Checking scope on access token creation about oauth2-server-php

[bshaffer]

I agree, but I believe we want a ScopeStorageInterface, as scope will be something different per implementation. This could contain something along the lines of getValidScopes, or isValidScope... I'm not sure. I think isValidScope might be logic better off placed in the AccessToken class, but this is open for discussion

[F21]

I agree with this approach. First let's deal with the case where writing to storage has failed. What do you think is the best approach here: throw an exception, or to just return a failure message to the client?

[bshaffer]

If writing to storage failed, I think it best for an exception to be thrown and caught. But I believe this would be part of the StorageInterface implementation, and not part of the code here. Unless we want to add it to Storage_Pdo.

[F21]

It's been quite a while since I worked with PDO directly (I have been working exclusively with an ORM library called RedBean), so please let me know if I have got things wrong :)

In OAuth2_Storage_Pdo under setAccessToken(), the result of $statement->execute() is returned:

return $stmt->execute(compact('access_token', 'client_id', 'user_id', 'expires', 'scope');

Does execute ever throw an exception?

If we were to throw an exception in the storage, then we need to make sure that the implementer of the storage driver actually throws an exception on error (which I don't think there's an easy way to enforce). However, if we just check the return value of setAccessToken in createAccessToken, and return an error message to the client when the return value is falsy, then if the implementer forgets to return anything, the access token would never be created, and upon some investigation (hopefully through comments in the storage interfaces), he would discover that he forgot to return a value.

[bshaffer]

This should not be handled in the oauth library. This should be handled on a per-storage basis.

I do not want to force these methods to return a boolean value.

However, the part concerning the scope is a valid bug. Let's focus on that. I'll work on adding the ScopeStorage interface.

[F21]

That sounds great! Looking forward to it :)

[bshaffer]

fixed with pull request