1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2025-02-26 13:39:08 +01:00
phorge-phorge/src/applications/conduit/protocol/ConduitAPIRequest.php

83 lines
2.1 KiB
PHP
Raw Normal View History

2011-01-24 09:00:29 -08:00
<?php
final class ConduitAPIRequest extends Phobject {
2011-01-24 09:00:29 -08:00
protected $params;
private $user;
private $isClusterRequest = false;
Implement "auth.logout" Conduit API method Summary: Ref T7303. Ref T7673. This implements an "auth.logout" which: - terminates all web sessions; - terminates the current OAuth token if called via OAuth; and - may always be called via OAuth. (Since it consumes an OAuth token, even a "malicious" OAuth application can't really be that much of a jerk with this: it can't continuously log you out, since calling the method once kills the token. The application would need to ask your permission again to get a fresh token.) The primary goal here is to let Phacility instances call this against the Phacility upstream, so that when you log out of an instance it also logs you out of your Phacility account (possibly with a checkbox or something). This also smooths over the session token code. Before this change, your sessions would get logged out but when you reloaded we'd tell you your session was invalid. Instead, try to clear the invalid session before telling the user there's an issue. I think that ssentially 100% of invalid sessions are a result of something in this vein (e.g., forced logout via Settings) nowadays, since the session code is generally stable and sane and has been for a long time. Test Plan: - Called `auth.logout` via console, got a reasonable logout experience. - Called `auth.logout` via OAuth. - Tried to make another call, verified OAuth token had been invalidated. - Verified web session had been invalidated. Reviewers: chad Reviewed By: chad Maniphest Tasks: T7303, T7673 Differential Revision: https://secure.phabricator.com/D15594
2016-04-03 09:06:26 -07:00
private $oauthToken;
private $isStrictlyTyped = true;
2011-01-24 09:00:29 -08:00
public function __construct(array $params, $strictly_typed) {
2011-01-24 09:00:29 -08:00
$this->params = $params;
$this->isStrictlyTyped = $strictly_typed;
2011-01-24 09:00:29 -08:00
}
public function getValue($key, $default = null) {
return coalesce(idx($this->params, $key), $default);
2011-01-24 09:00:29 -08:00
}
public function getValueExists($key) {
return array_key_exists($key, $this->params);
}
2011-01-24 09:00:29 -08:00
public function getAllParameters() {
return $this->params;
}
public function setUser(PhabricatorUser $user) {
$this->user = $user;
return $this;
}
/**
* Retrieve the authentic identity of the user making the request. If a
* method requires authentication (the default) the user object will always
* be available. If a method does not require authentication (i.e., overrides
* shouldRequireAuthentication() to return false) the user object will NEVER
* be available.
*
* @return PhabricatorUser Authentic user, available ONLY if the method
* requires authentication.
*/
public function getUser() {
if (!$this->user) {
throw new Exception(
pht(
'You can not access the user inside the implementation of a Conduit '.
'method which does not require authentication (as per %s).',
'shouldRequireAuthentication()'));
}
return $this->user;
}
Implement "auth.logout" Conduit API method Summary: Ref T7303. Ref T7673. This implements an "auth.logout" which: - terminates all web sessions; - terminates the current OAuth token if called via OAuth; and - may always be called via OAuth. (Since it consumes an OAuth token, even a "malicious" OAuth application can't really be that much of a jerk with this: it can't continuously log you out, since calling the method once kills the token. The application would need to ask your permission again to get a fresh token.) The primary goal here is to let Phacility instances call this against the Phacility upstream, so that when you log out of an instance it also logs you out of your Phacility account (possibly with a checkbox or something). This also smooths over the session token code. Before this change, your sessions would get logged out but when you reloaded we'd tell you your session was invalid. Instead, try to clear the invalid session before telling the user there's an issue. I think that ssentially 100% of invalid sessions are a result of something in this vein (e.g., forced logout via Settings) nowadays, since the session code is generally stable and sane and has been for a long time. Test Plan: - Called `auth.logout` via console, got a reasonable logout experience. - Called `auth.logout` via OAuth. - Tried to make another call, verified OAuth token had been invalidated. - Verified web session had been invalidated. Reviewers: chad Reviewed By: chad Maniphest Tasks: T7303, T7673 Differential Revision: https://secure.phabricator.com/D15594
2016-04-03 09:06:26 -07:00
public function setOAuthToken(
PhabricatorOAuthServerAccessToken $oauth_token) {
$this->oauthToken = $oauth_token;
return $this;
}
public function getOAuthToken() {
return $this->oauthToken;
}
public function setIsClusterRequest($is_cluster_request) {
$this->isClusterRequest = $is_cluster_request;
return $this;
}
public function getIsClusterRequest() {
return $this->isClusterRequest;
}
public function getIsStrictlyTyped() {
return $this->isStrictlyTyped;
}
public function newContentSource() {
return PhabricatorContentSource::newForSource(
PhabricatorConduitContentSource::SOURCECONST);
}
2011-01-24 09:00:29 -08:00
}