExists(t('Login')); - $assert_session->responseContains('An external client application is requesting access'); + $assert_session->responseContains(t('An external client application is requesting access')); // 2. Log the user in and try again. $this->drupalLogin($this->user); @@ -114,7 +114,7 @@ 'query' => $valid_params, ]); $assert_session = $this->assertSession(); - $assert_session->statusCodeEquals(500); + $assert_session->responseContains('Fatal error. Unable to get the authorization server.'); $this ->config('simple_oauth_extras.settings') ->set('use_implicit', TRUE)