bsiggel
127fa6503b
- Updated copyright headers in 3,055 core application files - Changed 'Copyright (C) 2014-2025' to 'Copyright (C) 2014-2026' - Added 123 new files from EspoCRM core updates - Removed 4 deprecated files - Total changes: 61,637 insertions, 54,283 deletions This is a routine maintenance update for the new year 2026.
564 lines
15 KiB
PHP
564 lines
15 KiB
PHP
<?php
|
||
/************************************************************************
|
||
* This file is part of EspoCRM.
|
||
*
|
||
* EspoCRM – Open Source CRM application.
|
||
* Copyright (C) 2014-2026 EspoCRM, Inc.
|
||
* Website: https://www.espocrm.com
|
||
*
|
||
* This program is free software: you can redistribute it and/or modify
|
||
* it under the terms of the GNU Affero General Public License as published by
|
||
* the Free Software Foundation, either version 3 of the License, or
|
||
* (at your option) any later version.
|
||
*
|
||
* This program is distributed in the hope that it will be useful,
|
||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||
* GNU Affero General Public License for more details.
|
||
*
|
||
* You should have received a copy of the GNU Affero General Public License
|
||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||
*
|
||
* The interactive user interfaces in modified source and object code versions
|
||
* of this program must display Appropriate Legal Notices, as required under
|
||
* Section 5 of the GNU Affero General Public License version 3.
|
||
*
|
||
* In accordance with Section 7(b) of the GNU Affero General Public License version 3,
|
||
* these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
|
||
************************************************************************/
|
||
|
||
namespace Espo\Core\ExternalAccount\Clients;
|
||
|
||
use Espo\Core\Exceptions\Error;
|
||
use Espo\Core\Utils\DateTime as DateTimeUtil;
|
||
use Espo\Core\Utils\Json;
|
||
use Espo\Core\ExternalAccount\ClientManager;
|
||
use Espo\Core\ExternalAccount\OAuth2\Client;
|
||
use Espo\Core\Utils\Log;
|
||
|
||
use Exception;
|
||
use DateTime;
|
||
use LogicException;
|
||
|
||
abstract class OAuth2Abstract implements IClient
|
||
{
|
||
/** @var Client */
|
||
protected $client = null;
|
||
/** @var ?ClientManager */
|
||
protected $manager = null;
|
||
/** @var Log */
|
||
protected $log;
|
||
|
||
/** @var string[] */
|
||
protected $paramList = [
|
||
'endpoint',
|
||
'tokenEndpoint',
|
||
'clientId',
|
||
'clientSecret',
|
||
'tokenType',
|
||
'accessToken',
|
||
'refreshToken',
|
||
'redirectUri',
|
||
'expiresAt',
|
||
];
|
||
|
||
/** @var ?string */
|
||
protected $endpoint = null;
|
||
/**
|
||
* @noinspection PhpUnused
|
||
* @var ?string
|
||
*/
|
||
protected $tokenEndpoint = null;
|
||
/**
|
||
* @noinspection PhpUnused
|
||
* @var ?string
|
||
*/
|
||
protected $redirectUri = null;
|
||
/** @var ?string */
|
||
protected $clientId = null;
|
||
/** @var ?string */
|
||
protected $clientSecret = null;
|
||
/**
|
||
* @noinspection PhpUnused
|
||
* @var ?string
|
||
*/
|
||
protected $tokenType = null;
|
||
/** @var ?string */
|
||
protected $accessToken = null;
|
||
/** @var ?string */
|
||
protected $refreshToken = null;
|
||
/** @var ?string */
|
||
protected $expiresAt = null;
|
||
|
||
const ACCESS_TOKEN_EXPIRATION_MARGIN = '20 seconds';
|
||
const LOCK_TIMEOUT = 5;
|
||
const LOCK_CHECK_STEP = 0.5;
|
||
|
||
/**
|
||
* @param array<string, mixed> $params
|
||
*/
|
||
public function __construct(
|
||
Client $client,
|
||
array $params = [],
|
||
?ClientManager $manager = null,
|
||
?Log $log = null
|
||
) {
|
||
$this->client = $client;
|
||
$this->manager = $manager;
|
||
$this->log = $log ?? $GLOBALS['log'];
|
||
|
||
$this->setParams($params);
|
||
}
|
||
|
||
/**
|
||
* @param string $name
|
||
* @return mixed
|
||
*/
|
||
public function getParam($name)
|
||
{
|
||
if (in_array($name, $this->paramList)) {
|
||
return $this->$name;
|
||
}
|
||
|
||
return null;
|
||
}
|
||
|
||
/**
|
||
* @param string $name
|
||
* @param mixed $value
|
||
* @return void
|
||
*/
|
||
public function setParam($name, $value)
|
||
{
|
||
if (in_array($name, $this->paramList)) {
|
||
$methodName = 'set' . ucfirst($name);
|
||
|
||
if (method_exists($this->client, $methodName)) {
|
||
$this->client->$methodName($value);
|
||
}
|
||
|
||
$this->$name = $value;
|
||
}
|
||
}
|
||
|
||
/**
|
||
* @param array<string, mixed> $params
|
||
* @return void
|
||
*/
|
||
public function setParams(array $params)
|
||
{
|
||
foreach ($this->paramList as $name) {
|
||
if (array_key_exists($name, $params)) {
|
||
$this->setParam($name, $params[$name]);
|
||
}
|
||
}
|
||
}
|
||
|
||
/**
|
||
* @param array{
|
||
* accessToken: ?string,
|
||
* tokenType: ?string,
|
||
* expiresAt?: ?string,
|
||
* refreshToken?: ?string
|
||
* } $data
|
||
* @return void
|
||
* @throws Error
|
||
*/
|
||
protected function afterTokenRefreshed(array $data): void
|
||
{
|
||
$this->manager?->storeAccessToken($this, $data);
|
||
}
|
||
|
||
/**
|
||
* @param array<string, mixed> $result
|
||
* @return array{
|
||
* accessToken: ?string,
|
||
* tokenType: ?string,
|
||
* refreshToken: ?string,
|
||
* expiresAt: ?string,
|
||
* }
|
||
*/
|
||
protected function getAccessTokenDataFromResponseResult($result): array
|
||
{
|
||
$data = [];
|
||
|
||
$data['accessToken'] = $result['access_token'] ?? null;
|
||
$data['tokenType'] = $result['token_type'] ?? null;
|
||
$data['expiresAt'] = null;
|
||
|
||
if (isset($result['refresh_token']) && $result['refresh_token'] !== $this->refreshToken) {
|
||
$data['refreshToken'] = $result['refresh_token'];
|
||
}
|
||
|
||
if (isset($result['expires_in']) && is_numeric($result['expires_in'])) {
|
||
$data['expiresAt'] = (new DateTime())
|
||
->modify('+' . $result['expires_in'] . ' seconds')
|
||
->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
|
||
}
|
||
|
||
/**
|
||
* @var array{
|
||
* accessToken: ?string,
|
||
* tokenType: ?string,
|
||
* refreshToken: ?string,
|
||
* expiresAt: ?string,
|
||
* }
|
||
*/
|
||
return $data;
|
||
}
|
||
|
||
/**
|
||
* @return ?array{
|
||
* accessToken: ?string,
|
||
* tokenType: ?string,
|
||
* expiresAt: ?string,
|
||
* refreshToken: ?string,
|
||
* }
|
||
* @throws Exception
|
||
*/
|
||
public function getAccessTokenFromAuthorizationCode(string $code)
|
||
{
|
||
$response = $this->client->getAccessToken(
|
||
$this->getParam('tokenEndpoint'),
|
||
Client::GRANT_TYPE_AUTHORIZATION_CODE,
|
||
[
|
||
'code' => $code,
|
||
'redirect_uri' => $this->getParam('redirectUri'),
|
||
]
|
||
);
|
||
|
||
if ($response['code'] != 200) {
|
||
$this->log->debug("OAuth getAccessTokenFromAuthorizationCode; Response: " . Json::encode($response));
|
||
|
||
return null;
|
||
}
|
||
|
||
if (empty($response['result'])) {
|
||
$this->log->debug("OAuth getAccessTokenFromAuthorizationCode; Response: " . Json::encode($response));
|
||
|
||
return null;
|
||
}
|
||
|
||
/** @var array<string, mixed> $result */
|
||
$result = $response['result'];
|
||
|
||
$data = $this->getAccessTokenDataFromResponseResult($result);
|
||
|
||
$data['refreshToken'] = $result['refresh_token'] ?? null;
|
||
|
||
/**
|
||
* @var array{
|
||
* accessToken: ?string,
|
||
* tokenType: ?string,
|
||
* expiresAt: ?string,
|
||
* refreshToken: ?string,
|
||
* }
|
||
*/
|
||
return $data;
|
||
}
|
||
|
||
/**
|
||
* @return non-empty-string
|
||
*/
|
||
protected function getPingUrl()
|
||
{
|
||
throw new LogicException("Ping is not implemented.");
|
||
}
|
||
|
||
/**
|
||
* @return bool
|
||
*/
|
||
public function ping()
|
||
{
|
||
if (empty($this->accessToken) || empty($this->clientId) || empty($this->clientSecret)) {
|
||
return false;
|
||
}
|
||
|
||
$url = $this->getPingUrl();
|
||
|
||
try {
|
||
$this->request($url);
|
||
|
||
return true;
|
||
} catch (Exception) {
|
||
return false;
|
||
}
|
||
}
|
||
|
||
/**
|
||
* @return void
|
||
* @throws Error
|
||
*/
|
||
public function handleAccessTokenActuality()
|
||
{
|
||
if (!$this->getParam('expiresAt')) {
|
||
return;
|
||
}
|
||
|
||
try {
|
||
$dt = new DateTime($this->getParam('expiresAt'));
|
||
} catch (Exception) {
|
||
$this->log->debug("Oauth: Bad expires-at parameter stored for client $this->clientId.");
|
||
|
||
return;
|
||
}
|
||
|
||
$dt->modify('-' . $this::ACCESS_TOKEN_EXPIRATION_MARGIN);
|
||
|
||
if ($dt->format('U') > (new DateTime())->format('U')) {
|
||
return;
|
||
}
|
||
|
||
$this->log->debug("Oauth: Refreshing expired token for client $this->clientId.");
|
||
|
||
if (!$this->isLocked()) {
|
||
$this->refreshToken();
|
||
|
||
return;
|
||
}
|
||
|
||
$until = microtime(true) + $this::LOCK_TIMEOUT;
|
||
|
||
while (true) {
|
||
usleep($this::LOCK_CHECK_STEP * 1000000);
|
||
|
||
if (!$this->isLocked()) {
|
||
$this->log->debug("Oauth: Waited until unlocked for client $this->clientId.");
|
||
|
||
$this->reFetch();
|
||
|
||
return;
|
||
}
|
||
|
||
if (microtime(true) > $until) {
|
||
$this->log->debug("Oauth: Waited until unlocked but timed out for client $this->clientId.");
|
||
|
||
$this->unlock();
|
||
|
||
break;
|
||
}
|
||
}
|
||
|
||
$this->refreshToken();
|
||
}
|
||
|
||
/**
|
||
* @throws Error
|
||
* @phpstan-impure
|
||
*/
|
||
protected function isLocked(): bool
|
||
{
|
||
if (!$this->manager) {
|
||
return false;
|
||
}
|
||
|
||
return $this->manager->isClientLocked($this);
|
||
}
|
||
|
||
/**
|
||
* @throws Error
|
||
*/
|
||
protected function lock(): void
|
||
{
|
||
if (!$this->manager) {
|
||
return;
|
||
}
|
||
|
||
$this->manager->lockClient($this);
|
||
}
|
||
|
||
/**
|
||
* @throws Error
|
||
*/
|
||
protected function unlock(): void
|
||
{
|
||
if (!$this->manager) {
|
||
return;
|
||
}
|
||
|
||
$this->manager->unlockClient($this);
|
||
}
|
||
|
||
/**
|
||
* @throws Error
|
||
*/
|
||
private function controlRefreshTokenAttempts(): void
|
||
{
|
||
if (!$this->manager) {
|
||
return;
|
||
}
|
||
|
||
$this->manager->controlRefreshTokenAttempts($this);
|
||
}
|
||
|
||
/**
|
||
* @throws Error
|
||
*/
|
||
protected function reFetch(): void
|
||
{
|
||
if (!$this->manager) {
|
||
return;
|
||
}
|
||
|
||
$this->manager->reFetchClient($this);
|
||
}
|
||
|
||
/**
|
||
* @param non-empty-string $url
|
||
* @param array<string, mixed>|string|null $params
|
||
* @param non-empty-string $httpMethod
|
||
* @param ?string $contentType
|
||
* @param bool $allowRenew
|
||
* @return mixed
|
||
* @throws Error
|
||
*/
|
||
public function request(
|
||
$url,
|
||
$params = null,
|
||
$httpMethod = Client::HTTP_METHOD_GET,
|
||
$contentType = null,
|
||
$allowRenew = true
|
||
) {
|
||
|
||
$this->handleAccessTokenActuality();
|
||
|
||
$httpHeaders = [];
|
||
|
||
if (!empty($contentType)) {
|
||
$httpHeaders['Content-Type'] = $contentType;
|
||
|
||
switch ($contentType) {
|
||
case Client::CONTENT_TYPE_APPLICATION_JSON:
|
||
case Client::CONTENT_TYPE_MULTIPART_FORM_DATA:
|
||
if (is_string($params)) {
|
||
$httpHeaders['Content-Length'] = (string) strlen($params);
|
||
}
|
||
|
||
break;
|
||
}
|
||
}
|
||
|
||
try {
|
||
$response = $this->client->request($url, $params, $httpMethod, $httpHeaders);
|
||
} catch (Exception $e) {
|
||
throw new Error($e->getMessage(), 0, $e);
|
||
}
|
||
|
||
$code = null;
|
||
|
||
if (!empty($response['code'])) {
|
||
$code = $response['code'];
|
||
}
|
||
|
||
$result = $response['result'];
|
||
|
||
if ($code >= 200 && $code < 300) {
|
||
return $result;
|
||
}
|
||
|
||
$handledData = $this->handleErrorResponse($response);
|
||
|
||
if ($allowRenew && is_array($handledData)) {
|
||
if ($handledData['action'] === 'refreshToken') {
|
||
if ($this->refreshToken()) {
|
||
return $this->request($url, $params, $httpMethod, $contentType, false);
|
||
}
|
||
} else if ($handledData['action'] === 'renew') {
|
||
return $this->request($url, $params, $httpMethod, $contentType, false);
|
||
}
|
||
}
|
||
|
||
$reasonPart = '';
|
||
|
||
if (
|
||
is_array($result) &&
|
||
isset($result['error']['message'])
|
||
) {
|
||
$reasonPart = '; Reason: ' . $result['error']['message'];
|
||
}
|
||
|
||
$this->log->debug("OAuth response: " . Json::encode($response));
|
||
|
||
throw new Error("Oauth: Error after requesting $httpMethod $url$reasonPart.", (int) $code);
|
||
}
|
||
|
||
/**
|
||
* @return bool
|
||
* @throws Error
|
||
*/
|
||
protected function refreshToken()
|
||
{
|
||
if (empty($this->refreshToken)) {
|
||
throw new Error(
|
||
"Oauth: Could not refresh token for client $this->clientId, because refreshToken is empty.");
|
||
}
|
||
|
||
$this->lock();
|
||
|
||
assert(is_string($this->refreshToken));
|
||
|
||
try {
|
||
$response = $this->client->getAccessToken(
|
||
$this->getParam('tokenEndpoint'),
|
||
Client::GRANT_TYPE_REFRESH_TOKEN,
|
||
['refresh_token' => $this->refreshToken]
|
||
);
|
||
} catch (Exception $e) {
|
||
$this->unlock();
|
||
$this->controlRefreshTokenAttempts();
|
||
|
||
throw new Error("Oauth: Error while refreshing token: " . $e->getMessage());
|
||
}
|
||
|
||
if ($response['code'] == 200) {
|
||
if (is_array($response['result']) && !empty($response['result']['access_token'])) {
|
||
$data = $this->getAccessTokenDataFromResponseResult($response['result']);
|
||
|
||
$this->setParams($data);
|
||
$this->afterTokenRefreshed($data);
|
||
$this->unlock();
|
||
|
||
return true;
|
||
}
|
||
}
|
||
|
||
$this->unlock();
|
||
$this->controlRefreshTokenAttempts();
|
||
|
||
$this->log->error("Oauth: Refreshing token failed for client $this->clientId: " . json_encode($response));
|
||
|
||
return false;
|
||
}
|
||
|
||
/**
|
||
* @param array<string, mixed> $response
|
||
* @return ?array{
|
||
* action: string,
|
||
* }
|
||
*/
|
||
protected function handleErrorResponse($response)
|
||
{
|
||
if ($response['code'] == 401 && !empty($response['result'])) {
|
||
if (str_contains($response['header'], 'error=invalid_token')) {
|
||
return ['action' => 'refreshToken'];
|
||
}
|
||
|
||
return ['action' => 'renew'];
|
||
}
|
||
|
||
if ($response['code'] == 400) {
|
||
$result = $response['result'] ?? null;
|
||
|
||
if (is_array($result)) {
|
||
$error = $result['error'] ?? null;
|
||
|
||
if ($error === 'invalid_token') {
|
||
return ['action' => 'refreshToken'];
|
||
}
|
||
}
|
||
}
|
||
|
||
return null;
|
||
}
|
||
}
|