From 95c8f3bdc729bf33bf2d3ea1d98131868be2c401 Mon Sep 17 00:00:00 2001
From: Diogo Peralta Cordeiro <mail@diogo.site>
Date: Sun, 16 Jan 2022 18:25:08 +0000
Subject: [PATCH] damn

---
 plugins/OAuth2/OAuth2.php          | 37 ++----------------------------
 templates/security/grant.html.twig | 33 --------------------------
 2 files changed, 2 insertions(+), 68 deletions(-)
 delete mode 100644 templates/security/grant.html.twig

diff --git a/plugins/OAuth2/OAuth2.php b/plugins/OAuth2/OAuth2.php
index 827bf8a77c..d472c04790 100644
--- a/plugins/OAuth2/OAuth2.php
+++ b/plugins/OAuth2/OAuth2.php
@@ -38,15 +38,12 @@ use App\Core\Router\RouteLoader;
 use App\Core\Router\Router;
 use App\Util\Common;
 use App\Util\Exception\NoLoggedInUser;
-use App\Util\Formatting;
 use Nyholm\Psr7\Response;
 use Plugin\OAuth2\Controller\Apps;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
-use Symfony\Component\HttpFoundation\Exception\BadRequestException;
 use Trikoder\Bundle\OAuth2Bundle\Event\AuthorizationRequestResolveEvent;
 use Trikoder\Bundle\OAuth2Bundle\Event\UserResolveEvent;
 use Trikoder\Bundle\OAuth2Bundle\OAuth2Events;
-use Trikoder\Bundle\OAuth2Bundle\OAuth2Grants;
 use XML_XRD_Element_Link;
 
 /**
@@ -107,38 +104,8 @@ class OAuth2 extends Plugin implements EventSubscriberInterface
         $request = Common::getRequest();
         try {
             $user = Common::ensureLoggedIn();
-            // get requests will be intercepted and shown the login form
-            // other verbs we will handle as an authorization denied
-            // and this implementation ensures a user is set at this point already
-            if ($request->getMethod() !== 'POST') {
-                $event->resolveAuthorization(AuthorizationRequestResolveEvent::AUTHORIZATION_DENIED);
-                return;
-            } else {
-                if (!$request->request->has('action')) {
-                    // 1. successful login, goes to grant page
-                    $content = Formatting::twigRenderFile('security/grant.html.twig', [
-                        'scopes' => $event->getScopes(),
-                        'client' => $event->getClient(),
-                        'grant'  => OAuth2Grants::AUTHORIZATION_CODE,
-                        // very simple way to ensure user gets to this point in the
-                        // flow when granting or denying is to pre-add their credentials
-                        'email'    => $request->request->get('email'),
-                        'password' => $request->request->get('password'),
-                    ]);
-                    $response = new Response(200, [], $content);
-                    $event->setResponse($response);
-                } else {
-                    // 2. grant operation, either grants or denies
-                    if ($request->request->get('action') === OAuth2Grants::AUTHORIZATION_CODE) {
-                        $event->setUser($user);
-                        $event->resolveAuthorization(AuthorizationRequestResolveEvent::AUTHORIZATION_APPROVED);
-                    } else {
-                        $event->resolveAuthorization(AuthorizationRequestResolveEvent::AUTHORIZATION_DENIED);
-                    }
-                }
-            }
-            // Whoops!
-            throw new BadRequestException();
+            $event->setUser($user);
+            $event->resolveAuthorization(AuthorizationRequestResolveEvent::AUTHORIZATION_APPROVED);
         } catch (NoLoggedInUser) {
             $event->setResponse(new Response(302, [
                 'Location' => Router::url('security_login', [
diff --git a/templates/security/grant.html.twig b/templates/security/grant.html.twig
deleted file mode 100644
index 91228aaca2..0000000000
--- a/templates/security/grant.html.twig
+++ /dev/null
@@ -1,33 +0,0 @@
-<form method="post">
-    {% if app.user %}
-    <div class="mb-3">
-        You are logged in as {{ app.user.username }}, <a href="{{ path('api_logout') }}">Logout</a>
-    </div>
-    {% endif %}
-
-    <h1 class="h3 mb-3 font-weight-normal">Grant Permissions</h1>
-    <input type="hidden" name="_csrf_token"
-           value="{{ csrf_token('authenticate') }}"
-    >
-    <input type="hidden" name="email"
-           value="{{ email }}"
-    >
-    <input type="hidden" name="password"
-           value="{{ password }}"
-    >
-
-    <p>Grant the following permissions:</p>
-    <ul>
-        {% for scope in scopes %}
-        <li>{{ scope }}: {{ scope }}</li>
-        {% endfor %}
-    </ul>
-
-    <button class="btn btn-lg btn-primary" type="submit" name="action" value="{{ grant }}">
-        Grant
-    </button>
-
-    <button class="btn btn-lg btn-primary" type="submit" name="action" value="Deny">
-        Deny
-    </button>
-</form>
\ No newline at end of file