38538993966

Committed 14 Oct 2026 08:58AM UTC coverage: 77.499% (+0.5%) from 77.02%

Build # 38538993966

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #75 from daycry/refactor/code-health-cleanup

refactor: code-health cleanup; fix OAuth info leak and bugs hidden in the PHPStan baseline

Coverage Stats

89 of 100 new or added lines in 21 files covered. (89.0%)

5497 of 7093 relevant lines covered (77.5%)

81.8 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

69.23

/src/Controllers/OauthController.php

<?php

declare(strict_types=1);

/**
 * This file is part of Daycry Auth.
 *
 * (c) Daycry <daycry9@proton.me>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Daycry\Auth\Controllers;

use Daycry\Auth\Config\AuthOAuth;
use Daycry\Auth\Exceptions\AuthenticationException;
use Daycry\Auth\Libraries\Oauth\OauthManager;
use Throwable;

class OauthController extends BaseAuthController
{
    protected $helpers = ['setting', 'url'];

    /**
     * Get rules for validation
     */
    protected function getValidationRules(): array
    {
        return [];
    }

    public function redirect(string $provider)
    {
        return $this->createManager()->setProvider($provider)->redirect();
    }

    /**
     * Begins linking an OAuth provider to the *currently authenticated* user.
     *
     * Unlike redirect()/callback() (which sign a user in), this stashes the
     * logged-in user's id so the shared callback links the provider to them
     * explicitly — the safe alternative to merging accounts by e-mail.
     */
    public function link(string $provider)
    {
        if (! auth()->loggedIn()) {
            return redirect()->to(config('Auth')->loginPage());
        }

        session()->set('oauth_link_user_id', auth()->id());

        return $this->createManager()->setProvider($provider)->redirect();
    }

    public function callback(string $provider)
    {
        try {
            $this->createManager()->setProvider($provider)->handleCallback(
                $this->request->getGet('code') ?? '',
                $this->request->getGet('state') ?? '',
            );

            return redirect()->to(config('Auth')->loginRedirect());
        } catch (AuthenticationException $e) {
            // User-facing, translated messages (invalid state, unverified e-mail, ...).
            return redirect()->to(config('Auth')->loginPage())->with('error', $e->getMessage());
        } catch (Throwable $e) {
            // Anything else (database, provider HTTP, misconfiguration) may carry
            // internal details: log it and show a generic message instead.
            log_message('error', 'OAuth callback for provider {provider} failed: {message}', [
                'provider' => $provider,
                'message'  => $e->getMessage(),
            ]);

            return redirect()->to(config('Auth')->loginPage())->with('error', lang('Auth.badAttempt'));
        }
    }

    /**
     * Builds the OAuth manager for the configured providers.
     */
    protected function createManager(): OauthManager
    {
        /** @var AuthOAuth $config */
        $config = config('AuthOAuth');

        return new OauthManager($config);
    }
}

1	<?php
2
3	declare(strict_types=1);
4
5	/**
6	* This file is part of Daycry Auth.
7	*
8	* (c) Daycry <daycry9@proton.me>
9	*
10	* For the full copyright and license information, please view
11	* the LICENSE file that was distributed with this source code.
12	*/
13
14	namespace Daycry\Auth\Controllers;
15
16	use Daycry\Auth\Config\AuthOAuth;
17	use Daycry\Auth\Exceptions\AuthenticationException;
18	use Daycry\Auth\Libraries\Oauth\OauthManager;
19	use Throwable;
20
21	class OauthController extends BaseAuthController
22	{
23	protected $helpers = ['setting', 'url'];
24
25	/**
26	* Get rules for validation
27	*/
28	protected function getValidationRules(): array	×
29	{
30	return [];	×
31	}
32
33	public function redirect(string $provider)	1 ✔
34	{
35	return $this->createManager()->setProvider($provider)->redirect();	1 ✔
36	}
37
38	/**
39	* Begins linking an OAuth provider to the currently authenticated user.
40	*
41	* Unlike redirect()/callback() (which sign a user in), this stashes the
42	* logged-in user's id so the shared callback links the provider to them
43	* explicitly — the safe alternative to merging accounts by e-mail.
44	*/
45	public function link(string $provider)	×
46	{
47	if (! auth()->loggedIn()) {	×
48	return redirect()->to(config('Auth')->loginPage());	×
49	}
50
51	session()->set('oauth_link_user_id', auth()->id());	×
52
NEW 53	return $this->createManager()->setProvider($provider)->redirect();	×
54	}
55
56	public function callback(string $provider)	2 ✔
57	{
58	try {
59	$this->createManager()->setProvider($provider)->handleCallback(	2 ✔
60	$this->request->getGet('code') ?? '',	2 ✔
61	$this->request->getGet('state') ?? '',	2 ✔
62	);	2 ✔
63
64	return redirect()->to(config('Auth')->loginRedirect());	×
65	} catch (AuthenticationException $e) {	2 ✔
66	// User-facing, translated messages (invalid state, unverified e-mail, ...).
67	return redirect()->to(config('Auth')->loginPage())->with('error', $e->getMessage());	1 ✔
68	} catch (Throwable $e) {	1 ✔
69	// Anything else (database, provider HTTP, misconfiguration) may carry
70	// internal details: log it and show a generic message instead.
71	log_message('error', 'OAuth callback for provider {provider} failed: {message}', [	1 ✔
72	'provider' => $provider,	1 ✔
73	'message' => $e->getMessage(),	1 ✔
74	]);	1 ✔
75
76	return redirect()->to(config('Auth')->loginPage())->with('error', lang('Auth.badAttempt'));	1 ✔
77	}
78	}
79
80	/**
81	* Builds the OAuth manager for the configured providers.
82	*/
83	protected function createManager(): OauthManager	1 ✔
84	{
85	/** @var AuthOAuth $config */
86	$config = config('AuthOAuth');	1 ✔
87
88	return new OauthManager($config);	1 ✔
89	}
90	}

daycry / auth / 38538993966

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous