thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

Deny access if user is not authenticated #1408

Open hafezdivandari opened 1 month ago

hafezdivandari commented 1 month ago

On Laravel Passport we support prompt=none when redirecting for authorization. Currently, we have to create the error response manually when user is not authenticated.

Here is the related code on Laravel Passport:

https://github.com/laravel/passport/blob/8ea1dd41745c89769fd8c4b207c4739eea707e95/src/Http/Controllers/AuthorizationController.php#L181-L204

After this PR we are able to simply do:

if (! is_null($user)) {
    $authRequest->setUser(new User($user->getAuthIdentifier()));
}

$authRequest->setAuthorizationApproved(false);

return $this->withErrorHandling(function () use ($authRequest) {
    return $this->convertResponse(
        $this->server->completeAuthorizationRequest($authRequest, new Psr7Response)
    );
});