thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.52k stars 1.12k forks source link

Fix inconsistent `persistDeviceCode` usage #1446

Open hafezdivandari opened 1 week ago

hafezdivandari commented 1 week ago

On "Device Authorization" grant, the \League\OAuth2\Server\Repositories\DeviceCodeRepositoryInterface::persistDeviceCode() method has been used 3 times with 3 different purposes:

  1. For persisting the new device code (when requesting a device code)
  2. For updating the "User ID" and "User Approved" (when completing the device auth request)
  3. For updating "Last polled at" (when responding to access token request)

This makes the implementation of this method too hard, as we have to manually determine that for which purpose this method has been called!

You may check the workaround I had to use to be able to implement this on Laravel Passport here.

This PR adds 2 new methods to fix this: