| 26 | | final class ClientRepository extends AbstractRepository implements ClientRepositoryInterface |
| 27 | | { |
| 28 | | public function getClientEntity(string $clientIdentifier): ?ClientEntityInterface |
| 29 | | { |
| 30 | | $query = sprintf( |
| 31 | | "SELECT client_id, client_secret, name, redirect_uri, grants, is_confidential |
| 32 | | FROM %s |
| 33 | | WHERE client_id = '%s'", |
| 34 | | $this->table('faqoauth_clients'), |
| 35 | | $this->db()->escape($clientIdentifier), |
| 36 | | ); |
| 37 | | |
| 38 | | $result = $this->db()->query($query); |
| 39 | | if ($result === false) { |
| 40 | | return null; |
| 41 | | } |
| 42 | | |
| 43 | | $row = $this->db()->fetchObject($result); |
| 44 | | if (!is_object($row)) { |
| 45 | | return null; |
| 46 | | } |
| 47 | | |
| 48 | | $clientIdentifier = (string) $row->client_id; |
| 49 | | if ($clientIdentifier === '') { |
| 50 | | return null; |
| 51 | | } |
| 52 | | |
| 53 | | $entity = new ClientEntity(); |
| 54 | | $entity->setIdentifier($clientIdentifier); |
| 55 | | $entity->secret = $row->client_secret !== null ? (string) $row->client_secret : null; |
| 56 | | $entity->setName((string) ($row->name ?? $row->client_id)); |
| 57 | | $entity->setRedirectUri((string) ($row->redirect_uri ?? '')); |
| 58 | | $entity->setConfidential((int) ($row->is_confidential ?? 1) === 1); |
| 59 | | |
| 60 | | $grants = array_filter(array_map('trim', explode(',', (string) ($row->grants ?? '')))); |
| 61 | | $entity->allowedGrants = array_values($grants); |
| 62 | | |
| 63 | | return $entity; |
| 64 | | } |
| 65 | | |
| 66 | | public function validateClient( |
| 67 | | string $clientIdentifier, |
| 68 | | #[\SensitiveParameter] |
| 69 | | ?string $clientSecret, |
| 70 | | ?string $grantType, |
| 71 | | ): bool { |
| 72 | | $client = $this->getClientEntity($clientIdentifier); |
| 73 | | if (!$client instanceof ClientEntity) { |
| 74 | | return false; |
| 75 | | } |
| 76 | | |
| 77 | | if ($grantType !== null && !$client->supportsGrantType($grantType)) { |
| 78 | | return false; |
| 79 | | } |
| 80 | | |
| 81 | | if (!$client->isConfidential()) { |
| 82 | | return true; |
| 83 | | } |
| 84 | | |
| 85 | | $storedSecret = $client->secret; |
| 86 | | if ($storedSecret === null || $clientSecret === null) { |
| 87 | | return false; |
| 88 | | } |
| 89 | | |
| 90 | | $passwordInfo = password_get_info($storedSecret); |
| 91 | | if (($passwordInfo['algoName'] ?? 'unknown') !== 'unknown') { |
| 92 | | return password_verify($clientSecret, $storedSecret); |
| 93 | | } |
| 94 | | |
| 95 | | return hash_equals($storedSecret, $clientSecret); |
| 96 | | } |
| 97 | | } |