Yoast\WP\SEO\MyYoast_Client\Application

Authorization_Code_Handler::get_authorization_url │ public │ Yoast 1.0

Builds the authorization URL for the user to visit.

Generates PKCE challenge, state, and nonce, and stores them in the expiring store.

Метод класса: Authorization_Code_Handler{}

Хуков нет.

Возвращает

Строку. The authorization URL to redirect the user to.

Использование

$Authorization_Code_Handler = new Authorization_Code_Handler();
$Authorization_Code_Handler->get_authorization_url( $user_id, $scopes, $resource_indicator, ?string $return_url ): string;

$user_id(int) (обязательный)

The WordPress user ID.

$scopes(string[]) (обязательный)

The scopes to request.

$resource_indicator(Resource_Indicator) (обязательный)

The RFC 8707 resource indicator the issued token should be bound to.

?string $return_url

.
По умолчанию: null

Код Authorization_Code_Handler::get_authorization_url() Authorization Code Handler::get authorization url ^{Yoast 28.3}

public function get_authorization_url( int $user_id, array $scopes, Resource_Indicator $resource_indicator, ?string $return_url = null ): string {
	if ( $user_id <= 0 ) {
		throw new Authorization_Flow_Exception( 'invalid_user', 'A valid WordPress user ID is required to start the authorization flow.' );
	}

	// Registration is a prerequisite handled by the connect flow; this method never triggers DCR.
	$registered_client = $this->client_registration->get_registered_client();
	if ( $registered_client === null ) {
		throw new Authorization_Flow_Exception( 'not_registered', 'Site is not registered with MyYoast; complete the registration first.' );
	}

	// Resolve which registered redirect URI to embed in this request (the server matches it exactly).
	$redirect_uri = $this->redirect_uri_provider->get_authorization_redirect_uri(
		$registered_client,
		$user_id,
		$scopes,
		$resource_indicator,
		$return_url,
	);

	try {
		$auth_endpoint = $this->discovery->get_document()->get_authorization_endpoint();
	} catch ( Discovery_Failed_Exception | Server_Capability_Exception $e ) {
		// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Internal exception message.
		throw new Authorization_Flow_Exception( 'discovery_failed', $e->getMessage(), 0, $e );
	}

	$requests_openid = \in_array( 'openid', $scopes, true );

	try {
		$code_verifier  = Base64url::encode( \random_bytes( 32 ) );
		$code_challenge = Base64url::encode( \hash( 'sha256', $code_verifier, true ) );
		// State = CSRF protection on the redirect (verified by us on callback).
		$state = Base64url::encode( \random_bytes( 32 ) );
		// Nonce = ID token replay protection per OIDC Core 1.0 Section 3.1.2.1
		// (embedded in the ID token by the server, verified by us to ensure freshness).
		// Only generated when openid scope is requested, as nonces are not permitted otherwise.
		$nonce = ( $requests_openid ) ? Base64url::encode( \random_bytes( 16 ) ) : null;
	} catch ( Exception $e ) {
		// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Internal exception message.
		throw new Authorization_Flow_Exception( 'random_failure', 'Failed to generate secure random values.', 0, $e );
	}

	try {
		$flow_state = new Auth_Flow_State( $code_verifier, $state, $nonce, $redirect_uri, $return_url, $resource_indicator );
	} catch ( InvalidArgumentException $e ) {
		// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Internal exception message.
		throw new Authorization_Flow_Exception( 'invalid_state', $e->getMessage(), 0, $e );
	}

	$this->expiring_store->persist_for_user(
		self::CURRENT_AUTH_FLOW_STATE_KEY,
		$flow_state->to_array(),
		self::PKCE_TTL,
		$user_id,
	);

	$params = [
		'response_type'         => 'code',
		'client_id'             => $registered_client->get_client_id(),
		'redirect_uri'          => $redirect_uri,
		'scope'                 => \implode( ' ', $scopes ),
		'code_challenge'        => $code_challenge,
		'code_challenge_method' => 'S256',
		'state'                 => $state,
		'prompt'                => 'consent',
	];

	if ( $nonce !== null ) {
		$params['nonce'] = $nonce;
	}

	if ( ! $resource_indicator->is_default() ) {
		$params['resource'] = $resource_indicator->value();
	}

	return $auth_endpoint . '?' . \http_build_query( $params, '', '&', \PHP_QUERY_RFC3986 );
}