use Friendica\Core\Logger;
use Friendica\Database\Database;
use Friendica\Database\DBA;
+use Friendica\Module\BaseApi;
use Friendica\Util\DateTimeFormat;
/**
*/
class OAuth
{
- const SCOPE_READ = 'read';
- const SCOPE_WRITE = 'write';
- const SCOPE_FOLLOW = 'follow';
- const SCOPE_PUSH = 'push';
-
/**
* @var bool|int
*/
protected static $current_token = [];
/**
- * Check if the provided scope does exist
- *
- * @param string $scope the requested scope (read, write, follow, push)
+ * Get current user id, returns 0 if not logged in
*
- * @return bool "true" if the scope is allowed
+ * @return int User ID
*/
- public static function isAllowedScope(string $scope)
+ public static function getCurrentUserID()
{
- $token = self::getCurrentApplicationToken();
-
- if (empty($token)) {
- Logger::notice('Empty application token');
- return false;
- }
-
- if (!isset($token[$scope])) {
- Logger::warning('The requested scope does not exist', ['scope' => $scope, 'application' => $token]);
- return false;
- }
-
- if (empty($token[$scope])) {
- Logger::warning('The requested scope is not allowed', ['scope' => $scope, 'application' => $token]);
- return false;
+ if (empty(self::$current_user_id)) {
+ $token = self::getCurrentApplicationToken();
+ if (!empty($token['uid'])) {
+ self::$current_user_id = $token['uid'];
+ } else {
+ self::$current_user_id = 0;
+ }
}
- return true;
+ return (int)self::$current_user_id;
}
/**
return self::$current_token;
}
- /**
- * Get current user id, returns 0 if not logged in
- *
- * @return int User ID
- */
- public static function getCurrentUserID()
- {
- if (empty(self::$current_user_id)) {
- $token = self::getCurrentApplicationToken();
- if (!empty($token['uid'])) {
- self::$current_user_id = $token['uid'];
- } else {
- self::$current_user_id = 0;
- }
- }
-
- return (int)self::$current_user_id;
- }
-
/**
* Get the user token via the Bearer token
*
{
$authorization = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
+ if (empty($authorization)) {
+ // workaround for HTTP-auth in CGI mode
+ $authorization = $_SERVER['REDIRECT_REMOTE_USER'] ?? '';
+ }
+
if (substr($authorization, 0, 7) != 'Bearer ') {
return [];
}
- $bearer = trim(substr($authorization, 7));
-
- $condition = ['access_token' => $bearer];
+ $condition = ['access_token' => trim(substr($authorization, 7))];
$token = DBA::selectFirst('application-view', ['uid', 'id', 'name', 'website', 'created_at', 'read', 'write', 'follow', 'push'], $condition);
if (!DBA::isResult($token)) {
'code' => $code,
'access_token' => $access_token,
'scopes' => $scope,
- 'read' => (stripos($scope, self::SCOPE_READ) !== false),
- 'write' => (stripos($scope, self::SCOPE_WRITE) !== false),
- 'follow' => (stripos($scope, self::SCOPE_FOLLOW) !== false),
- 'push' => (stripos($scope, self::SCOPE_PUSH) !== false),
+ 'read' => (stripos($scope, BaseApi::SCOPE_READ) !== false),
+ 'write' => (stripos($scope, BaseApi::SCOPE_WRITE) !== false),
+ 'follow' => (stripos($scope, BaseApi::SCOPE_FOLLOW) !== false),
+ 'push' => (stripos($scope, BaseApi::SCOPE_PUSH) !== false),
'created_at' => DateTimeFormat::utcNow(DateTimeFormat::MYSQL)];
- foreach ([self::SCOPE_READ, self::SCOPE_WRITE, self::SCOPE_WRITE, self::SCOPE_PUSH] as $scope) {
+ foreach ([BaseApi::SCOPE_READ, BaseApi::SCOPE_WRITE, BaseApi::SCOPE_WRITE, BaseApi::SCOPE_PUSH] as $scope) {
if ($fields[$scope] && !$application[$scope]) {
Logger::warning('Requested token scope is not allowed for the application', ['token' => $fields, 'application' => $application]);
}