|
| 1 | +# Discord Provider for OAuth 2.0 Client |
| 2 | +[](https://github.com/wohali/oauth2-discord-new) |
| 3 | +[](https://github.com/wohali/oauth2-discord-new/releases) |
| 4 | +[](LICENSE.md) |
| 5 | +[](https://travis-ci.org/wohali/oauth2-discord-new) |
| 6 | +[](https://scrutinizer-ci.com/g/wohali/oauth2-discord-new) |
| 7 | +[](https://coveralls.io/r/wohali/oauth2-discord-new?branch=master) |
| 8 | +[](https://packagist.org/packages/wohali/oauth2-discord-new) |
| 9 | + |
| 10 | +This package provides Discord OAuth 2.0 support for the PHP League's [OAuth 2.0 Client](https://github.com/thephpleague/oauth2-client), v2.0 and up. |
| 11 | + |
| 12 | +## Requirements |
| 13 | + |
| 14 | +The following versions of PHP are supported. |
| 15 | + |
| 16 | +* PHP 5.6 |
| 17 | +* PHP 7.0 |
| 18 | +* PHP 7.1 |
| 19 | +* HHVM |
| 20 | + |
| 21 | +## Installation |
| 22 | + |
| 23 | +To install, use composer: |
| 24 | + |
| 25 | +```bash |
| 26 | +$ composer require wohali/oauth2-discord-new |
| 27 | +``` |
| 28 | + |
| 29 | +## Usage |
| 30 | + |
| 31 | +Usage is the same as The League's OAuth client, using `\Wohali\OAuth2\Client\Provider\Discord` as the provider. |
| 32 | + |
| 33 | +### Sample Authorization Code Flow |
| 34 | + |
| 35 | +This self-contained example: |
| 36 | + |
| 37 | +1. Gets an authorization code |
| 38 | +1. Gets an access token using the provided authorization code |
| 39 | +1. Looks up the user's provile with the provided access token |
| 40 | + |
| 41 | +You can try this script by [registering a Discord App](https://discordapp.com/developers/applications/me/create) with a redirect URI to your server's copy of this sample script. Then, place the Discord app's client id and secret, along with that same URI, into the settings at the top of the script. |
| 42 | + |
| 43 | +```php |
| 44 | +<?php |
| 45 | + |
| 46 | +require __DIR__ . '/vendor/autoload.php'; |
| 47 | + |
| 48 | +session_start(); |
| 49 | + |
| 50 | +echo ('Main screen turn on!<br/><br/>'); |
| 51 | + |
| 52 | +$provider = new \Wohali\OAuth2\Client\Provider\Discord([ |
| 53 | + 'clientId' => '{discord-client-id}', |
| 54 | + 'clientSecret' => '{discord-client-secret}', |
| 55 | + 'redirecturi' => '{your-server-uri-to-this-script-here}' |
| 56 | +]); |
| 57 | + |
| 58 | +if (!isset($_GET['code'])) { |
| 59 | + |
| 60 | + // Step 1. Get authorization code |
| 61 | + $authUrl = $provider->getAuthorizationUrl(); |
| 62 | + $_SESSION['oauth2state'] = $provider->getState(); |
| 63 | + header('Location: ' . $authUrl); |
| 64 | + |
| 65 | +// Check given state against previously stored one to mitigate CSRF attack |
| 66 | +} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) { |
| 67 | + |
| 68 | + unset($_SESSION['oauth2state']); |
| 69 | + exit('Invalid state'); |
| 70 | + |
| 71 | +} else { |
| 72 | + |
| 73 | + // Step 2. Get an access token using the provided authorization code |
| 74 | + $token = $provider->getAccessToken('authorization_code', [ |
| 75 | + 'code' => $_GET['code'] |
| 76 | + ]); |
| 77 | + |
| 78 | + // Show some token details |
| 79 | + echo '<h2>Token details:</h2>'; |
| 80 | + echo 'Token: ' . $token->getToken() . "<br/>"; |
| 81 | + echo 'Refresh token: ' . $token->getRefreshToken() . "<br/>"; |
| 82 | + echo 'Expires: ' . $token->getExpires() . " - "; |
| 83 | + echo ($token->hasExpired() ? 'expired' : 'not expired') . "<br/>"; |
| 84 | + |
| 85 | + // Step 3. (Optional) Look up the user's profile with the provided token |
| 86 | + try { |
| 87 | + |
| 88 | + $user = $provider->getResourceOwner($token); |
| 89 | + |
| 90 | + echo '<h2>Resource owner details:</h2>'; |
| 91 | + printf('Hello %s#%s!<br/><br/>', $user->getUsername(), $user->getDiscriminator()); |
| 92 | + var_export($user->toArray()); |
| 93 | + |
| 94 | + } catch (Exception $e) { |
| 95 | + |
| 96 | + // Failed to get user details |
| 97 | + exit('Oh dear...'); |
| 98 | + |
| 99 | + } |
| 100 | +} |
| 101 | +``` |
| 102 | + |
| 103 | +### Managing Scopes |
| 104 | + |
| 105 | +When creating your Discord authorization URL in Step 1, you can specify the state and scopes your application may authorize. |
| 106 | + |
| 107 | +```php |
| 108 | +$options = [ |
| 109 | + 'state' => 'OPTIONAL_CUSTOM_CONFIGURED_STATE', |
| 110 | + 'scope' => ['identify', 'email', '...'] // array or string |
| 111 | +]; |
| 112 | + |
| 113 | +$authorizationUrl = $provider->getAuthorizationUrl($options); |
| 114 | +``` |
| 115 | +If neither are defined, the provider will utilize internal defaults. |
| 116 | + |
| 117 | +At the time of authoring this documentation, the [following scopes are available](https://discordapp.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes): |
| 118 | + |
| 119 | +- bot |
| 120 | +- connections |
| 121 | +- email |
| 122 | +- identify |
| 123 | +- guilds |
| 124 | +- guilds.join |
| 125 | +- gdm.join |
| 126 | +- messages.read |
| 127 | +- rpc |
| 128 | +- rpc.api |
| 129 | +- rpc.notifications.read |
| 130 | +- webhook.incoming |
| 131 | + |
| 132 | +### Refreshing a Token |
| 133 | + |
| 134 | +You can refresh an expired token using a refresh token rather than going through the entire process of obtaining a brand new token. To do so, simply reuse the fresh token from your data store to request a refresh: |
| 135 | + |
| 136 | +```php |
| 137 | +// create $provider as in the initial example |
| 138 | +$existingAccessToken = getAccessTokenFromYourDataStore(); |
| 139 | + |
| 140 | +if ($existingAccessToken->hasExpired()) { |
| 141 | + $newAccessToken = $provider->getAccessToken('refresh_token', [ |
| 142 | + 'refresh_token' => $existingAccessToken->getRefreshToken() |
| 143 | + ]); |
| 144 | + |
| 145 | + // Purge old access token and store new access token to your data store. |
| 146 | +} |
| 147 | +``` |
| 148 | + |
| 149 | +### Client Credentials Grant |
| 150 | + |
| 151 | +Discord provides a client credentials flow for bot developers to get their own bearer tokens for testing purposes. This returns an access token for the *bot owner*: |
| 152 | + |
| 153 | +```php |
| 154 | +// create $provider as in the initial example |
| 155 | +try { |
| 156 | + |
| 157 | + // Try to get an access token using the client credentials grant. |
| 158 | + $accessToken = $provider->getAccessToken('client_credentials'); |
| 159 | + |
| 160 | +} catch (\League\OAuth2\Client\Provider\Exception\IdentityProviderException $e) { |
| 161 | + |
| 162 | + // Failed to get the access token |
| 163 | + exit($e->getMessage()); |
| 164 | + |
| 165 | +} |
| 166 | +``` |
| 167 | + |
| 168 | +### Bot Authorization |
| 169 | + |
| 170 | +To authorize a bot, specify a scope of `bot` and set [permissions](https://discordapp.com/developers/docs/topics/permissions#permissions-bitwise-permission-flags) appropriately: |
| 171 | + |
| 172 | +```php |
| 173 | +// create $provider as in the initial example |
| 174 | + |
| 175 | +$options = [ |
| 176 | + 'scope' => ['bot'], |
| 177 | + 'permissions' => 1 |
| 178 | +]; |
| 179 | + |
| 180 | +$authorizationUrl = $provider->getAuthorizationUrl($options); |
| 181 | + |
| 182 | +// Redirect user to authorization page |
| 183 | +header('Location: ' . $authUrl); |
| 184 | +``` |
| 185 | + |
| 186 | +## Testing |
| 187 | + |
| 188 | +``` bash |
| 189 | +$ ./vendor/bin/parallel-lint src test |
| 190 | +$ ./vendor/bin/phpcs src --standard=psr2 -sp |
| 191 | +$ ./vendor/bin/phpunit --coverage-text |
| 192 | +``` |
| 193 | + |
| 194 | +## Contributing |
| 195 | + |
| 196 | +Please see [CONTRIBUTING](https://github.com/wohali/oauth2-discord-new/blob/master/CONTRIBUTING.md) for details. |
| 197 | + |
| 198 | +## Credits |
| 199 | + |
| 200 | +- [Joan Touzet](https://github.com/wohali) |
| 201 | +- [All Contributors](https://github.com/wohali/oauth2-discord-new/contributors) |
| 202 | + |
| 203 | +## License |
| 204 | + |
| 205 | +The MIT License (MIT). Please see [License File](https://github.com/wohali/oauth2-discord-new/blob/master/LICENSE) for more information. |
0 commit comments