Deny access if user is not authenticated

src/Grant/AbstractAuthorizeGrant.php

@@ -35,4 +35,14 @@ protected function createAuthorizationRequest(): AuthorizationRequestInterface
     {
         return new AuthorizationRequest();
     }
+
+    /**
+     * Get the client redirect URI.
+     */
+    protected function getClientRedirectUri(AuthorizationRequestInterface $authorizationRequest): string
+    {
+        return is_array($authorizationRequest->getClient()->getRedirectUri())
+            ? $authorizationRequest->getClient()->getRedirectUri()[0]
+            : $authorizationRequest->getClient()->getRedirectUri();
+    }
 }

src/Grant/AuthCodeGrant.php

@@ -347,15 +347,15 @@ function ($method) {
      */
     public function completeAuthorizationRequest(AuthorizationRequestInterface $authorizationRequest): ResponseTypeInterface
     {
-        if ($authorizationRequest->getUser() instanceof UserEntityInterface === false) {
-            throw new LogicException('An instance of UserEntityInterface should be set on the AuthorizationRequest');
-        }
-
         $finalRedirectUri = $authorizationRequest->getRedirectUri()
                           ?? $this->getClientRedirectUri($authorizationRequest);
 
         // The user approved the client, redirect them back with an auth code
         if ($authorizationRequest->isAuthorizationApproved() === true) {
+            if ($authorizationRequest->getUser() instanceof UserEntityInterface === false) {
+                throw new LogicException('An instance of UserEntityInterface should be set on the AuthorizationRequest');
+            }
+
             $authCode = $this->issueAuthCode(
                 $this->authCodeTTL,
                 $authorizationRequest->getClient(),
@@ -406,14 +406,4 @@ public function completeAuthorizationRequest(AuthorizationRequestInterface $auth
             )
         );
     }
-
-    /**
-     * Get the client redirect URI if not set in the request.
-     */
-    private function getClientRedirectUri(AuthorizationRequestInterface $authorizationRequest): string
-    {
-        return is_array($authorizationRequest->getClient()->getRedirectUri())
-                ? $authorizationRequest->getClient()->getRedirectUri()[0]
-                : $authorizationRequest->getClient()->getRedirectUri();
-    }
 }

src/Grant/ImplicitGrant.php

@@ -148,18 +148,15 @@ public function validateAuthorizationRequest(ServerRequestInterface $request): A
      */
     public function completeAuthorizationRequest(AuthorizationRequestInterface $authorizationRequest): ResponseTypeInterface
     {
-        if ($authorizationRequest->getUser() instanceof UserEntityInterface === false) {
-            throw new LogicException('An instance of UserEntityInterface should be set on the AuthorizationRequest');
-        }
-
-        $clientRegisteredRedirectUri = is_array($authorizationRequest->getClient()->getRedirectUri())
-                ? $authorizationRequest->getClient()->getRedirectUri()[0]
-                : $authorizationRequest->getClient()->getRedirectUri();
-
-        $finalRedirectUri = $authorizationRequest->getRedirectUri() ?? $clientRegisteredRedirectUri;
+        $finalRedirectUri = $authorizationRequest->getRedirectUri()
+                          ?? $this->getClientRedirectUri($authorizationRequest);
 
         // The user approved the client, redirect them back with an access token
         if ($authorizationRequest->isAuthorizationApproved() === true) {
+            if ($authorizationRequest->getUser() instanceof UserEntityInterface === false) {
+                throw new LogicException('An instance of UserEntityInterface should be set on the AuthorizationRequest');
+            }
+
             // Finalize the requested scopes
             $finalizedScopes = $this->scopeRepository->finalizeScopes(
                 $authorizationRequest->getScopes(),

tests/Grant/AuthCodeGrantTest.php

@@ -2186,6 +2186,14 @@ public function testRefreshTokenRepositoryFailToPersistUniqueNoInfiniteLoop(): v
 
     public function testCompleteAuthorizationRequestNoUser(): void
     {
+        $client = new ClientEntity();
+        $client->setRedirectUri('http://foo/bar');
+
+        $authRequest = new AuthorizationRequest();
+        $authRequest->setAuthorizationApproved(true);
+        $authRequest->setClient($client);
+        $authRequest->setGrantTypeId('authorization_code');
+
         $grant = new AuthCodeGrant(
             $this->getMockBuilder(AuthCodeRepositoryInterface::class)->getMock(),
             $this->getMockBuilder(RefreshTokenRepositoryInterface::class)->getMock(),
@@ -2194,7 +2202,29 @@ public function testCompleteAuthorizationRequestNoUser(): void
 
         $this->expectException(LogicException::class);
 
-        $grant->completeAuthorizationRequest(new AuthorizationRequest());
+        $grant->completeAuthorizationRequest($authRequest);
+    }
+
+    public function testCompleteAuthorizationRequestDeniedNoUser(): void
+    {
+        $client = new ClientEntity();
+        $client->setRedirectUri('http://foo/bar');
+
+        $authRequest = new AuthorizationRequest();
+        $authRequest->setAuthorizationApproved(false);
+        $authRequest->setClient($client);
+        $authRequest->setGrantTypeId('authorization_code');
+
+        $grant = new AuthCodeGrant(
+            $this->getMockBuilder(AuthCodeRepositoryInterface::class)->getMock(),
+            $this->getMockBuilder(RefreshTokenRepositoryInterface::class)->getMock(),
+            new DateInterval('PT10M')
+        );
+
+        $this->expectException(OAuthServerException::class);
+        $this->expectExceptionCode(9);
+
+        $grant->completeAuthorizationRequest($authRequest);
     }
 
     public function testPublicClientAuthCodeRequestRejectedWhenCodeChallengeRequiredButNotGiven(): void

tests/Grant/ImplicitGrantTest.php

@@ -395,10 +395,36 @@ public function testSetRefreshTokenRepository(): void
 
     public function testCompleteAuthorizationRequestNoUser(): void
     {
+        $client = new ClientEntity();
+        $client->setRedirectUri('https://foo/bar');
+
+        $authRequest = new AuthorizationRequest();
+        $authRequest->setAuthorizationApproved(true);
+        $authRequest->setClient($client);
+        $authRequest->setGrantTypeId('authorization_code');
+
         $grant = new ImplicitGrant(new DateInterval('PT10M'));
 
         $this->expectException(LogicException::class);
 
-        $grant->completeAuthorizationRequest(new AuthorizationRequest());
+        $grant->completeAuthorizationRequest($authRequest);
+    }
+
+    public function testCompleteAuthorizationRequestDeniedNoUser(): void
+    {
+        $client = new ClientEntity();
+        $client->setRedirectUri('https://foo/bar');
+
+        $authRequest = new AuthorizationRequest();
+        $authRequest->setAuthorizationApproved(false);
+        $authRequest->setClient($client);
+        $authRequest->setGrantTypeId('authorization_code');
+
+        $grant = new ImplicitGrant(new DateInterval('PT10M'));
+
+        $this->expectException(OAuthServerException::class);
+        $this->expectExceptionCode(9);
+
+        $grant->completeAuthorizationRequest($authRequest);
     }
 }