First OAth2 Functional Implementation

composer.json

@@ -7,7 +7,6 @@
     
     "require": {
         "luracast/restler" : "dev-master",
-        "bshaffer/oauth2-server-php": "v1.0",
-        "twig/twig": "v1.13.2"
+        "bshaffer/oauth2-server-php": "v1.0"
     }
 }

gulliver/core/Session/PmSessionHandler.php

@@ -24,8 +24,8 @@ class PmSessionHandler //implements SessionHandlerInterface
      * @var string
      */
     private $dsn = '';
-    private $user = '';
-    private $password = '';
+    private $dbUser = '';
+    private $dbPassword = '';
     private $dbtable = 'SESSION_STORAGE';
 
     /**
@@ -127,6 +127,10 @@ class PmSessionHandler //implements SessionHandlerInterface
     public function open($savePath, $sessionName)
     {
         // routines moved to __construct() for php 5.3.x compatibility
+
+
+        error_log("PmSession :: open($savePath, $sessionName) was called");
+
         return true;
     }
 
@@ -146,6 +150,8 @@ class PmSessionHandler //implements SessionHandlerInterface
         // this was commented to take advantage of PDO persistence connections
         //$this->db = null;
 
+        error_log("PmSession :: close() was called");
+
         return true;
     }
 
@@ -170,6 +176,8 @@ class PmSessionHandler //implements SessionHandlerInterface
         //$this->wstmt->bind_param('siss', $id, $time, $data, $key);
         $this->wstmt->execute(array($id, $time, $data, $key));
 
+        error_log("PmSession :: write($id, array()) was called");
+
         return true;
     }
 
@@ -189,6 +197,8 @@ class PmSessionHandler //implements SessionHandlerInterface
         $data = $this->rstmt->fetch();
         $data = unserialize(base64_decode($data['DATA']));
 
+        error_log("PmSession :: read($id) was called");
+
         return $data;
     }
 
@@ -203,6 +213,8 @@ class PmSessionHandler //implements SessionHandlerInterface
             $this->dstmt = $this->db->prepare("DELETE FROM {$this->dbtable} WHERE ID = ?");
         }
 
+        error_log("PmSession :: destroy($id) was called");
+
         $this->dstmt->execute(array($id));
         
         return true;
@@ -219,10 +231,12 @@ class PmSessionHandler //implements SessionHandlerInterface
         $time = time() - $maxlifetime;
 
         if(! isset($this->gcstmt)) {
-            $thi->gcstmt = $this->db->prepare("DELETE FROM {$this->dbtable} WHERE SET_TIME < ?");
+            $this->gcstmt = $this->db->prepare("DELETE FROM {$this->dbtable} WHERE SET_TIME < ?");
         }
 
-        $thi->gcstmt->execute(array($time));
+        $this->gcstmt->execute(array($time));
+
+        error_log("PmSession :: gc($maxlifetime) was called");
         
         return true;
     }

gulliver/system/class.bootstrap.php

@@ -1076,6 +1076,12 @@ class Bootstrap
         
         $rest->addAuthenticationClass('Api\\OAuth2\\Server', '');
 
+        list($host, $port) = strpos(DB_HOST, ':') !== false ? explode(':', DB_HOST) : array(DB_HOST, '');
+        $port = empty($port) ? '' : ";port=$port";
+
+        \Api\OAuth2\Server::setDatabaseSource(DB_USER, DB_PASS, DB_ADAPTER.":host=$host;dbname=".DB_NAME.$port);
+        \Api\OAuth2\Server::setPmClientId('x-pm-local-client');
+
         $rest->setSupportedFormats('JsonFormat', 'XmlFormat'); //, 'HtmlFormat');
         //$rest->setOverridingFormats('UploadFormat', 'JsonFormat', 'XmlFormat', 'HtmlFormat');
         $rest->setOverridingFormats('HtmlFormat', 'JsonFormat', 'UploadFormat');

workflow/engine/classes/class.api.php

@@ -4,6 +4,7 @@ namespace ProcessMaker;
 class Api
 {
     private static $workspace;
+    private static $userId;
 
     public function __costruct()
     {
@@ -19,5 +20,17 @@ class Api
     {
         return self::$workspace;
     }
+
+    public static function setUserId($userId)
+    {
+        self::$userId = $userId;
+    }
+
+    public function getUserId()
+    {
+        //return self::$userId;
+
+        return \Api\OAuth2\Server::getUserId();
+    }
 }
 

workflow/engine/classes/model/PmoauthUserAccessTokens.php

@@ -0,0 +1,19 @@
+<?php
+
+require_once 'classes/model/om/BasePmoauthUserAccessTokens.php';
+
+
+/**
+ * Skeleton subclass for representing a row from the 'PMOAUTH_USER_ACCESS_TOKENS' table.
+ *
+ * 
+ *
+ * You should add additional methods to this class to meet the
+ * application requirements.  This class will only be generated as
+ * long as it does not already exist in the output directory.
+ *
+ * @package    classes.model
+ */
+class PmoauthUserAccessTokens extends BasePmoauthUserAccessTokens {
+
+} // PmoauthUserAccessTokens

workflow/engine/classes/model/PmoauthUserAccessTokensPeer.php

@@ -0,0 +1,23 @@
+<?php
+
+  // include base peer class
+  require_once 'classes/model/om/BasePmoauthUserAccessTokensPeer.php';
+
+  // include object class
+  include_once 'classes/model/PmoauthUserAccessTokens.php';
+
+
+/**
+ * Skeleton subclass for performing query and update operations on the 'PMOAUTH_USER_ACCESS_TOKENS' table.
+ *
+ * 
+ *
+ * You should add additional methods to this class to meet the
+ * application requirements.  This class will only be generated as
+ * long as it does not already exist in the output directory.
+ *
+ * @package    classes.model
+ */
+class PmoauthUserAccessTokensPeer extends BasePmoauthUserAccessTokensPeer {
+
+} // PmoauthUserAccessTokensPeer

workflow/engine/classes/model/map/OauthClientsMapBuilder.php

@@ -69,6 +69,12 @@ class OauthClientsMapBuilder
 
         $tMap->addColumn('CLIENT_SECRET', 'ClientSecret', 'string', CreoleTypes::VARCHAR, true, 80);
 
+        $tMap->addColumn('CLIENT_NAME', 'ClientName', 'string', CreoleTypes::VARCHAR, true, 256);
+
+        $tMap->addColumn('CLIENT_DESCRIPTION', 'ClientDescription', 'string', CreoleTypes::VARCHAR, true, 1024);
+
+        $tMap->addColumn('CLIENT_WEBSITE', 'ClientWebsite', 'string', CreoleTypes::VARCHAR, true, 1024);
+
         $tMap->addColumn('REDIRECT_URI', 'RedirectUri', 'string', CreoleTypes::VARCHAR, true, 2000);
 
     } // doBuild()

workflow/engine/classes/model/map/PmoauthUserAccessTokensMapBuilder.php

@@ -0,0 +1,78 @@
+<?php
+
+require_once 'propel/map/MapBuilder.php';
+include_once 'creole/CreoleTypes.php';
+
+
+/**
+ * This class adds structure of 'PMOAUTH_USER_ACCESS_TOKENS' table to 'workflow' DatabaseMap object.
+ *
+ *
+ *
+ * These statically-built map classes are used by Propel to do runtime db structure discovery.
+ * For example, the createSelectSql() method checks the type of a given column used in an
+ * ORDER BY clause to know whether it needs to apply SQL to make the ORDER BY case-insensitive
+ * (i.e. if it's a text column type).
+ *
+ * @package    workflow.classes.model.map
+ */
+class PmoauthUserAccessTokensMapBuilder
+{
+
+    /**
+     * The (dot-path) name of this class
+     */
+    const CLASS_NAME = 'classes.model.map.PmoauthUserAccessTokensMapBuilder';
+
+    /**
+     * The database map.
+     */
+    private $dbMap;
+
+    /**
+     * Tells us if this DatabaseMapBuilder is built so that we
+     * don't have to re-build it every time.
+     *
+     * @return     boolean true if this DatabaseMapBuilder is built, false otherwise.
+     */
+    public function isBuilt()
+    {
+        return ($this->dbMap !== null);
+    }
+
+    /**
+     * Gets the databasemap this map builder built.
+     *
+     * @return     the databasemap
+     */
+    public function getDatabaseMap()
+    {
+        return $this->dbMap;
+    }
+
+    /**
+     * The doBuild() method builds the DatabaseMap
+     *
+     * @return     void
+     * @throws     PropelException
+     */
+    public function doBuild()
+    {
+        $this->dbMap = Propel::getDatabaseMap('workflow');
+
+        $tMap = $this->dbMap->addTable('PMOAUTH_USER_ACCESS_TOKENS');
+        $tMap->setPhpName('PmoauthUserAccessTokens');
+
+        $tMap->setUseIdGenerator(false);
+
+        $tMap->addPrimaryKey('ACCESS_TOKEN', 'AccessToken', 'string', CreoleTypes::VARCHAR, true, 40);
+
+        $tMap->addColumn('REFRESH_TOKEN', 'RefreshToken', 'string', CreoleTypes::VARCHAR, true, 40);
+
+        $tMap->addColumn('USER_ID', 'UserId', 'string', CreoleTypes::VARCHAR, false, 32);
+
+        $tMap->addColumn('SESSION_ID', 'SessionId', 'string', CreoleTypes::VARCHAR, true, 40);
+
+    } // doBuild()
+
+} // PmoauthUserAccessTokensMapBuilder

workflow/engine/classes/model/om/BaseOauthClients.php

@@ -39,6 +39,24 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
      */
     protected $client_secret;
 
+    /**
+     * The value for the client_name field.
+     * @var        string
+     */
+    protected $client_name;
+
+    /**
+     * The value for the client_description field.
+     * @var        string
+     */
+    protected $client_description;
+
+    /**
+     * The value for the client_website field.
+     * @var        string
+     */
+    protected $client_website;
+
     /**
      * The value for the redirect_uri field.
      * @var        string
@@ -81,6 +99,39 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
         return $this->client_secret;
     }
 
+    /**
+     * Get the [client_name] column value.
+     * 
+     * @return     string
+     */
+    public function getClientName()
+    {
+
+        return $this->client_name;
+    }
+
+    /**
+     * Get the [client_description] column value.
+     * 
+     * @return     string
+     */
+    public function getClientDescription()
+    {
+
+        return $this->client_description;
+    }
+
+    /**
+     * Get the [client_website] column value.
+     * 
+     * @return     string
+     */
+    public function getClientWebsite()
+    {
+
+        return $this->client_website;
+    }
+
     /**
      * Get the [redirect_uri] column value.
      * 
@@ -136,6 +187,72 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
 
     } // setClientSecret()
 
+    /**
+     * Set the value of [client_name] column.
+     * 
+     * @param      string $v new value
+     * @return     void
+     */
+    public function setClientName($v)
+    {
+
+        // Since the native PHP type for this column is string,
+        // we will cast the input to a string (if it is not).
+        if ($v !== null && !is_string($v)) {
+            $v = (string) $v;
+        }
+
+        if ($this->client_name !== $v) {
+            $this->client_name = $v;
+            $this->modifiedColumns[] = OauthClientsPeer::CLIENT_NAME;
+        }
+
+    } // setClientName()
+
+    /**
+     * Set the value of [client_description] column.
+     * 
+     * @param      string $v new value
+     * @return     void
+     */
+    public function setClientDescription($v)
+    {
+
+        // Since the native PHP type for this column is string,
+        // we will cast the input to a string (if it is not).
+        if ($v !== null && !is_string($v)) {
+            $v = (string) $v;
+        }
+
+        if ($this->client_description !== $v) {
+            $this->client_description = $v;
+            $this->modifiedColumns[] = OauthClientsPeer::CLIENT_DESCRIPTION;
+        }
+
+    } // setClientDescription()
+
+    /**
+     * Set the value of [client_website] column.
+     * 
+     * @param      string $v new value
+     * @return     void
+     */
+    public function setClientWebsite($v)
+    {
+
+        // Since the native PHP type for this column is string,
+        // we will cast the input to a string (if it is not).
+        if ($v !== null && !is_string($v)) {
+            $v = (string) $v;
+        }
+
+        if ($this->client_website !== $v) {
+            $this->client_website = $v;
+            $this->modifiedColumns[] = OauthClientsPeer::CLIENT_WEBSITE;
+        }
+
+    } // setClientWebsite()
+
     /**
      * Set the value of [redirect_uri] column.
      * 
@@ -179,14 +296,20 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
 
             $this->client_secret = $rs->getString($startcol + 1);
 
-            $this->redirect_uri = $rs->getString($startcol + 2);
+            $this->client_name = $rs->getString($startcol + 2);
+
+            $this->client_description = $rs->getString($startcol + 3);
+
+            $this->client_website = $rs->getString($startcol + 4);
+
+            $this->redirect_uri = $rs->getString($startcol + 5);
 
             $this->resetModified();
 
             $this->setNew(false);
 
             // FIXME - using NUM_COLUMNS may be clearer.
-            return $startcol + 3; // 3 = OauthClientsPeer::NUM_COLUMNS - OauthClientsPeer::NUM_LAZY_LOAD_COLUMNS).
+            return $startcol + 6; // 6 = OauthClientsPeer::NUM_COLUMNS - OauthClientsPeer::NUM_LAZY_LOAD_COLUMNS).
 
         } catch (Exception $e) {
             throw new PropelException("Error populating OauthClients object", $e);
@@ -397,6 +520,15 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
                 return $this->getClientSecret();
                 break;
             case 2:
+                return $this->getClientName();
+                break;
+            case 3:
+                return $this->getClientDescription();
+                break;
+            case 4:
+                return $this->getClientWebsite();
+                break;
+            case 5:
                 return $this->getRedirectUri();
                 break;
             default:
@@ -421,7 +553,10 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
         $result = array(
             $keys[0] => $this->getClientId(),
             $keys[1] => $this->getClientSecret(),
-            $keys[2] => $this->getRedirectUri(),
+            $keys[2] => $this->getClientName(),
+            $keys[3] => $this->getClientDescription(),
+            $keys[4] => $this->getClientWebsite(),
+            $keys[5] => $this->getRedirectUri(),
         );
         return $result;
     }
@@ -460,6 +595,15 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
                 $this->setClientSecret($value);
                 break;
             case 2:
+                $this->setClientName($value);
+                break;
+            case 3:
+                $this->setClientDescription($value);
+                break;
+            case 4:
+                $this->setClientWebsite($value);
+                break;
+            case 5:
                 $this->setRedirectUri($value);
                 break;
         } // switch()
@@ -494,7 +638,19 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
         }
 
         if (array_key_exists($keys[2], $arr)) {
-            $this->setRedirectUri($arr[$keys[2]]);
+            $this->setClientName($arr[$keys[2]]);
+        }
+
+        if (array_key_exists($keys[3], $arr)) {
+            $this->setClientDescription($arr[$keys[3]]);
+        }
+
+        if (array_key_exists($keys[4], $arr)) {
+            $this->setClientWebsite($arr[$keys[4]]);
+        }
+
+        if (array_key_exists($keys[5], $arr)) {
+            $this->setRedirectUri($arr[$keys[5]]);
         }
 
     }
@@ -516,6 +672,18 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
             $criteria->add(OauthClientsPeer::CLIENT_SECRET, $this->client_secret);
         }
 
+        if ($this->isColumnModified(OauthClientsPeer::CLIENT_NAME)) {
+            $criteria->add(OauthClientsPeer::CLIENT_NAME, $this->client_name);
+        }
+
+        if ($this->isColumnModified(OauthClientsPeer::CLIENT_DESCRIPTION)) {
+            $criteria->add(OauthClientsPeer::CLIENT_DESCRIPTION, $this->client_description);
+        }
+
+        if ($this->isColumnModified(OauthClientsPeer::CLIENT_WEBSITE)) {
+            $criteria->add(OauthClientsPeer::CLIENT_WEBSITE, $this->client_website);
+        }
+
         if ($this->isColumnModified(OauthClientsPeer::REDIRECT_URI)) {
             $criteria->add(OauthClientsPeer::REDIRECT_URI, $this->redirect_uri);
         }
@@ -576,6 +744,12 @@ abstract class BaseOauthClients extends BaseObject implements Persistent
 
         $copyObj->setClientSecret($this->client_secret);
 
+        $copyObj->setClientName($this->client_name);
+
+        $copyObj->setClientDescription($this->client_description);
+
+        $copyObj->setClientWebsite($this->client_website);
+
         $copyObj->setRedirectUri($this->redirect_uri);
 
 

workflow/engine/classes/model/om/BaseOauthClientsPeer.php

@@ -25,7 +25,7 @@ abstract class BaseOauthClientsPeer
     const CLASS_DEFAULT = 'classes.model.OauthClients';
 
     /** The total number of columns. */
-    const NUM_COLUMNS = 3;
+    const NUM_COLUMNS = 6;
 
     /** The number of lazy-loaded columns. */
     const NUM_LAZY_LOAD_COLUMNS = 0;
@@ -37,6 +37,15 @@ abstract class BaseOauthClientsPeer
     /** the column name for the CLIENT_SECRET field */
     const CLIENT_SECRET = 'OAUTH_CLIENTS.CLIENT_SECRET';
 
+    /** the column name for the CLIENT_NAME field */
+    const CLIENT_NAME = 'OAUTH_CLIENTS.CLIENT_NAME';
+
+    /** the column name for the CLIENT_DESCRIPTION field */
+    const CLIENT_DESCRIPTION = 'OAUTH_CLIENTS.CLIENT_DESCRIPTION';
+
+    /** the column name for the CLIENT_WEBSITE field */
+    const CLIENT_WEBSITE = 'OAUTH_CLIENTS.CLIENT_WEBSITE';
+
     /** the column name for the REDIRECT_URI field */
     const REDIRECT_URI = 'OAUTH_CLIENTS.REDIRECT_URI';
 
@@ -51,10 +60,10 @@ abstract class BaseOauthClientsPeer
      * e.g. self::$fieldNames[self::TYPE_PHPNAME][0] = 'Id'
      */
     private static $fieldNames = array (
-        BasePeer::TYPE_PHPNAME => array ('ClientId', 'ClientSecret', 'RedirectUri', ),
-        BasePeer::TYPE_COLNAME => array (OauthClientsPeer::CLIENT_ID, OauthClientsPeer::CLIENT_SECRET, OauthClientsPeer::REDIRECT_URI, ),
-        BasePeer::TYPE_FIELDNAME => array ('CLIENT_ID', 'CLIENT_SECRET', 'REDIRECT_URI', ),
-        BasePeer::TYPE_NUM => array (0, 1, 2, )
+        BasePeer::TYPE_PHPNAME => array ('ClientId', 'ClientSecret', 'ClientName', 'ClientDescription', 'ClientWebsite', 'RedirectUri', ),
+        BasePeer::TYPE_COLNAME => array (OauthClientsPeer::CLIENT_ID, OauthClientsPeer::CLIENT_SECRET, OauthClientsPeer::CLIENT_NAME, OauthClientsPeer::CLIENT_DESCRIPTION, OauthClientsPeer::CLIENT_WEBSITE, OauthClientsPeer::REDIRECT_URI, ),
+        BasePeer::TYPE_FIELDNAME => array ('CLIENT_ID', 'CLIENT_SECRET', 'CLIENT_NAME', 'CLIENT_DESCRIPTION', 'CLIENT_WEBSITE', 'REDIRECT_URI', ),
+        BasePeer::TYPE_NUM => array (0, 1, 2, 3, 4, 5, )
     );
 
     /**
@@ -64,10 +73,10 @@ abstract class BaseOauthClientsPeer
      * e.g. self::$fieldNames[BasePeer::TYPE_PHPNAME]['Id'] = 0
      */
     private static $fieldKeys = array (
-        BasePeer::TYPE_PHPNAME => array ('ClientId' => 0, 'ClientSecret' => 1, 'RedirectUri' => 2, ),
-        BasePeer::TYPE_COLNAME => array (OauthClientsPeer::CLIENT_ID => 0, OauthClientsPeer::CLIENT_SECRET => 1, OauthClientsPeer::REDIRECT_URI => 2, ),
-        BasePeer::TYPE_FIELDNAME => array ('CLIENT_ID' => 0, 'CLIENT_SECRET' => 1, 'REDIRECT_URI' => 2, ),
-        BasePeer::TYPE_NUM => array (0, 1, 2, )
+        BasePeer::TYPE_PHPNAME => array ('ClientId' => 0, 'ClientSecret' => 1, 'ClientName' => 2, 'ClientDescription' => 3, 'ClientWebsite' => 4, 'RedirectUri' => 5, ),
+        BasePeer::TYPE_COLNAME => array (OauthClientsPeer::CLIENT_ID => 0, OauthClientsPeer::CLIENT_SECRET => 1, OauthClientsPeer::CLIENT_NAME => 2, OauthClientsPeer::CLIENT_DESCRIPTION => 3, OauthClientsPeer::CLIENT_WEBSITE => 4, OauthClientsPeer::REDIRECT_URI => 5, ),
+        BasePeer::TYPE_FIELDNAME => array ('CLIENT_ID' => 0, 'CLIENT_SECRET' => 1, 'CLIENT_NAME' => 2, 'CLIENT_DESCRIPTION' => 3, 'CLIENT_WEBSITE' => 4, 'REDIRECT_URI' => 5, ),
+        BasePeer::TYPE_NUM => array (0, 1, 2, 3, 4, 5, )
     );
 
     /**
@@ -172,6 +181,12 @@ abstract class BaseOauthClientsPeer
 
         $criteria->addSelectColumn(OauthClientsPeer::CLIENT_SECRET);
 
+        $criteria->addSelectColumn(OauthClientsPeer::CLIENT_NAME);
+
+        $criteria->addSelectColumn(OauthClientsPeer::CLIENT_DESCRIPTION);
+
+        $criteria->addSelectColumn(OauthClientsPeer::CLIENT_WEBSITE);
+
         $criteria->addSelectColumn(OauthClientsPeer::REDIRECT_URI);
 
     }

workflow/engine/config/schema.xml

@@ -3028,6 +3028,9 @@
     <table name="OAUTH_CLIENTS">
         <column name="CLIENT_ID" type="VARCHAR" size="80" required="true" primaryKey="true" />
         <column name="CLIENT_SECRET" type="VARCHAR"  size="80" required="true" />
+        <column name="CLIENT_NAME" type="VARCHAR" size="256" required="true" />
+        <column name="CLIENT_DESCRIPTION" type="VARCHAR" size="1024" required="true" />
+        <column name="CLIENT_WEBSITE" type="VARCHAR" size="1024" required="true" />
         <column name="REDIRECT_URI" type="VARCHAR" size="2000" required="true" />
     </table>
     <table name="OAUTH_REFRESH_TOKENS">
@@ -3042,4 +3045,11 @@
         <column name="SCOPE" type="VARCHAR" size="2000" required="false" />
         <column name="CLIENT_ID" type="VARCHAR"  size="80" required="false" />
     </table>
+
+    <table name="PMOAUTH_USER_ACCESS_TOKENS">
+        <column name="ACCESS_TOKEN" type="VARCHAR" size="40" required="true" primaryKey="true" />
+        <column name="REFRESH_TOKEN" type="VARCHAR" size="40" required="true" />
+        <column name="USER_ID" type="VARCHAR"  size="32" required="false" />
+        <column name="SESSION_ID" type="VARCHAR" size="40" required="true" />
+    </table>
 </database>

workflow/engine/data/mysql/schema.sql

@@ -1516,6 +1516,9 @@ CREATE TABLE `OAUTH_CLIENTS`
 (
 	`CLIENT_ID` VARCHAR(80)  NOT NULL,
 	`CLIENT_SECRET` VARCHAR(80)  NOT NULL,
+	`CLIENT_NAME` VARCHAR(256)  NOT NULL,
+	`CLIENT_DESCRIPTION` VARCHAR(1024)  NOT NULL,
+	`CLIENT_WEBSITE` VARCHAR(1024)  NOT NULL,
 	`REDIRECT_URI` VARCHAR(2000)  NOT NULL,
 	PRIMARY KEY (`CLIENT_ID`)
 )ENGINE=InnoDB ;
@@ -1548,5 +1551,20 @@ CREATE TABLE `OAUTH_SCOPES`
 	`SCOPE` VARCHAR(2000),
 	`CLIENT_ID` VARCHAR(80)
 )ENGINE=InnoDB ;
+#-----------------------------------------------------------------------------
+#-- PMOAUTH_USER_ACCESS_TOKENS
+#-----------------------------------------------------------------------------
+
+DROP TABLE IF EXISTS `PMOAUTH_USER_ACCESS_TOKENS`;
+
+
+CREATE TABLE `PMOAUTH_USER_ACCESS_TOKENS`
+(
+	`ACCESS_TOKEN` VARCHAR(40)  NOT NULL,
+	`REFRESH_TOKEN` VARCHAR(40)  NOT NULL,
+	`USER_ID` VARCHAR(32),
+	`SESSION_ID` VARCHAR(40)  NOT NULL,
+	PRIMARY KEY (`ACCESS_TOKEN`)
+)ENGINE=InnoDB ;
 # This restores the fkey checks, after having unset them earlier
 SET FOREIGN_KEY_CHECKS = 1;

workflow/engine/methods/oauth2/authorize.php

@@ -0,0 +1,34 @@
+<?php
+switch ($_SERVER['REQUEST_METHOD']) {
+    case 'GET':
+        $G_PUBLISH = new Publisher();
+
+        $G_PUBLISH->AddContent( 'view', 'oauth2/authorize' );
+
+        G::RenderPage('publish', 'minimal');
+    break;
+
+    case 'POST':
+        require_once PATH_CORE . 'services/oauth2/Server.php';
+
+        list($host, $port) = strpos(DB_HOST, ':') !== false ? explode(':', DB_HOST) : array(DB_HOST, '');
+        $port = empty($port) ? '' : ";port=$port";
+
+        \Api\OAuth2\Server::setDatabaseSource(DB_USER, DB_PASS, DB_ADAPTER.":host=$host;dbname=".DB_NAME.$port);
+        \Api\OAuth2\Server::setPmClientId('x-pm-local-client');
+
+        $oauthServer = new \Api\OAuth2\Server();
+        $userid = $_SESSION['USER_LOGGED'];
+        $authorize = isset($_POST['authorize']) ? (bool) $_POST['authorize'] : false;
+
+
+        $response = $oauthServer->postAuthorize($authorize, $userid, true);
+
+        $code = substr($response->getHttpHeader('Location'), strpos($response->getHttpHeader('Location'), 'code=')+5, 40);
+
+        echo 'session_id ' . session_id() . '<br>';
+        exit("SUCCESS! ==>  Authorization Code: $code");
+
+        //die($response->send());
+    break;
+}

workflow/engine/methods/services/oauth2_grant.php

@@ -1,14 +1,20 @@
 <?php
 
-//$host = 'http://pmos/sysworkflow/en/neoclassic/services/oauth2_grant';
-$host = 'http://pmos/api/1.0/workflow/token';
+if (! empty($_GET['error'])) {
+    echo '<h1>'.$_GET['error'] . '</h1><br/>';
+    die($_GET['error_description']);
+}
 
-$clientId = 'testclient';
-$secret = 'testpass';
+
+$host = 'http://pmos/api/1.0/workflow/token';
+$code = empty($_GET['code']) ? 'NN' : $_GET['code'];
+
+$clientId = 'x-pm-local-client';
+$secret = '179ad45c6ce2cb97cf1029e212046e81';
 
 $data = array(
     'grant_type' => 'authorization_code',
-    'code' => $_GET['code']
+    'code' => $code
 );
 
 $ch = curl_init($host);
@@ -20,9 +26,26 @@ curl_setopt($ch, CURLOPT_POST, 1);
 curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
-$return = @json_decode(curl_exec($ch));
+$data = @json_decode(curl_exec($ch));
+
+if (is_object($data)) {
+    /*$data = (array) $data;
+    require_once PATH_CORE . 'classes/model/DesignerOauthAccessTokens.php';
+
+    $model = new DesignerOauthAccessTokens();
+    $model->setAccessToken($data['access_token']);
+    $model->setExpires($data['expires_in']);
+    $model->setTokenType($data['token_type']);
+    $model->setScope($data['scope']);
+    $model->setRefreshToken($data['refresh_token']);
+    $model->setClientId($clientId);
+    $model->setUserId($_SESSION['USER_LOGGED']);
+
+    $model->save();*/
+}
 
 echo '<pre>';
-print_r($return);
+//print_r($_SESSION);
+print_r($data);
 
 curl_close($ch);

workflow/engine/services/api/processmaker/Application.php

@@ -3,9 +3,17 @@ namespace Services\Api\ProcessMaker;
 
 class Application extends \ProcessMaker\Api
 {
+    /**
+     * Sample api protected with OAuth2
+     *
+     * For testing the oAuth token
+     *
+     * @access protected
+     */
     public function get($id)
     {
         $data = array(
+            'USSER_LOGGED' => $this->getUserId(),
             "APP_UID" => $id,
             "PRO_UID" => "13885168416038181883131343548151",
             "DUMMY" => "sample data",
@@ -17,7 +25,6 @@ class Application extends \ProcessMaker\Api
 
     public function post($requestData = null)
     {
-        $requestData;
         $requestData['processed'] = true;
 
         return $requestData;

workflow/engine/services/oauth2/Server.php

@@ -20,61 +20,58 @@ class Server implements iAuthenticate
     /**
      * @var OAuth2_Server
      */
-    //protected static $server;
     protected $server;
-    protected $storage;
-
     /**
      * @var OAuth2_Storage_Pdo
      */
-    //protected static $storage;
-    /**
-     * @var OAuth2_Request
-     */
-    protected static $request;
+    protected $storage;
+    
+    protected $scope = array();
+
+    protected static $pmClientId;
+    protected static $userId;
+
+    protected static $dbUser;
+    protected static $dbPassword;
+    protected static $dsn;
+
     public function __construct()
     {
-        /*$dir = __DIR__ . '/db/';
-        $file = 'oauth.sqlite';
-        if (!file_exists($dir . $file)) {
-            include_once $dir . 'rebuild_db.php';
-        }
-        static::$storage = new \OAuth2\Storage\Pdo(
-            array('dsn' => 'sqlite:' . $dir . $file)
-        );
-        static::$request = \OAuth2\Request::createFromGlobals();
-        static::$server = new \OAuth2\Server(static::$storage);
-        static::$server->addGrantType(
-            new \OAuth2\GrantType\AuthorizationCode(static::$storage)
-        );*/
-
-        static::$request = \OAuth2\Request::createFromGlobals();
-
         require_once 'PmPdo.php';
 
-        $dsn      = 'mysql:dbname=wf_workflow;host=localhost';
-        $username = 'root';
-        $password = 'sample';
-
-        // error reporting (this is a demo, after all!)
-        //ini_set('display_errors',1);error_reporting(E_ALL);
-
-        // Autoloading (composer is preferred, but for this example let's just do this)
-        //require_once('oauth2-server-php/src/OAuth2/Autoloader.php');
-        //\OAuth2\Autoloader::register();
+        $this->scope = array(
+            'view_processes' => 'View Processes',
+            'edit_processes' => 'Edit Processes'
+        );
 
         // $dsn is the Data Source Name for your database, for exmaple "mysql:dbname=my_oauth2_db;host=localhost"
-        $storage = new PmPdo(array('dsn' => $dsn, 'username' => $username, 'password' => $password));
+        $config = array('dsn' => self::$dsn, 'username' => self::$dbUser, 'password' => self::$dbPassword);
+        //var_dump($config); die;
+        $this->storage = new PmPdo($config);
 
         // Pass a storage object or array of storage objects to the OAuth2 server class
-        $this->server = new \OAuth2\Server($storage);
-
-        // Add the "Client Credentials" grant type (it is the simplest of the grant types)
-        $this->server->addGrantType(new \OAuth2\GrantType\ClientCredentials($storage));
+        $this->server = new \OAuth2\Server($this->storage);
 
         // Add the "Authorization Code" grant type (this is where the oauth magic happens)
-        $this->server->addGrantType(new \OAuth2\GrantType\AuthorizationCode($storage));
+        $this->server->addGrantType(new \OAuth2\GrantType\AuthorizationCode($this->storage));
 
+        // Add the "Client Credentials" grant type (it is the simplest of the grant types)
+        $this->server->addGrantType(new \OAuth2\GrantType\ClientCredentials($this->storage));
+
+        // Add the "Refresh token" grant type
+        $this->server->addGrantType(new \OAuth2\GrantType\RefreshToken($this->storage));
+
+        $scope = new \OAuth2\Scope(array(
+            'supported_scopes' => array_keys($this->scope)
+        ));
+        $this->server->setScopeUtil($scope);
+    }
+
+    public static function setDatabaseSource($user, $password, $dsn)
+    {
+        self::$dbUser = $user;
+        self::$dbPassword = $password;
+        self::$dsn = $dsn;
     }
 
     /**
@@ -83,7 +80,7 @@ class Server implements iAuthenticate
      */
     public function register()
     {
-        static::$server->getResponse(static::$request);
+        static::$server->getResponse(\OAuth2\Request::createFromGlobals());
         return array('queryString' => $_SERVER['QUERY_STRING']);
     }
 
@@ -97,10 +94,22 @@ class Server implements iAuthenticate
      */
     public function authorize()
     {
-        $this->server->getResponse(static::$request);
+        $clientId = \OAuth2\Request::createFromGlobals()->query('client_id', '');
+        $requestedScope = \OAuth2\Request::createFromGlobals()->query('scope', '');
+        $requestedScope = empty($requestedScope) ? array() : explode(' ', $requestedScope);
 
-        return array('queryString' => $_SERVER['QUERY_STRING']);
+        if (! empty($clientId)) {
+            $clientDetails = $this->storage->getClientDetails(\OAuth2\Request::createFromGlobals()->query('client_id'));
+        }
+
+        return array(
+            'client_details' => $clientDetails,
+            'query_string'   => $_SERVER['QUERY_STRING'],
+            'supportedScope' => $this->scope,
+            'requestedScope' => $requestedScope
+        );
     }
+
     /**
      * Stage 2: User response is captured here
      *
@@ -114,7 +123,7 @@ class Server implements iAuthenticate
      *
      * @format JsonFormat,UploadFormat
      */
-    public function postAuthorize($authorize = false)
+    public function postAuthorize($authorize = false, $userId = null, $returnResponse = false)
     {
         $request = \OAuth2\Request::createFromGlobals();
         $response = new \OAuth2\Response();
@@ -122,13 +131,12 @@ class Server implements iAuthenticate
         $response = $this->server->handleAuthorizeRequest(
             $request,
             $response,
-            (bool)$authorize
+            (bool)$authorize,
+            $userId
         );
 
-        if ($authorize) {
-            // this is only here so that you get to see your code in the cURL request. Otherwise, we'd redirect back to the client
-            $code = substr($response->getHttpHeader('Location'), strpos($response->getHttpHeader('Location'), 'code=')+5, 40);
-            //exit("SUCCESS! Authorization Code: $code");
+        if ($returnResponse) {
+            return $response;
         }
 
         die($response->send());
@@ -142,26 +150,35 @@ class Server implements iAuthenticate
      *
      * @format JsonFormat,UploadFormat
      */
-    public function postGrant()
+    public function postToken()
     {
-        $response = static::$server->handleGrantRequest(
-            static::$request
-        );
-        die($response->send());
-    }
-    /**
-     * Sample api protected with OAuth2
-     *
-     * For testing the oAuth token
-     *
-     * @access protected
-     */
-    public function postAccess()
-    {
-        return array(
-            'friends' => array('john', 'matt', 'jane')
-        );
+        // Handle a request for an OAuth2.0 Access Token and send the response to the client
+        $request = \OAuth2\Request::createFromGlobals();
+        $response = $this->server->handleTokenRequest($request);
+
+        /* DEPREACATED
+        $token = $response->getParameters();
+        if (array_key_exists('access_token', $token)) {
+            $data = $this->storage->getAccessToken($token['access_token']);
+
+            // verify if the client is our local PM Designer client
+            if ($data['client_id'] == self::getPmClientId()) {
+                error_log('do stuff - is a request from local pm client');
+                require_once "classes/model/PmoauthUserAccessTokens.php";
+
+                $userToken = new \PmoauthUserAccessTokens();
+                $userToken->setAccessToken($token['access_token']);
+                $userToken->setRefreshToken($token['refresh_token']);
+                $userToken->setUserId($data['user_id']);
+                $userToken->setSessionId(session_id());
+
+                $userToken->save();
+            }
+        }*/
+
+        $response->send();
     }
+
     /**
      * Access verification method.
      *
@@ -171,21 +188,41 @@ class Server implements iAuthenticate
      */
     public function __isAllowed()
     {
-        return $this->server->verifyResourceRequest(\OAuth2\Request::createFromGlobals());
+        $request = \OAuth2\Request::createFromGlobals();
+        $allowed = $this->server->verifyResourceRequest($request);
+        $token = $this->server->getAccessTokenData($request);
+
+        self::$userId = $token['user_id'];
+
+        // verify if the client is our local PM Designer client
+        if ($token['client_id'] != self::getPmClientId()) {
+            return $allowed;
+        }
+
+        if (! isset($_SESSION) || ! array_key_exists('USER_LOGGED', $_SESSION)) {
+            return false;
+        }
+
+        return true;
     }
 
-
-
-    /****************************************/
-
-    /**
-     * Stage 3: Client directly calls this api to exchange access token
-     *
-     * It can then use this access token to make calls to protected api
-     */
-    public function postToken()
+    public static function setPmClientId($clientId)
     {
-        // Handle a request for an OAuth2.0 Access Token and send the response to the client
-        return $this->server->handleTokenRequest(\OAuth2\Request::createFromGlobals())->send();
+        self::$pmClientId = $clientId;
+    }
+
+    public static function getPmClientId()
+    {
+        return self::$pmClientId;
+    }
+
+    public function getServer()
+    {
+        return $this->server;
+    }
+
+    public function getUserId()
+    {
+        return self::$userId;
     }
 }

workflow/engine/services/oauth2/views/oauth2/server/authorize.php

@@ -1,30 +1,29 @@
 
-    <p>
-        <strong>Demo App</strong> would like to access the following data:
-    </p>
-    <ul>
-        <li>friends</li>
-        <li>memories</li>
-        <li>hopes, dreams, passions, etc.</li>
-        <li>sock drawer</li>
-    </ul>
-    <p>It will use this data to:</p>
-    <ul>
-        <li>integrate with friends</li>
-        <li>make your life better</li>
-        <li>miscellaneous nefarious purposes</li>
-    </ul>
-    <ul class="authorize_options">
-        <li>
-            <form action="authorize?<?php echo $response['queryString']?>" method="post">
-                <input type="submit" class="button authorize" value="Yes, I Authorize This Request"/>
-                <input type="hidden" name="authorize" value="1"/>
-            </form>
-        </li>
-        <li class="cancel">
-            <form id="cancel" action="authorize?<?php echo $response['queryString']?>" method="post">
-                <a href="#" onclick="document.getElementById('cancel').submit()">cancel</a>
-                <input type="hidden" name="authorize" value="0"/>
-            </form>
-        </li>
-    </ul>
+<p>
+    <strong><?php echo $response['client_details']['CLIENT_NAME']?></strong> would like to access the following data:
+</p>
+<ul>
+    <?php foreach($response['requestedScope'] as $scope) {?>
+    <li><?php echo $response['supportedScope'][$scope] ?></li>
+    <?php } ?>
+</ul>
+<p>It will use this data to:</p>
+<ul>
+    <li>integrate with ProcessMaker</li>
+    <li>make your life better</li>
+    <li>miscellaneous nefarious purposes</li>
+</ul>
+<ul class="authorize_options">
+    <li>
+        <form action="/api/1.0/workflow/authorize?<?php echo $response['query_string']?>" method="post">
+            <input type="submit" class="button authorize" value="Yes, I Authorize This Request"/>
+            <input type="hidden" name="authorize" value="1"/>
+        </form>
+    </li>
+    <li class="cancel">
+        <form id="cancel" action="/api/1.0/workflow/authorize?<?php echo $response['query_string']?>" method="post">
+            <a href="#" onclick="document.getElementById('cancel').submit()">cancel</a>
+            <input type="hidden" name="authorize" value="0"/>
+        </form>
+    </li>
+</ul>

workflow/engine/templates/oauth2/authorize.php

@@ -0,0 +1,135 @@
+<?php
+require_once PATH_CORE . 'services/oauth2/PmPdo.php';
+
+$dsn      = 'mysql:dbname=wf_workflow;host=localhost';
+$username = 'root';
+$password = 'sample';
+
+$this->scope = array(
+    'view_processes' => 'View Processes',
+    'edit_processes' => 'Edit Processes'
+);
+
+// $dsn is the Data Source Name for your database, for exmaple "mysql:dbname=my_oauth2_db;host=localhost"
+$storage = new Api\OAuth2\PmPdo(array('dsn' => $dsn, 'username' => $username, 'password' => $password));
+
+
+
+$clientId = $_GET['client_id'];
+$requestedScope = isset($_GET['scope']) ? $_GET['scope'] : '';
+$requestedScope = empty($requestedScope) ? array() : explode(' ', $requestedScope);
+
+if (! empty($clientId)) {
+    $clientDetails = $storage->getClientDetails($clientId);
+    //g::pr($clientDetails); die;
+}
+
+$response = array(
+    'client_details' => $clientDetails,
+    'query_string'   => $_SERVER['QUERY_STRING'],
+    'supportedScope' => $this->scope,
+    'requestedScope' => $requestedScope
+);
+
+?>
+
+
+<table width="100%" cellspacing="0" cellpadding="0" border="0">
+    <tbody><tr>
+        <td width="100%" style="height:25px">
+        </td>
+    </tr>
+    <tr>
+        <td width="100%" align="center">
+
+            <table width="100%" cellspacing="0" cellpadding="0" border="0" style="padding-top: 3px">
+                <tbody><tr>
+                    <td align="center">
+                        <div align="center" style="; margin:0px;" id="publisherContent[0]">
+
+                            <form  style="margin:0px;" enctype="multipart/form-data" method="post" class="formDefault" action="authorize?<?php echo $response['query_string']?>" name="authorizeForm" id="authorizeForm">
+                                <div style="width:400px; padding-left:0; padding-right:0; border-width:1;" class="borderForm">
+                                    <div class="boxTop"><div class="a"></div><div class="b"></div><div class="c"></div></div>
+                                    <div style="height:100%;" class="content">
+                                        <table width="99%">
+                                            <tbody><tr>
+                                                <td valign="top">
+
+                                                    <table width="100%" cellspacing="0" cellpadding="0" border="0">
+                                                        <tbody>
+                                                        <tr>
+                                                            <td align="" colspan="2" class="FormTitle">
+                                                                <span name="form[TITLE]" id="form[TITLE]">
+                                                                    <strong><?php echo $response['client_details']['CLIENT_NAME']?></strong> would like to access the following data:
+                                                                </span>
+                                                            </td>
+                                                        </tr>
+
+
+                                                        <tr>
+                                                            <td align="" colspan="2" class="FormSubTitle">
+                                                                <span name="form[TITLE]" id="form[TITLE]">
+
+                                                        <ul>
+                                                            <?php foreach($response['requestedScope'] as $scope) {?>
+                                                                <li><?php echo $response['supportedScope'][$scope] ?></li>
+                                                            <?php } ?>
+                                                        </ul>
+                                                        <p>It will use this data to:</p>
+                                                        <ul>
+                                                            <li>integrate with ProcessMaker</li>
+                                                            <li>make your life better</li>
+                                                            <li>miscellaneous nefarious purposes</li>
+                                                        </ul>
+
+                                                            <div align="center">
+
+                                                                <input type="submit" value="Yes, I Authorize This Request" name="authorize" class="module_app_button___gray " value="1">
+                                                                <input type="button" value="Reject this Request" name="reject_btn" id="reject_btn" class="module_app_button___gray " onclick="doSubmit()">
+                                                                <input type="hidden" name="authorize" id="authorize" value="1">
+
+                                                            </div>
+
+
+                                                                </span>
+                                                            </td>
+                                                        </tr>
+
+
+
+
+
+
+
+                                                        </tbody>
+                                                    </table>
+                                                </td>
+                                            </tr>
+                                            </tbody></table>
+                                    </div>
+                                    <div class="boxBottom"><div class="a"></div><div class="b"></div><div class="c"></div></div>
+                                </div>
+
+
+
+
+
+                            </form>
+                        </div>
+                    </td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    </tbody></table>
+
+
+<script>
+function doSubmit()
+{
+    document.getElementById('authorize').value = '0';
+    document.forms[0].submit();
+}
+
+</script>