feat: token validator trait

.gitignore

@@ -4,4 +4,5 @@ composer.lock
 .DS_Store
 /.idea
 .phpunit*
-clover.xml
+clover.xml
+/tests/var

README.md

@@ -43,6 +43,9 @@ $prestaShopProvider = new \PrestaShop\OAuth2\Client\Provider\PrestaShop([
     'clientSecret' => 'yourClientSecret', // The client password assigned to you by PrestaShop
     'redirectUri' => 'yourClientRedirectUri', // The URL responding to the code flow implemented here
     // Optional parameters
+    'cachedWellKnown' => new CachedFile(
+        __DIR__ . '/var/cache/openid-configuration.json', 15 * 60
+    ),
     'uiLocales' => ['fr-FR', 'en'],
     'acrValues' => ['prompt:create'], // In that specific case we change the default prompt to the "register" page
 ]);
@@ -117,6 +120,9 @@ $prestaShopProvider = new \PrestaShop\OAuth2\Client\Provider\PrestaShop([
     'redirectUri' => 'yourClientRedirectUri', // The URL responding to the code flow implemented here
     'postLogoutCallbackUri' => 'yourLogoutCallbackUri', // Logout url whitelisted among the ones defined with your client
     // Optional parameters
+    'cachedWellKnown' => new CachedFile(
+        __DIR__ . '/var/cache/openid-configuration.json', 15 * 60
+    ),
     'uiLocales' => ['fr-FR', 'en'],
     'acrValues' => ['prompt:create'], // In that specific case we change the default prompt to the "register" page
 ]);
@@ -142,6 +148,45 @@ if (isset($_GET['oauth2Callback')) {
 }
 ```
 
+## Token Validation
+
+```php
+$prestaShopProvider = new \PrestaShop\OAuth2\Client\Provider\PrestaShop([
+    'clientId' => 'yourClientId', // The client ID assigned to you by PrestaShop
+    'clientSecret' => 'yourClientSecret', // The client password assigned to you by PrestaShop
+    'redirectUri' => 'yourClientRedirectUri', // The URL responding to the code flow implemented here
+    // Optional parameters
+    'cachedJwks' => new CachedFile(__DIR__ . '/var/cache/jwks.json'),
+    'cachedWellKnown' => new CachedFile(
+        __DIR__ . '/var/cache/openid-configuration.json', 15 * 60
+    ),
+    'uiLocales' => ['fr-FR', 'en'],
+    'acrValues' => ['prompt:create'], // In that specific case we change the default prompt to the "register" page
+]);
+
+try {
+    // Only verifying a token
+    $prestaShopProvider->verifyToken($jwtString);
+} catch (SignatureInvalidException) {
+} catch (TokenExpiredException) {
+} catch (TokenInvalidException) {
+}
+
+try {
+    // Verifying and checking required scope(s) and audience(s)
+    $prestaShopProvider->validateToken(
+        $jwtString, 
+        ['resource.read', 'resource.wrire'], 
+        ['https://an-audience']
+    );
+} catch (SignatureInvalidException) {
+} catch (TokenExpiredException) {
+} catch (ScopeInvalidException) {
+} catch (AudienceInvalidException) {
+} catch (TokenInvalidException) {
+}
+```
+
 ## Testing
 
 ``` bash

composer.json

@@ -21,7 +21,8 @@
     ],
     "require": {
         "php": ">=5.6",
-        "league/oauth2-client": "^2.0"
+        "league/oauth2-client": "^2.0",
+        "firebase/php-jwt": "6.00"
     },
     "require-dev": {
         "phpunit/phpunit": "^8.0 || ^9.0",

src/Provider/CachedFile.php

@@ -0,0 +1,128 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider;
+
+class CachedFile
+{
+    /**
+     * @var string
+     */
+    private $filename;
+
+    /**
+     * @var int lifetime in seconds
+     */
+    private $ttl;
+
+    /**
+     * @param string $filename
+     * @param int|null $ttl
+     *
+     * @throws \Exception
+     */
+    public function __construct($filename, $ttl = null)
+    {
+        $this->filename = $filename;
+        $this->ttl = (int) $ttl;
+
+        $this->initDirectory();
+        $this->assertReadable();
+        $this->assertWritable();
+    }
+
+    /**
+     * @return bool
+     */
+    public function isExpired()
+    {
+        if (file_exists($this->filename)) {
+            if ($this->ttl === null) {
+                return false;
+            }
+
+            return time() - filemtime($this->filename) > $this->ttl;
+        }
+
+        return true;
+    }
+
+    /**
+     * @return false|string
+     */
+    public function read()
+    {
+        return file_get_contents($this->filename);
+    }
+
+    /**
+     * @param mixed $content
+     *
+     * @return void
+     */
+    public function write($content)
+    {
+        file_put_contents($this->filename, $content);
+    }
+
+    /**
+     * @return void
+     */
+    public function clear()
+    {
+        if (file_exists($this->filename)) {
+            unlink($this->filename);
+        }
+    }
+
+    /**
+     * @return string
+     */
+    public function getFilename()
+    {
+        return $this->filename;
+    }
+
+    /**
+     * @return int|null
+     */
+    public function getTtl()
+    {
+        return $this->ttl;
+    }
+
+    /**
+     * @return bool
+     */
+    protected function initDirectory()
+    {
+        if (!file_exists(dirname($this->filename))) {
+            return mkdir(dirname($this->filename), 0755, true);
+        }
+
+        return true;
+    }
+
+    /**
+     * @return void
+     *
+     * @throws \Exception
+     */
+    protected function assertReadable()
+    {
+        if (!is_readable($this->filename) && !is_readable(dirname($this->filename))) {
+            throw new \Exception('File "' . $this->filename . '" is not readable.');
+        }
+    }
+
+    /**
+     * @return void
+     *
+     * @throws \Exception
+     */
+    protected function assertWritable()
+    {
+        if (!is_writable($this->filename) && !is_writeable(dirname($this->filename))) {
+            throw new \Exception('File "' . $this->filename . '" is not writable.');
+        }
+    }
+}

src/Provider/Exception/AudienceInvalidException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider\Exception;
+
+class AudienceInvalidException extends TokenInvalidException
+{
+}

src/Provider/Exception/KidInvalidException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider\Exception;
+
+class KidInvalidException extends TokenInvalidException
+{
+}

src/Provider/Exception/ScopeInvalidException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider\Exception;
+
+class ScopeInvalidException extends TokenInvalidException
+{
+}

src/Provider/Exception/SignatureInvalidException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider\Exception;
+
+class SignatureInvalidException extends TokenInvalidException
+{
+}

src/Provider/Exception/TokenExpiredException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider\Exception;
+
+class TokenExpiredException extends TokenInvalidException
+{
+}

src/Provider/Exception/TokenInvalidException.php

@@ -0,0 +1,7 @@
+<?php
+
+namespace PrestaShop\OAuth2\Client\Provider\Exception;
+
+class TokenInvalidException extends \Exception
+{
+}