Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/get_keys.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,3 +34,6 @@ The guide to get the `client_id` & `client_secret` keys on Google is [here](http

# Get Yahoo Keys
The guide to get the `client_id` & `client_secret` keys on Yahoo is [here](https://developer.yahoo.com/apps/create/).

# Get Facebook Keys
The guide to get the `client_id` & `client_secret` keys on Facebook is [here](https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow#login).
2 changes: 1 addition & 1 deletion docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
[![Latest Stable Version](https://poser.pugx.org/datamweb/shield-oauth/v?style=for-the-badge)](https://packagist.org/packages/datamweb/shield-oauth) [![Total Downloads](https://poser.pugx.org/datamweb/shield-oauth/downloads?style=for-the-badge)](https://packagist.org/packages/datamweb/shield-oauth) [![Latest Unstable Version](https://poser.pugx.org/datamweb/shield-oauth/v/unstable?style=for-the-badge)](https://packagist.org/packages/datamweb/shield-oauth) [![License](https://poser.pugx.org/datamweb/shield-oauth/license?style=for-the-badge)](https://packagist.org/packages/datamweb/shield-oauth) [![PHP Version Require](https://poser.pugx.org/datamweb/shield-oauth/require/php?style=for-the-badge)](https://packagist.org/packages/datamweb/shield-oauth)


`Shield OAuth` helps you to provide the possibility of login or registering users through the OAuth service. Currently, `Shield OAuth` supports `Google OAuth` and `GitHub OAuth` by default, but it allows you to implement it for any other service, including Yahoo, Facebook, Twitter, LinkedIn, GitLab and ..., this is very easy. Just create a class in route `app\Libraries\ShieldOAuth`!
`Shield OAuth` helps you to provide the possibility of login or registering users through the OAuth service. Currently, `Shield OAuth` supports `Google OAuth`, `GitHub OAuth`, and `Facebook OAuth` by default, but it allows you to implement it for any other service, including Yahoo, Twitter, LinkedIn, GitLab and ..., this is very easy. Just create a class in route `app\Libraries\ShieldOAuth`!
more info see [How to add other services](add_other_oauth.md).

## Links:
Expand Down
1 change: 1 addition & 0 deletions docs/install.md
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ The last step is to, You can create your own buttons in views, what is important
```html
http://localhost:8080/oauth/google
http://localhost:8080/oauth/github
http://localhost:8080/oauth/facebook
http://localhost:8080/oauth/yahoo
<!-- and other OAuth !>
```
Expand Down
4 changes: 1 addition & 3 deletions docs/quickstart.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,7 @@ php spark migrate -n Datamweb\ShieldOAuth

### Step 4 :

Receive keys `client_id` and `client_secret` from each OAuth server. and setting them in file `app\Config\ShieldOAuthConfig.php`.

callBack address is `https://yourBaseURL.com/oauth/call-back`.
Receive keys `client_id` and `client_secret` from each OAuth provider and set them in file `app\Config\ShieldOAuthConfig.php` callBack address is `https://yourBaseURL.com/oauth/call-back`.
```php
public array $oauthConfigs = [
'github' => [
Expand Down
7 changes: 7 additions & 0 deletions src/Config/ShieldOAuthConfig.php
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,13 @@ class ShieldOAuthConfig extends BaseConfig
// 'client_id' => 'Get it from Yahoo',
// 'client_secret' => 'Get it from Yahoo',

// 'allow_login' => true,
// 'allow_register' => true,
// ],
// 'facebook' => [
// 'client_id' => 'Get it from Facebook',
// 'client_secret' => 'Get it from Facebook',

// 'allow_login' => true,
// 'allow_register' => true,
// ],
Expand Down
116 changes: 116 additions & 0 deletions src/Libraries/FacebookOAuth.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,116 @@
<?php

declare(strict_types=1);

/**
* This file is part of Shield OAuth.
*
* (c) Datamweb <[email protected]>
*
* For the full copyright and license information, please view
* the LICENSE file that was distributed with this source code.
*/

namespace Datamweb\ShieldOAuth\Libraries;

use Datamweb\ShieldOAuth\Libraries\Basic\AbstractOAuth;

class FacebookOAuth extends AbstractOAuth
{

private static $API_CODE_URL = 'https://www.facebook.com/v16.0/dialog/oauth';

Check failure on line 21 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$API_CODE_URL has no type specified.
private static $API_TOKEN_URL = 'https://graph.facebook.com/v16.0/oauth/access_token';

Check failure on line 22 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$API_TOKEN_URL has no type specified.
private static $API_USER_INFO_URL = 'https://graph.facebook.com/me?fields';

Check failure on line 23 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$API_USER_INFO_URL has no type specified.
private static $APPLICATION_NAME = 'SheildOAuth';

Check failure on line 24 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$APPLICATION_NAME has no type specified.
protected string $token;
protected string $client_id;
protected string $client_secret;
protected string $callbake_url;
protected string $fb_scope;


public function __construct(string $token = '')
{
$this->token = $token;
$this->client = \Config\Services::curlrequest();

Check failure on line 35 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Access to an undefined property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$client.

$this->config = config('ShieldOAuthConfig');

Check failure on line 37 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Access to an undefined property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$config.
$this->callbake_url = base_url('oauth/' . $this->config->call_back_route);
$this->client_id = $this->config->oauthConfigs['facebook']['client_id'];
$this->client_secret = $this->config->oauthConfigs['facebook']['client_secret'];
$this->fb_scope = "id,first_name,last_name,middle_name,name,name_format,picture,short_name,email";
}
Comment on lines +32 to +42
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Declare the missing $client and $config properties.

The code references $this->client and $this->config, but these properties are not declared, causing static analysis failures and likely runtime errors. Add them with proper types.

 class FacebookOAuth extends AbstractOAuth
 {
+    protected \CodeIgniter\HTTP\CURLRequest $client;
+    protected \Datamweb\ShieldOAuth\Config\ShieldOAuthConfig $config;
     ...
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
public function __construct(string $token = '')
{
$this->token = $token;
$this->client = \Config\Services::curlrequest();
$this->config = config('ShieldOAuthConfig');
$this->callbake_url = base_url('oauth/' . $this->config->call_back_route);
$this->client_id = $this->config->oauthConfigs['facebook']['client_id'];
$this->client_secret = $this->config->oauthConfigs['facebook']['client_secret'];
$this->fb_scope = "id,first_name,last_name,middle_name,name,name_format,picture,short_name,email";
}
<?php
namespace Datamweb\ShieldOAuth\Libraries;
class FacebookOAuth extends AbstractOAuth
{
protected \CodeIgniter\HTTP\CURLRequest $client;
protected \Datamweb\ShieldOAuth\Config\ShieldOAuthConfig $config;
public function __construct(string $token = '')
{
$this->token = $token;
$this->client = \Config\Services::curlrequest();
$this->config = config('ShieldOAuthConfig');
$this->callbake_url = base_url('oauth/' . $this->config->call_back_route);
$this->client_id = $this->config->oauthConfigs['facebook']['client_id'];
$this->client_secret = $this->config->oauthConfigs['facebook']['client_secret'];
$this->fb_scope = "id,first_name,last_name,middle_name,name,name_format,picture,short_name,email";
}
}
🧰 Tools
🪛 GitHub Check: PHP 8.1 Static Analysis

[failure] 37-37:
Access to an undefined property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$config.


[failure] 35-35:
Access to an undefined property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$client.


public function makeGoLink(string $state): string
{
return self::$API_CODE_URL . "?client_id={$this->client_id}&redirect_uri={$this->callbake_url}&state={$state}";
}

protected function fetchAccessTokenWithAuthCode(array $allGet): void

Check failure on line 49 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Method Datamweb\ShieldOAuth\Libraries\FacebookOAuth::fetchAccessTokenWithAuthCode() has parameter $allGet with no value type specified in iterable type array.
{
try {
// send request to API URL
$response = $this->client->request('POST', self::$API_TOKEN_URL, [

Check failure on line 53 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Access to an undefined property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$client.
'form_params' => [
'client_id' => $this->client_id,
'client_secret' => $this->client_secret,
'code' => $allGet['code'],
'redirect_uri' => $this->callbake_url,
'grant_type' => 'authorization_code',
],
'headers' => [
'User-Agent' => self::$APPLICATION_NAME . '/1.0',
'Accept' => 'application/json',
],
]);
} catch (Exception $e) {

Check failure on line 66 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Caught class Datamweb\ShieldOAuth\Libraries\Exception not found.
exit($e->getMessage());

Check failure on line 67 in src/Libraries/FacebookOAuth.php

View workflow job for this annotation

GitHub Actions / PHP 8.1 Static Analysis

Call to method getMessage() on an unknown class Datamweb\ShieldOAuth\Libraries\Exception.
}
$token = json_decode($response->getBody())->access_token;
$this->setToken($token);
}
Comment on lines +49 to +71
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Import the correct Exception class and avoid terminating the app on errors.

  1. Ensure the Exception class is imported via use Exception; or fully qualified as catch (\Exception $e).
  2. Relying on exit($e->getMessage()) may abruptly stop the entire application. Consider throwing a typed exception or logging the error instead.
+ use Exception;

 protected function fetchAccessTokenWithAuthCode(array $allGet): void
 {
     try {
         ...
     } catch (\Exception $e) {
-        exit($e->getMessage());
+        // Log or rethrow the exception
+        throw $e;
     }
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
protected function fetchAccessTokenWithAuthCode(array $allGet): void
{
try {
// send request to API URL
$response = $this->client->request('POST', self::$API_TOKEN_URL, [
'form_params' => [
'client_id' => $this->client_id,
'client_secret' => $this->client_secret,
'code' => $allGet['code'],
'redirect_uri' => $this->callbake_url,
'grant_type' => 'authorization_code',
],
'headers' => [
'User-Agent' => self::$APPLICATION_NAME . '/1.0',
'Accept' => 'application/json',
],
]);
} catch (Exception $e) {
exit($e->getMessage());
}
$token = json_decode($response->getBody())->access_token;
$this->setToken($token);
}
<?php
use Exception;
class FacebookOAuth {
// Other class members...
protected function fetchAccessTokenWithAuthCode(array $allGet): void
{
try {
// send request to API URL
$response = $this->client->request('POST', self::$API_TOKEN_URL, [
'form_params' => [
'client_id' => $this->client_id,
'client_secret' => $this->client_secret,
'code' => $allGet['code'],
'redirect_uri' => $this->callbake_url,
'grant_type' => 'authorization_code',
],
'headers' => [
'User-Agent' => self::$APPLICATION_NAME . '/1.0',
'Accept' => 'application/json',
],
]);
} catch (\Exception $e) {
// Log or rethrow the exception
throw $e;
}
$token = json_decode($response->getBody())->access_token;
$this->setToken($token);
}
// Other class members...
}
🧰 Tools
🪛 GitHub Check: PHP 8.1 Static Analysis

[failure] 67-67:
Call to method getMessage() on an unknown class Datamweb\ShieldOAuth\Libraries\Exception.


[failure] 66-66:
Caught class Datamweb\ShieldOAuth\Libraries\Exception not found.


[failure] 53-53:
Access to an undefined property Datamweb\ShieldOAuth\Libraries\FacebookOAuth::$client.


[failure] 49-49:
Method Datamweb\ShieldOAuth\Libraries\FacebookOAuth::fetchAccessTokenWithAuthCode() has parameter $allGet with no value type specified in iterable type array.


protected function fetchUserInfoWithToken(): object
{
// send request to API URL
try {
$response = $this->client->request('POST', self::$API_USER_INFO_URL.'='.$this->fb_scope, [
'headers' => [
'Accept' => 'application/json',
'User-Agent' => self::$APPLICATION_NAME . '/1.0',
'Authorization' => 'Bearer ' . $this->getToken(),
],
'http_errors' => false,
]);
} catch (Exception $e) {
exit($e->getMessage());
}
return json_decode($response->getBody());
}
Comment on lines +73 to +89
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Fix the query string concatenation and HTTP method.

  1. Currently, '?fields' . '=' . $this->fb_scope yields an extra = (resulting in ?fields==...). It should be '?fields=' . $this->fb_scope.
  2. Typically, fetching user info is done with a GET request instead of POST. Verify that Facebook’s API accepts POST here.
- $response = $this->client->request('POST', self::$API_USER_INFO_URL.'='.$this->fb_scope, [
+ $response = $this->client->request('GET', self::$API_USER_INFO_URL . '=' . $this->fb_scope, [

Committable suggestion skipped: line range outside the PR's diff.


protected function setColumnsName(string $nameOfProcess, $userInfo): array
{
if ($nameOfProcess === 'syncingUserInfo') {
$usersColumnsName = [
$this->config->usersColumnsName['first_name'] => $userInfo->first_name,
$this->config->usersColumnsName['last_name'] => $userInfo->last_name,
$this->config->usersColumnsName['avatar'] => $userInfo->picture->data->url,
];
}

if ($nameOfProcess === 'newUser') {
$usersColumnsName = [
// users tbl // OAuth
'username' => $userInfo->first_name,
'email' => $userInfo->email,
'password' => random_string('crypto', 32),
'active' => '1',
$this->config->usersColumnsName['first_name'] => $userInfo->first_name,
$this->config->usersColumnsName['last_name'] => $userInfo->last_name,
$this->config->usersColumnsName['avatar'] => $userInfo->picture->data->url,
];
}

return $usersColumnsName;
}
Comment on lines +91 to +115
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Handle missing or incomplete picture data.

Accessing $userInfo->picture->data->url will fail if picture is absent or its structure changes. Consider adding a safety check or fallback logic.

}
Loading