Merge pull request #11068 from nanaya/oauth-session

Ignore invalid session error from oauth approval endpoint

Author: notbakaneko

app/Exceptions/Handler.php

@@ -72,6 +72,8 @@ public static function statusCode($e)
             return 401;
         } elseif ($e instanceof AuthorizationException || $e instanceof MissingScopeException) {
             return 403;
+        } elseif (static::isOAuthSessionException($e)) {
+            return 422;
         } else {
             return 500;
         }
@@ -82,6 +84,12 @@ private static function isOAuthServerException($e)
         return ($e instanceof PassportOAuthServerException) && ($e->getPrevious() instanceof OAuthServerException);
     }
 
+    private static function isOAuthSessionException(Throwable $e): bool
+    {
+        return ($e instanceof \Exception)
+            && $e->getMessage() === 'Authorization request was not present in the session.';
+    }
+
     private static function unwrapViewException(Throwable $e): Throwable
     {
         if ($e instanceof ViewException) {
@@ -175,7 +183,9 @@ public function render($request, Throwable $e)
 
     protected function shouldntReport(Throwable $e)
     {
-        return parent::shouldntReport(static::unwrapViewException($e)) || $this->isOAuthServerException($e);
+        $e = static::unwrapViewException($e);
+
+        return parent::shouldntReport($e) || static::isOAuthServerException($e) || static::isOAuthSessionException($e);
     }
 
     protected function unauthenticated($request, AuthenticationException $exception)

tests/Controllers/Passport/ApproveAuthorizationControllerTest.php

@@ -0,0 +1,21 @@
+<?php
+
+// Copyright (c) ppy Pty Ltd <contact@ppy.sh>. Licensed under the GNU Affero General Public License v3.0.
+// See the LICENCE file in the repository root for full licence text.
+
+namespace Tests\Controllers\Passport;
+
+use App\Models\User;
+use Tests\TestCase;
+
+class ApproveAuthorizationControllerTest extends TestCase
+{
+    public function testApproveWithInvalidSession(): void
+    {
+        $user = User::factory()->create();
+
+        $this->actingAsVerified($user)
+            ->post(route('oauth.authorizations.authorize'))
+            ->assertStatus(422);
+    }
+}