Add OpenID Response Type

examples/src/Repositories/IdTokenRepository.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server\Repositories;
+
+use DateTimeImmutable;
+use Lcobucci\JWT\Encoding\ChainedFormatter;
+use Lcobucci\JWT\Encoding\JoseEncoder;
+use Lcobucci\JWT\Token\Builder;
+use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
+
+/**
+ * Exmaple implemnation of IdTokenRepositoryInterface
+ *
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+class IdTokenRepository implements IdTokenRepositoryInterface
+{
+    public function __construct(private string $issuedBy, private ?string $nonce = null)
+    {
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getBuilder(AccessTokenEntityInterface $accessToken): Builder
+    {
+        $builder = (new Builder(new JoseEncoder(), ChainedFormatter::withUnixTimestampDates()))
+            ->permittedFor($accessToken->getClient()->getIdentifier())
+            ->issuedBy($this->issuedBy)
+            ->issuedAt(new DateTimeImmutable())
+            ->expiresAt($accessToken->getExpiryDateTime())
+            ->relatedTo($accessToken->getUserIdentifier());
+
+        if ($this->nonce) {
+            $builder->withClaim('nonce', $this->nonce);
+        }
+
+        return $builder;
+    }
+}

src/ClaimExtractor.php

@@ -0,0 +1,178 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server;
+
+use InvalidArgumentException;
+use League\OAuth2\Server\Entities\ClaimSetEntry;
+use League\OAuth2\Server\Entities\ClaimSetEntryInterface;
+use League\OAuth2\Server\Entities\ClaimSetInterface;
+use League\OAuth2\Server\Entities\ScopeEntityInterface;
+
+use function array_filter;
+use function array_intersect;
+use function array_keys;
+use function array_merge;
+use function in_array;
+use function sprintf;
+
+/**
+ * ClaimExtractor
+ *
+ * @link https://github.com/steverhoades/oauth2-openid-connect-server
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ */
+class ClaimExtractor implements ClaimExtractorInterface
+{
+    /**
+     * claimSets
+     *
+     * @var ClaimSetEntryInterface[]
+     */
+    protected array $claimSets = [];
+
+    /**
+     * Protected claims
+     *
+     * @var string[]
+     */
+    protected array $protectedClaims = ['profile', 'email', 'address', 'phone'];
+
+    /**
+     * ClaimExtractor constructor
+     *
+     * @param ClaimSetEntryInterface[] $claimSets
+     */
+    public function __construct(array $claimSets = [])
+    {
+        $this->claimSets = self::getDefaultClaimSetEnties();
+        foreach ($claimSets as $claimSet) {
+            $this->addClaimSet($claimSet);
+        }
+    }
+
+    /**
+     * @return $this
+     *
+     * @throws \InvalidArgumentException
+     */
+    public function addClaimSet(ClaimSetEntryInterface $claimSetEntry): ClaimExtractor
+    {
+        if (in_array($claimSetEntry->getScope(), $this->protectedClaims) && !$this->getClaimSet($claimSetEntry->getScope())) {
+            throw new InvalidArgumentException(
+                sprintf('%s is a protected scope and is pre-defined by the OpenID Connect specification.', $claimSetEntry->getScope())
+            );
+        }
+
+        $this->claimSets[] = $claimSetEntry;
+
+        return $this;
+    }
+
+    public function getClaimSet(string $scope): ?ClaimSetEntryInterface
+    {
+        foreach ($this->claimSets as $set) {
+            if ($set->getScope() === $scope) {
+                return $set;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Get claimSets
+     *
+     * @return ClaimSetInterface[]
+     */
+    public function getClaimSets(): array
+    {
+        return $this->claimSets;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function extract(array $scopes, array $claims): array
+    {
+        $claimData  = [];
+        $keys = array_keys($claims);
+
+        foreach ($scopes as $scope) {
+            $scopeName = ($scope instanceof ScopeEntityInterface) ? $scope->getIdentifier() : $scope;
+
+            $claimSet = $this->getClaimSet($scopeName);
+            if (null === $claimSet) {
+                continue;
+            }
+
+            $intersected = array_intersect($claimSet->getClaims(), $keys);
+
+            if (empty($intersected)) {
+                continue;
+            }
+
+            $data = array_filter(
+                $claims,
+                function ($key) use ($intersected) {
+                    return in_array($key, $intersected);
+                },
+                ARRAY_FILTER_USE_KEY
+            );
+
+            $claimData = array_merge($claimData, $data);
+        }
+
+        return $claimData;
+    }
+
+    /**
+     * Create a array default openID connect claims
+     *
+     * @see http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
+     *
+     * @return ClaimSetEntry[]
+     */
+    public static function getDefaultClaimSetEnties(): array
+    {
+        return [
+            new ClaimSetEntry('profile', [
+                'name',
+                'family_name',
+                'given_name',
+                'middle_name',
+                'nickname',
+                'preferred_username',
+                'profile',
+                'picture',
+                'website',
+                'gender',
+                'birthdate',
+                'zoneinfo',
+                'locale',
+                'updated_at',
+            ]),
+            new ClaimSetEntry('email', [
+                'email',
+                'email_verified',
+            ]),
+            new ClaimSetEntry('address', [
+                'address',
+            ]),
+            new ClaimSetEntry('phone', [
+                'phone_number',
+                'phone_number_verified',
+            ]),
+            new ClaimSetEntry('openid', [
+                'nonce',
+                'auth_time',
+                'acr',
+                'amr',
+                'azp',
+            ]),
+        ];
+    }
+}

src/ClaimExtractorInterface.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server;
+
+use League\OAuth2\Server\Entities\ScopeEntityInterface;
+
+interface ClaimExtractorInterface
+{
+    /**
+     * For given scopes and aggregated claims get all claims that have been configured on the extractor.
+     *
+     * @param array<int, ScopeEntityInterface> $scopes
+     * @param array<string, string>            $claims
+     *
+     * @return array<string, string>
+     */
+    public function extract(array $scopes, array $claims): array;
+}

src/Entities/ClaimSetEntry.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server\Entities;
+
+/**
+ * ClaimSetEntry
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+class ClaimSetEntry implements ClaimSetEntryInterface
+{
+    /**
+     * Summary of __construct
+     *
+     * @param string   $scope  Scope of the claimset
+     * @param string[] $claims The claims
+     */
+    public function __construct(
+        protected string $scope,
+        protected array $claims
+    ) {
+    }
+
+    /**
+     * Get scope
+     */
+    public function getScope(): string
+    {
+        return $this->scope;
+    }
+
+    /**
+     * Get claims
+     *
+     * @return string[]
+     */
+    public function getClaims(): array
+    {
+        return $this->claims;
+    }
+}

src/Entities/ClaimSetEntryInterface.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server\Entities;
+
+/**
+ * ClaimSetEntryInterface
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+interface ClaimSetEntryInterface extends ClaimSetInterface
+{
+    public function getScope(): string;
+}

src/Entities/ClaimSetInterface.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server\Entities;
+
+/**
+ * ClaimSetEntryInterface
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+interface ClaimSetInterface
+{
+    /**
+     * Get Claims
+     *
+     * @return string[]
+     */
+    public function getClaims(): array;
+}

src/IdTokenClaimsCreatedEvent.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server;
+
+use Lcobucci\JWT\Builder;
+
+/**
+ * IdTokenClaimsCreatedEvent Event helps to extend claims of the id_token
+ *
+ * A usecase is to add nonce If requested by the client
+ *
+ * @author Marc Riemer <[email protected]>
+ */
+final class IdTokenClaimsCreatedEvent extends IdTokenEvent
+{
+    /**
+     * Builder
+     */
+    private Builder $builder;
+
+    public function __construct(string $name, Builder $builder)
+    {
+        parent::__construct($name);
+        $this->builder = $builder;
+    }
+
+    public function getBuilder(): Builder
+    {
+        return $this->builder;
+    }
+}

src/IdTokenEvent.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace League\OAuth2\Server;
+
+use League\OAuth2\Server\EventEmitting\AbstractEvent;
+
+/**
+ * IdTokenEvent
+ *
+ * @author Marc Riemer <[email protected]>
+ */
+class IdTokenEvent extends AbstractEvent
+{
+    public const ID_TOKEN_ISSUED = 'id_token.issued';
+
+    // This event can be used to extent claims of the id_token
+    public const ID_TOKEN_CLAIMS_CREATED = 'id_token.claims.created';
+}