Skip to content

Commit 960339f

Browse files
henrikwirthhenrikwirth
committed
Merge branch 'develop' into docs/add-all-mutations
# Conflicts: # src/Auth.php
2 parents 098e571 + 26f2c0c commit 960339f

File tree

2 files changed

+70
-18
lines changed

2 files changed

+70
-18
lines changed

‎src/Auth.php‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ public static function login_and_get_token( $username, $password ) {
6868
* The token is signed, now create the object with basic user data to send to the client
6969
*/
7070
$response = [
71-
'authToken' => self::get_signed_token( $user ),
72-
'refreshToken' => self::get_refresh_token( $user ),
71+
'authToken' => self::get_signed_token( wp_get_current_user() ),
72+
'refreshToken' => self::get_refresh_token( wp_get_current_user() ),
7373
'user' => DataSource::resolve_user( $user->data->ID, \WPGraphQL::get_app_context() ),
7474
'id' => $user->data->ID,
7575
];
@@ -123,7 +123,8 @@ public static function get_token_expiration() {
123123
/**
124124
* Retrieves validates user and retrieve signed token
125125
*
126-
* @param User|WP_User $user Owner of the token.
126+
* @param \WP_User $user Owner of the token.
127+
* @param bool $cap_check Whether to check capabilities when getting the token
127128
*
128129
* @return null|string
129130
*/
@@ -200,11 +201,13 @@ protected static function get_signed_token( $user, $cap_check = true ) {
200201
*/
201202
public static function get_user_jwt_secret( $user_id ) {
202203

204+
$is_revoked = Auth::is_jwt_secret_revoked( $user_id );
205+
203206
/**
204207
* If the secret has been revoked, throw an error
205208
*/
206-
if ( true === Auth::is_jwt_secret_revoked( $user_id ) ) {
207-
return new \WP_Error( 'graphql-jwt-revoked-secret', __( 'The JWT Auth secret cannot be returned', 'wp-graphql-jwt-authentication' ) );
209+
if ( true === (bool) $is_revoked ) {
210+
return null;
208211
}
209212

210213
/**
@@ -216,11 +219,11 @@ public static function get_user_jwt_secret( $user_id ) {
216219
$capability = apply_filters( 'graphql_jwt_auth_edit_users_capability', 'edit_users', $user_id );
217220

218221
/**
219-
* If the request is not from the current_user AND the current_user doesn't have the proper capabilities, don't return the secret
222+
* If the request is not from the current_user or the current_user doesn't have the proper capabilities, don't return the secret
220223
*/
221224
$is_current_user = ( $user_id === get_current_user_id() ) ? true : false;
222225
if ( ! $is_current_user && ! current_user_can( $capability ) ) {
223-
return new \WP_Error( 'graphql-jwt-improper-capabilities', __( 'The JWT Auth secret for this user cannot be returned', 'wp-graphql-jwt-authentication' ) );
226+
return null;
224227
}
225228

226229
/**
@@ -232,7 +235,7 @@ public static function get_user_jwt_secret( $user_id ) {
232235
* If there is no stored secret, or it's not a string
233236
*/
234237
if ( empty( $secret ) || ! is_string( $secret ) ) {
235-
Auth::issue_new_user_secret( $user_id );
238+
$secret = Auth::issue_new_user_secret( $user_id );
236239
}
237240

238241
/**
@@ -291,13 +294,21 @@ public static function is_jwt_secret_revoked( $user_id ) {
291294
* Public method for getting an Auth token for a given user
292295
*
293296
* @param \WP_USer $user The user to get the token for
297+
* @param boolean $cap_check Whether to check capabilities. Default is true.
294298
*
295299
* @return null|string
296300
*/
297301
public static function get_token( $user, $cap_check = true ) {
298302
return self::get_signed_token( $user, $cap_check );
299303
}
300304

305+
/**
306+
* Given a WP_User, this returns a refresh token for the user
307+
* @param \WP_User $user A WP_User object
308+
* @param bool $cap_check
309+
*
310+
* @return null|string
311+
*/
301312
public static function get_refresh_token( $user, $cap_check = true ) {
302313

303314
self::$is_refresh_token = true;
@@ -309,6 +320,7 @@ public static function get_refresh_token( $user, $cap_check = true ) {
309320
*/
310321
add_filter( 'graphql_jwt_auth_token_before_sign', function( $token, \WP_User $user ) {
311322
$secret = Auth::get_user_jwt_secret( $user->ID );
323+
312324
if ( ! empty( $secret ) && ! is_wp_error( $secret ) && true === self::is_refresh_token() ) {
313325

314326
/**

‎src/ManageTokens.php‎

Lines changed: 50 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
namespace WPGraphQL\JWT_Authentication;
1010

1111
use GraphQL\Error\UserError;
12+
use WPGraphQL\Model\User;
1213

1314
/**
1415
* Class - ManageToken
@@ -75,46 +76,83 @@ public static function register_jwt_fields_to( $type ) {
7576
'type' => 'String',
7677
'description' => __( 'A JWT token that can be used in future requests for authentication/authorization', 'wp-graphql-jwt-authentication' ),
7778
'resolve' => function ( $user ) {
78-
$user = get_user_by( 'id', $user->ID );
79+
80+
$user_id = 0;
81+
if ( isset( $user->userId ) ) {
82+
$user_id = $user->userId;
83+
} else if ( isset( $user->ID ) ) {
84+
$user_id = $user->ID;
85+
}
86+
87+
if ( ! $user instanceof \WP_User && ! empty( $user_id ) ) {
88+
$user = get_user_by( 'id', $user_id );
89+
}
7990

8091
// Get the token for the user.
8192
$token = Auth::get_token( $user );
8293

8394
// If the token cannot be returned, throw an error.
84-
if ( empty( $token ) || is_wp_error( $token ) ) {
95+
if ( empty( $token ) ) {
8596
throw new UserError( __( 'The JWT token could not be returned', 'wp-graphql-jwt-authentication' ) );
8697
}
8798

99+
if ( $token instanceof \WP_Error ) {
100+
throw new UserError( $token->get_error_message() );
101+
}
102+
88103
return ! empty( $token ) ? $token : null;
89104
},
90105
],
91106
'jwtRefreshToken' => [
92107
'type' => 'String',
93108
'description' => __( 'A JWT token that can be used in future requests to get a refreshed jwtAuthToken. If the refresh token used in a request is revoked or otherwise invalid, a valid Auth token will NOT be issued in the response headers.', 'wp-graphql-jwt-authentication' ),
94109
'resolve' => function ( $user ) {
95-
$user = get_user_by( 'id', $user->ID );
110+
111+
$user_id = 0;
112+
if ( isset( $user->userId ) ) {
113+
$user_id = $user->userId;
114+
} else if ( isset( $user->ID ) ) {
115+
$user_id = $user->ID;
116+
}
117+
118+
if ( ! $user instanceof \WP_User && ! empty( $user_id ) ) {
119+
$user = get_user_by( 'id', $user_id );
120+
}
96121

97122
// Get the token for the user.
98123
$token = Auth::get_refresh_token( $user );
99124

100125
// If the token cannot be returned, throw an error.
101-
if ( empty( $token ) || is_wp_error( $token ) ) {
126+
if ( empty( $token ) ) {
102127
throw new UserError( __( 'The JWT token could not be returned', 'wp-graphql-jwt-authentication' ) );
103128
}
104129

130+
if ( $token instanceof \WP_Error ) {
131+
throw new UserError( $token->get_error_message() );
132+
}
133+
105134
return ! empty( $token ) ? $token : null;
106135
},
107136
],
108137
'jwtUserSecret' => [
109138
'type' => 'String',
110139
'description' => __( 'A unique secret tied to the users JWT token that can be revoked or refreshed. Revoking the secret prevents JWT tokens from being issued to the user. Refreshing the token invalidates previously issued tokens, but allows new tokens to be issued.', 'wp-graphql' ),
111140
'resolve' => function ( $user ) {
141+
142+
$user_id = 0;
143+
144+
if ( isset( $user->userId ) ) {
145+
$user_id = $user->userId;
146+
} else if ( isset( $user->ID ) ) {
147+
$user_id = $user->ID;
148+
}
149+
112150
// Get the user's JWT Secret.
113-
$secret = Auth::get_user_jwt_secret( $user->ID );
151+
$secret = Auth::get_user_jwt_secret( $user_id );
114152

115153
// If the secret cannot be returned, throw an error.
116-
if ( is_wp_error( $secret ) ) {
117-
throw new UserError( __( 'The user secret could not be returned', 'wp-graphql-jwt-authentication' ) );
154+
if ( $secret instanceof \WP_Error ) {
155+
throw new UserError( $secret->get_error_message() );
118156
}
119157

120158
// Return the secret.
@@ -134,7 +172,7 @@ public static function register_jwt_fields_to( $type ) {
134172
'type' => [ 'non_null' => 'Boolean' ],
135173
'description' => __( 'Whether the JWT User secret has been revoked. If the secret has been revoked, auth tokens will not be issued until an admin, or user with proper capabilities re-issues a secret for the user.', 'wp-graphql-jwt-authentication' ),
136174
'resolve' => function ( $user ) {
137-
$revoked = Auth::is_jwt_secret_revoked( $user->ID );
175+
$revoked = Auth::is_jwt_secret_revoked( $user->userId );
138176

139177
return true === $revoked ? true : false;
140178
},
@@ -229,9 +267,10 @@ public static function prevent_token_from_returning_if_revoked( $token, $user_id
229267
/**
230268
* Returns tokens in the response headers
231269
*
232-
* @param array $headers GraphQL HTTP response headers.
270+
* @param array $headers GraphQL HTTP response headers.
233271
*
234272
* @return array
273+
* @throws \Exception
235274
*/
236275
public static function add_tokens_to_graphql_response_headers( $headers ) {
237276
/**
@@ -277,9 +316,10 @@ public static function add_tokens_to_graphql_response_headers( $headers ) {
277316
* This allows clients the ability to Authenticate with WPGraphQL, use the token
278317
* with REST API Requests, but get new refresh tokens from the REST API Headers
279318
*
280-
* @param WP_HTTP_Response $response Response object.
319+
* @param \WP_HTTP_Response $response Response object.
281320
*
282321
* @return \WP_HTTP_Response
322+
* @throws \Exception
283323
*/
284324
public static function add_auth_headers_to_rest_response( $response ) {
285325
if ( ! $response instanceof \WP_HTTP_Response ) {

0 commit comments

Comments
 (0)