From c4c73629851785ce342e696134dd590c93db30d4 Mon Sep 17 00:00:00 2001
From: Hafez Divandari <hafezdivandari@gmail.com>
Date: Sat, 9 Nov 2024 23:34:40 +0330
Subject: [PATCH] redirect uri is required on auth code

---
 src/Grant/AbstractGrant.php | 11 ++---------
 src/Grant/AuthCodeGrant.php |  2 ++
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/src/Grant/AbstractGrant.php b/src/Grant/AbstractGrant.php
index 92f76739f..32479638a 100644
--- a/src/Grant/AbstractGrant.php
+++ b/src/Grant/AbstractGrant.php
@@ -165,13 +165,6 @@ protected function validateClient(ServerRequestInterface $request): ClientEntity
             }
         }
 
-        // If a redirect URI is provided ensure it matches what is pre-registered
-        $redirectUri = $this->getRequestParameter('redirect_uri', $request);
-
-        if ($redirectUri !== null) {
-            $this->validateRedirectUri($redirectUri, $client, $request);
-        }
-
         return $client;
     }
 
@@ -233,13 +226,13 @@ protected function getClientCredentials(ServerRequestInterface $request): array
      * @throws OAuthServerException
      */
     protected function validateRedirectUri(
-        string $redirectUri,
+        ?string $redirectUri,
         ClientEntityInterface $client,
         ServerRequestInterface $request
     ): void {
         $validator = new RedirectUriValidator($client->getRedirectUri());
 
-        if (!$validator->validateRedirectUri($redirectUri)) {
+        if (is_null($redirectUri) || !$validator->validateRedirectUri($redirectUri)) {
             $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
             throw OAuthServerException::invalidClient($request);
         }
diff --git a/src/Grant/AuthCodeGrant.php b/src/Grant/AuthCodeGrant.php
index 0b857671a..c5fa25479 100644
--- a/src/Grant/AuthCodeGrant.php
+++ b/src/Grant/AuthCodeGrant.php
@@ -98,6 +98,8 @@ public function respondToAccessTokenRequest(
     ): ResponseTypeInterface {
         $client = $this->validateClient($request);
 
+        $this->validateRedirectUri($this->getRequestParameter('redirect_uri', $request), $client, $request);
+
         $encryptedAuthCode = $this->getRequestParameter('code', $request);
 
         if ($encryptedAuthCode === null) {