Restler+OAuth2 - Identifying the user correctly

Question

I'm working with Restler and the OAuth2 module written by Brent Shaffer. What I want to do is determine the user from the token they send, inside my app classes, not just the OAuth2Server classes.

There are two methods that I can see of doing this. Hopefully this explains what I am trying to do.

Method 1: I don't particularly like this method, but it works.

POST /v1/token

Returns my token including the user_id, for example

{
    "access_token":"282090609b3407d981c2bea633a39739595ba426",
    "expires_in":3600,
    "token_type":"Bearer",
    "scope":"basic",
    "refresh_token":"b60a4e5f759168df857342380f3550bc120b6f9d",
    "user_id": 5
}

Now that the client knows the user_id, it is sent with my request:

GET /v1/dashboard?id=5

My __isAllowed method takes care of checking that the user hasn't altered the id, requesting info that isn't theirs.

public function __isAllowed() {   
    $token  = static::$server->getAccessTokenData(Request::createFromGlobals());

    return (($token['user_id'] > 0) && ($token['user_id'] === $_GET['id']) && ($token['group_id'] == self::$group_id));
}

Dashboard class looks like this:

/*
 * @version    1
 * @access protected
 */
class Dashboard {
    /**
     * @param int $id Customer ID {@from query}
     * @return type
     */
    public function index($id) {           
        $s = Dao\ViewCustomerDaoObject::findId($id);

        return array_merge($s->toJSON(), $widgets);
    }
}

---

This is how I would prefer to be calling the API:

GET /v1/dashboard

When I request the above, join the oauth2_token table to my dashboard table. I think this might be a bit of a hack and I don't want this to cause problems down the road.

The info is already available in the OAuth2Server instance, as the OAuth2Server class does determine if the correct token is used and what their user_id is.

Can someone please guide me in the right direction for handling this situation, particularly with Restler?

Answer 1

I actually figured this out myself.

In the OAuth2Server->__isAllowed method, you must set the UserId in the static User class.

public function __isAllowed() {   
    $token = static::$server->getAccessTokenData(Request::createFromGlobals());

    // If the user_id is valid, set static user class. 
    // *** This is not production code, add more checks here if you use this!
    if ($token['user_id'] > 0) {
        \Luracast\Restler\User::init();
        \Luracast\Restler\User::setUniqueIdentifier($token['user_id']);
        return true;
    }
    return false;
}

Now you can get the currently authenticated user in your class by calling:

 \Luracast\Restler\User::getUniqueIdentifier(true)