diff --git a/modules/core/api/farm_api.services.yml b/modules/core/api/farm_api.services.yml index 6df00047..6244e9cf 100644 --- a/modules/core/api/farm_api.services.yml +++ b/modules/core/api/farm_api.services.yml @@ -10,7 +10,3 @@ services: class: Drupal\farm_api\Routing\RouteSubscriber tags: - { name: event_subscriber } - farm_api.repositories.scope: - class: Drupal\farm_api\Repositories\FarmScopeRepository - decorates: simple_oauth.repositories.scope - arguments: [ '@entity_type.manager' ] diff --git a/modules/core/api/src/Repositories/FarmScopeRepository.php b/modules/core/api/src/Repositories/FarmScopeRepository.php deleted file mode 100644 index 918c8700..00000000 --- a/modules/core/api/src/Repositories/FarmScopeRepository.php +++ /dev/null @@ -1,118 +0,0 @@ -getDrupalEntity(); - - // Load role ids of roles the consumer has. - $consumer_roles = array_map(function ($role) { - return $role['target_id']; - }, $consumer_entity->get('roles')->getValue()); - - // Include consumer roles. - // By default all consumer roles are available to authorization. - $allowed_roles = array_merge($allowed_roles, $consumer_roles); - - // Load the default user associated with the consumer. - // This is an optional setting, so it may not exist. - $default_user = NULL; - try { - $default_user = $client_entity->getDrupalEntity()->get('user_id')->entity; - } - catch (\InvalidArgumentException $e) { - // Do nothing. - } - - // Load the user associated with the token. - // If there is no user, use the default user. - /** @var \Drupal\user\UserInterface $user */ - $user = $user_identifier - ? $this->entityTypeManager->getStorage('user')->load($user_identifier) - : $default_user; - if (!$user) { - return []; - } - - // Load the user's roles. - // Load all roles for user 1 so they can be granted all possible scopes. - if ((int) $user->id() === 1) { - $user_roles = array_map(function (RoleInterface $role) { - return $role->id(); - }, $this->entityTypeManager->getStorage('user_role')->loadMultiple()); - } - // Else load the normal user's roles. - else { - $user_roles = $user->getRoles(); - } - - // Include the user's roles if enabled. - if ($consumer_entity->get('grant_user_access')->value) { - $allowed_roles = array_merge($allowed_roles, $user_roles); - } - - /* Limit the roles granted to the token. */ - - // Limit to requested roles if enabled. - if ($consumer_entity->get('limit_requested_access')->value) { - - // Save the requested scopes (roles) that were passed to this - // finalizeScopes() method. - $requested_roles = array_map(function (ScopeEntityInterface $scope) { - return $scope->getIdentifier(); - }, $scopes); - - // Reduce the requested roles to only those in allowed roles. - // This prevents additional roles being granted than the user - // and consumer have available. - $allowed_requested_roles = array_filter($requested_roles, function ($role_id) use ($allowed_roles) { - return in_array($role_id, $allowed_roles); - }); - - // Filter the allowed roles to only those requested. - $allowed_roles = array_intersect($allowed_roles, $allowed_requested_roles); - } - - // Limit to roles the user already has, if enabled. - if ($consumer_entity->get('limit_user_access')->value) { - $allowed_roles = array_intersect($allowed_roles, $user_roles); - } - - // Always include the authenticated role. - $allowed_roles[] = RoleInterface::AUTHENTICATED_ID; - - // Build a new list of ScopeEntityInterface to return. - $scopes = []; - foreach ($allowed_roles as $role_id) { - $scopes = $this->addRoleToScopes($scopes, $role_id); - } - return $scopes; - } - -}