Fix Passport Compatibility for V9

src/Grant/AbstractGrant.php

@@ -200,15 +200,15 @@ protected function getClientEntityOrFail(string $clientId, ServerRequestInterfac
      * Gets the client credentials from the request from the request body or
      * the Http Basic Authorization header
      *
-     * @return string[]
+     * @return mixed[]
      */
     protected function getClientCredentials(ServerRequestInterface $request): array
     {
         [$basicAuthUser, $basicAuthPassword] = $this->getBasicAuthCredentials($request);
 
         $clientId = $this->getRequestParameter('client_id', $request, $basicAuthUser);
 
-        if (is_null($clientId) || !is_string($clientId)) {
+        if (is_null($clientId)) {
             throw OAuthServerException::invalidRequest('client_id');
         }
 
@@ -218,7 +218,6 @@ protected function getClientCredentials(ServerRequestInterface $request): array
             throw OAuthServerException::invalidRequest('client_secret');
         }
 
-        /* @phpstan-ignore-next-line */
         return [$clientId, $clientSecret];
     }
 
@@ -287,10 +286,8 @@ private function convertScopesQueryStringToArray(string $scopes): array
 
     /**
      * Retrieve request parameter.
-     *
-     * @return string[]|string|null
      */
-    protected function getRequestParameter(string $parameter, ServerRequestInterface $request, string $default = null): array|string|null
+    protected function getRequestParameter(string $parameter, ServerRequestInterface $request, mixed $default = null): mixed
     {
         $requestParameters = (array) $request->getParsedBody();
 
@@ -333,23 +330,23 @@ protected function getBasicAuthCredentials(ServerRequestInterface $request): arr
     /**
      * Retrieve query string parameter.
      */
-    protected function getQueryStringParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
+    protected function getQueryStringParameter(string $parameter, ServerRequestInterface $request, mixed $default = null): ?string
     {
         return isset($request->getQueryParams()[$parameter]) ? $request->getQueryParams()[$parameter] : $default;
     }
 
     /**
      * Retrieve cookie parameter.
      */
-    protected function getCookieParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
+    protected function getCookieParameter(string $parameter, ServerRequestInterface $request, mixed $default = null): ?string
     {
         return isset($request->getCookieParams()[$parameter]) ? $request->getCookieParams()[$parameter] : $default;
     }
 
     /**
      * Retrieve server parameter.
      */
-    protected function getServerParameter(string $parameter, ServerRequestInterface $request, ?string $default = null): ?string
+    protected function getServerParameter(string $parameter, ServerRequestInterface $request, mixed $default = null): ?string
     {
         return isset($request->getServerParams()[$parameter]) ? $request->getServerParams()[$parameter] : $default;
     }

src/Grant/AuthCodeGrant.php

@@ -138,10 +138,6 @@ public function respondToAccessTokenRequest(
             );
         }
 
-        if ($codeVerifier !== null && !is_string($codeVerifier)) {
-            throw OAuthServerException::invalidRequest('code_verifier');
-        }
-
         if (isset($authCodePayload->code_challenge)) {
             $this->validateCodeChallenge($authCodePayload, $codeVerifier);
         }

src/Grant/DeviceCodeGrant.php

@@ -80,7 +80,7 @@ public function respondToDeviceAuthorizationRequest(ServerRequestInterface $requ
             $this->getServerParameter('PHP_AUTH_USER', $request)
         );
 
-        if ($clientId === null || !is_string($clientId)) {
+        if ($clientId === null) {
             throw OAuthServerException::invalidRequest('client_id');
         }
 
@@ -180,7 +180,7 @@ protected function validateDeviceCode(ServerRequestInterface $request, ClientEnt
     {
         $deviceCode = $this->getRequestParameter('device_code', $request);
 
-        if (is_null($deviceCode) || !is_string($deviceCode)) {
+        if (is_null($deviceCode)) {
             throw OAuthServerException::invalidRequest('device_code');
         }
 

tests/Grant/AbstractGrantTest.php

@@ -96,6 +96,38 @@ public function testHttpBasicNoColon(): void
         self::assertSame([null, null], $basicAuthMethod->invoke($grantMock, $serverRequest));
     }
 
+        public function testGetClientCredentialsClientSecretNotAString(): void
+    {
+        $clientRepositoryMock = $this->getMockBuilder(ClientRepositoryInterface::class)->getMock();
+
+        /** @var AbstractGrant $grantMock */
+        $grantMock = $this->getMockForAbstractClass(AbstractGrant::class);
+        $grantMock->setClientRepository($clientRepositoryMock);
+
+        $abstractGrantReflection = new ReflectionClass($grantMock);
+
+        $serverRequest = new ServerRequest(
+            [],
+            [],
+            null,
+            'POST',
+            'php://input',
+            [],
+            [],
+            [],
+            [
+                'client_id'     => 'client_id',
+                'client_secret' => ['not', 'a', 'string'],
+            ]
+        );
+        $getClientCredentialsMethod = $abstractGrantReflection->getMethod('getClientCredentials');
+        $getClientCredentialsMethod->setAccessible(true);
+
+        $this->expectException(OAuthServerException::class);
+
+        $getClientCredentialsMethod->invoke($grantMock, $serverRequest, true, true);
+    }
+
     public function testValidateClientPublic(): void
     {
         $client = new ClientEntity();

tests/Grant/AuthCodeGrantTest.php

@@ -1231,6 +1231,44 @@ public function testRespondToAccessTokenRequestWithRefreshTokenInsteadOfAuthCode
         }
     }
 
+    public function testRespondToAccessTokenRequestWithAuthCodeNotAString(): void
+    {
+        $client = new ClientEntity();
+        $client->setRedirectUri(self::REDIRECT_URI);
+
+        $clientRepositoryMock = $this->getMockBuilder(ClientRepositoryInterface::class)->getMock();
+        $clientRepositoryMock->method('getClientEntity')->willReturn($client);
+
+        $grant = new AuthCodeGrant(
+            $this->getMockBuilder(AuthCodeRepositoryInterface::class)->getMock(),
+            $this->getMockBuilder(RefreshTokenRepositoryInterface::class)->getMock(),
+            new DateInterval('PT10M')
+        );
+
+        $grant->setClientRepository($clientRepositoryMock);
+        $grant->setEncryptionKey($this->cryptStub->getKey());
+
+        $request = new ServerRequest(
+            [],
+            [],
+            null,
+            'POST',
+            'php://input',
+            [],
+            [],
+            [],
+            [
+                'grant_type'   => 'authorization_code',
+                'client_id'    => 'foo',
+                'redirect_uri' => self::REDIRECT_URI,
+                'code'         => ['not', 'a', 'string'],
+            ]
+        );
+
+        $this->expectException(OAuthServerException::class);
+        $grant->respondToAccessTokenRequest($request, new StubResponseType(), new DateInterval('PT10M'));
+    }
+
     public function testRespondToAccessTokenRequestExpiredCode(): void
     {
         $client = new ClientEntity();