Feature/safety net

.github/workflows/ci-linux.yml

@@ -81,7 +81,7 @@ jobs:
       - name: CS
         run: |
           cd galette-core/galette/plugins/plugin-oauth2
-          ../../vendor/bin/phpcs lib/ ./*.php
+          ../../vendor/bin/phpcs lib/ tests/ ./*.php
 
       - name: CS Fixer
         if: matrix.php-is-min

_dependencies.php

@@ -15,6 +15,7 @@
  * @author Johan Cwiklinski <johan@x-tnd.be>
  */
 
+use Analog\Analog;
 use Galette\Core\Preferences;
 use GaletteOAuth2\Repositories\AccessTokenRepository;
 use GaletteOAuth2\Repositories\AuthCodeRepository;
@@ -31,6 +32,7 @@
 use RKA\SessionMiddleware;
 use Slim\Flash\Messages;
 
+/** @var \Slim\Routing\RouteCollectorProxy<\DI\Container> $app */
 $container = $app->getContainer();
 
 $container->set(

_routes.php

@@ -20,13 +20,18 @@
 use GaletteOAuth2\Controllers\LoginController;
 use GaletteOAuth2\Middleware\Authentication;
 
+/**
+ * @var \Slim\Routing\RouteCollectorProxy<\DI\Container> $app
+ * @var array<string, mixed> $module
+ */
+
 //Include specific classes (league/oauth2_server and tools)
-require_once 'vendor/autoload.php';
+require_once __DIR__ . '/vendor/autoload.php';
 
 //Constants and classes from plugin
 require_once $module['root'] . '/_config.inc.php';
 
-require '_dependencies.php';
+require __DIR__ . '/_dependencies.php';
 
 //login is always called by a http_redirect
 $app->get(

lib/GaletteOAuth2/Authorization/UserHelper.php

@@ -286,6 +286,8 @@ public static function getUserData(Container $container, int $id, string $acl, a
      *
      * @param Adherent $member Member
      * @param bool     $legacy Legacy mode for data
+     *
+     * @return string[]
      */
     protected static function getUserGroups(Adherent $member, bool $legacy = false): array
     {
@@ -369,10 +371,12 @@ public static function getAuthorization(Config $config, string $client_id): stri
     /**
      * Merge requested and configured scopes
      *
-     * @param Config $config Config instance
+     * @param ?Config         $config           Config instance
+     * @param string          $client_id        Client app identifier
+     * @param string[]|string $requested_scopes Requested scopes from query string
+     * @param bool            $with_default     Add default scope
      *
-     * @param string       $client_id        Client app identifier
-     * @param array|string $requested_scopes Requested scopes from query string
+     * @return string[]
      */
     public static function mergeScopes(
         ?Config $config,

lib/GaletteOAuth2/Controllers/AuthorizationController.php

@@ -165,15 +165,8 @@ public function doAuthorize(Request $request, Response $response): Response|Resp
                 }
                 $authRequest->setScopes($req_scopes);
             } else {
-                $authRequest->setAuthorizationApproved(true);
-                $authRequest->setScopes([]);
-
-                throw OAuthServerException::accessDenied(
-                    sprintf(
-                        _T('Default scope (%s) has not been authorized.', 'oauth2'),
-                        'member'
-                    )
-                );
+                //refused: client will be redirected with an access_denied error
+                $authRequest->setAuthorizationApproved(false);
             }
 
             // Return the HTTP redirect response

lib/GaletteOAuth2/Controllers/LoginController.php

@@ -227,6 +227,11 @@ public function error(Request $request, Response $response): Response
         return $response;
     }
 
+    /**
+     * Prepare login form variables, null if client is invalid
+     *
+     * @return ?array<string, string>
+     */
     private function prepareVarsForm(): ?array
     {
         $client_id = $this->session->request_args['client_id'] ?? null;

lib/GaletteOAuth2/Entities/ClientEntity.php

@@ -25,12 +25,15 @@ final class ClientEntity implements ClientEntityInterface
     use EntityTrait;
     use ClientTrait;
 
-    public function setName($name): void
+    public function setName(string $name): void
     {
         $this->name = $name;
     }
 
-    public function setRedirectUri($uri): void
+    /**
+     * @param string|string[] $uri Redirect URI(s)
+     */
+    public function setRedirectUri(string|array $uri): void
     {
         $this->redirectUri = $uri;
     }

lib/GaletteOAuth2/Repositories/ClientRepository.php

@@ -11,7 +11,7 @@
 namespace GaletteOAuth2\Repositories;
 
 use Analog\Analog;
-use DI\Container;
+use Psr\Container\ContainerInterface;
 use GaletteOAuth2\Entities\ClientEntity;
 use GaletteOAuth2\Tools\Config;
 use GaletteOAuth2\Tools\Debug;
@@ -28,10 +28,10 @@ final class ClientRepository implements ClientRepositoryInterface
 {
     private const string EXAMPLE_PASSWORD = 'abc123';
 
-    private Container $container;
+    private ContainerInterface $container;
     private Config $config;
 
-    public function __construct(Container $container)
+    public function __construct(ContainerInterface $container)
     {
         $this->container = $container;
         $this->config = $this->container->get(Config::class);

lib/GaletteOAuth2/Repositories/ScopeRepository.php

@@ -26,6 +26,11 @@
  */
 final class ScopeRepository implements ScopeRepositoryInterface
 {
+    /**
+     * Known scopes, with their description
+     *
+     * @return array<string, array{description: string}>
+     */
     public static function knownScopes(): array
     {
         return [

lib/GaletteOAuth2/Tools/Config.php

@@ -21,6 +21,9 @@ final class Config extends \Noodlehaus\Config
     /** @var string[]|string */
     private array|string $path;
 
+    /**
+     * @param string[]|string $values Configuration file(s)
+     */
     public function __construct(array|string $values)
     {
         $this->path = $values;

lib/GaletteOAuth2/Tools/Debug.php

@@ -30,7 +30,7 @@ final class Debug
         'code_verifier',
     ];
 
-    public static function printVar($expression, bool $return = true)
+    public static function printVar(mixed $expression): string
     {
         $export = print_r($expression, true);
         $patterns = [
@@ -39,12 +39,8 @@ public static function printVar($expression, bool $return = true)
             "/=>[ ]?\n[ ]+\\[/" => '=> [',
             "/([ ]*)(\\'[^\\']+\\') => ([\\[\\'])/" => '$1$2 => $3',
         ];
-        $export = preg_replace(array_keys($patterns), array_values($patterns), $export);
 
-        if ($return) {
-            return $export;
-        }
-        echo $export;
+        return preg_replace(array_keys($patterns), array_values($patterns), $export);
     }
 
     public static function log(string $txt): void

phpstan.neon

@@ -1,9 +1,14 @@
 parameters:
     parallel:
         maximumNumberOfProcesses: 2
-    level: 5
+    level: 6
     paths:
         - lib/
+        - tests/
+        - _config.inc.php
+        - _define.php
+        - _dependencies.php
+        - _routes.php
     scanFiles:
         - _config.inc.php
         - ../../includes/sys_config/paths.inc.php

tests/GaletteOAuth2/Authorization/tests/units/UserHelper.php

@@ -8,6 +8,7 @@
 
 namespace GaletteOauth2\Authorization\tests\units;
 
+use Analog\Analog;
 use Galette\Tests\GaletteTestCase;
 use PHPUnit\Framework\Attributes\DataProvider;
 
@@ -313,7 +314,7 @@ public function testRequireAdmin()
     /**
      * Data provider for not found members
      *
-     * @return array
+     * @return array<array<int>>
      */
     public static function memberNotFoundProvider(): array
     {
@@ -326,10 +327,12 @@ public static function memberNotFoundProvider(): array
     /**
      * Test with a not found member
      *
+     * @param int $member_id Member ID
+     *
      * @return void
      */
     #[DataProvider('memberNotFoundProvider')]
-    public function testMemberNotFound($member_id)
+    public function testMemberNotFound(int $member_id): void
     {
         global $container;
 
@@ -346,7 +349,7 @@ public function testMemberNotFound($member_id)
             $this->assertEquals("User not found.", $e->getMessage());
         }
         $this->assertTrue($exception_thrown);
-        $this->expectLogEntry(\Analog::ERROR, 'No member #' . $member_id);
+        $this->expectLogEntry(Analog::ERROR, 'No member #' . $member_id);
     }
 
     /**
@@ -485,7 +488,7 @@ public function testGetAuthorizations(): void
             \GaletteOAuth2\Authorization\UserHelper::getAuthorization($config, 'galette_test')
         );
         $this->expectLogEntry(
-            \Analog::ERROR,
+            Analog::ERROR,
             'Invalid authorization "unknown" for client "galette_test"'
         );