Modernize Google OAuth flow (#8)

* Modernize Google OAuth flow

* Require secure Google OAuth dependencies

Author: Jord-JD

.github/workflows/compatibility.yml

@@ -0,0 +1,22 @@
+name: Compatibility
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  composer:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.1', '8.5']
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+      - run: composer update --prefer-dist --no-interaction
+      - run: find src -name '*.php' -print0 | xargs -0 -n1 php -l

README.md

@@ -21,8 +21,28 @@ the packages that make use of this handler.
 
 ## Setup
 
-*TODO*
+Create OAuth client credentials in Google Cloud and register a redirect URI. Then run:
+
+```bash
+php vendor/rapidwebltd/php-google-oauth-2-handler/src/setup.php
+```
+
+The retired out-of-band OAuth flow is not used. After authorizing, copy the
+`code` query parameter from the registered redirect URL back into the setup
+command.
 
 ## Usage
 
-*TODO*
+```php
+use RapidWeb\GoogleOAuth2Handler\GoogleOAuth2Handler;
+
+$handler = new GoogleOAuth2Handler(
+    $clientId,
+    $clientSecret,
+    $scopes,
+    $refreshToken,
+    $redirectUri
+);
+
+$response = $handler->performRequest('GET', 'https://people.googleapis.com/v1/people/me');
+```

composer.json

@@ -10,8 +10,9 @@
         }
     ],
     "require": {
-        "google/apiclient": "^2.2",
-        "guzzlehttp/guzzle": "^6.3"
+        "php": "^8.1",
+        "google/apiclient": "^2.19",
+        "guzzlehttp/guzzle": "^7.4.5"
     },
     "autoload": {
         "psr-4": {

src/GoogleOAuth2Handler.php

@@ -2,24 +2,31 @@
 
 namespace RapidWeb\GoogleOAuth2Handler;
 
-use GuzzleHttp\Psr7\Request;
+use InvalidArgumentException;
+use RuntimeException;
 
 class GoogleOAuth2Handler
 {
     private $clientId;
     private $clientSecret;
     private $scopes;
     private $refreshToken;
+    private $redirectUri;
     private $client;
 
     public $authUrl;
 
-    public function __construct($clientId, $clientSecret, $scopes, $refreshToken = '')
+    public function __construct($clientId, $clientSecret, $scopes, $refreshToken = '', $redirectUri = null)
     {
         $this->clientId = $clientId;
         $this->clientSecret = $clientSecret;
         $this->scopes = $scopes;
         $this->refreshToken = $refreshToken;
+        $this->redirectUri = $redirectUri;
+
+        if (!$this->refreshToken && !$this->redirectUri) {
+            throw new InvalidArgumentException('A redirect URI is required when requesting a new Google authorization code.');
+        }
 
         $this->setupClient();
     }
@@ -30,11 +37,17 @@ private function setupClient()
 
         $this->client->setClientId($this->clientId);
         $this->client->setClientSecret($this->clientSecret);
-        $this->client->setRedirectUri('urn:ietf:wg:oauth:2.0:oob');
+        if ($this->redirectUri) {
+            $this->client->setRedirectUri($this->redirectUri);
+        }
         $this->client->setAccessType('offline');
-        $this->client->setApprovalPrompt('force');
+        if (method_exists($this->client, 'setPrompt')) {
+            $this->client->setPrompt('consent');
+        } else {
+            $this->client->setApprovalPrompt('force');
+        }
 
-        foreach($this->scopes as $scope)  {
+        foreach ($this->scopes as $scope) {
             $this->client->addScope($scope);
         }
 
@@ -47,17 +60,27 @@ private function setupClient()
 
     public function getRefreshToken($authCode)
     {
-        $this->client->authenticate($authCode);
-        $accessToken = $this->client->getAccessToken();
+        $accessToken = $this->client->fetchAccessTokenWithAuthCode($authCode);
+
+        if (isset($accessToken['error'])) {
+            throw new RuntimeException('Google rejected the authorization code: '.($accessToken['error_description'] ?? $accessToken['error']));
+        }
+
+        if (empty($accessToken['refresh_token'])) {
+            throw new RuntimeException('Google did not return a refresh token. Revoke the existing grant and authorize again with consent.');
+        }
+
         return $accessToken['refresh_token'];
     }
 
-    public function performRequest($method, $url, $body = null)
+    public function performRequest($method, $url, $body = null, array $options = [])
     {
         $httpClient = $this->client->authorize();
-        $request = new Request($method, $url, [], $body);
-        $response = $httpClient->send($request);
-        return $response;
-    }
 
-}
+        if ($body !== null && !array_key_exists('body', $options)) {
+            $options['body'] = $body;
+        }
+
+        return $httpClient->request($method, $url, $options);
+    }
+}

src/setup.php

@@ -25,6 +25,7 @@
 
 $clientId = trim(readline('Google Client ID: '));
 $clientSecret = trim(readline('Google Client Secret: '));
+$redirectUri = trim(readline('Authorized redirect URI: '));
 echo PHP_EOL;
 
 echo 'You need to select the scopes you need access to. Go to the';
@@ -48,19 +49,19 @@
     }
 }
 
-$googleOAuth2Handler = new GoogleOAuth2Handler($clientId, $clientSecret, $scopes);
+$googleOAuth2Handler = new GoogleOAuth2Handler($clientId, $clientSecret, $scopes, '', $redirectUri);
 
 echo PHP_EOL;
 echo 'Now, go to the following URL, sign in to your Google Account,';
 echo PHP_EOL;
-echo 'and copy-paste the auth code you receive below.';
+echo 'and copy the `code` query parameter from the redirect URL below.';
 echo PHP_EOL.PHP_EOL;
 
 echo $googleOAuth2Handler->authUrl;
 echo PHP_EOL.PHP_EOL;
 
 $authCode = trim(readline('Auth Code: '));
-echo PHP_EOL;PHP_EOL;
+echo PHP_EOL.PHP_EOL;
 
 $refreshToken = $googleOAuth2Handler->getRefreshToken($authCode);
 
@@ -83,7 +84,9 @@
 echo PHP_EOL;
 echo '$refreshToken = \''.$refreshToken.'\';';
 echo PHP_EOL;
+echo '$redirectUri  = \''.$redirectUri.'\';';
+echo PHP_EOL;
 echo '$scopes       = [\''.implode('\', \'', $scopes).'\'];';
 echo PHP_EOL.PHP_EOL;
-echo '$googleOAuth2Handler = new GoogleOAuth2Handler($clientId, $clientSecret, $scopes, $refreshToken);';
+echo '$googleOAuth2Handler = new GoogleOAuth2Handler($clientId, $clientSecret, $scopes, $refreshToken, $redirectUri);';
 echo PHP_EOL.PHP_EOL;