Deny access if user is not authenticated

[hafezdivandari]

Setting the user instance has been forced on AuthCodeGrant::completeAuthorizationRequest() method, but it is not necessary when Authorization request is denied!

On Laravel Passport we support prompt=none when redirecting for authorization. Currently, we have to create the error response manually when user is not authenticated.

Here is the related code on Laravel Passport:

https://github.com/laravel/passport/blob/8ea1dd41745c89769fd8c4b207c4739eea707e95/src/Http/Controllers/AuthorizationController.php#L181-L204

After this PR we are able to simply do:

if (! is_null($user)) {
    $authRequest->setUser(new User($user->getAuthIdentifier()));
}

$authRequest->setAuthorizationApproved(false);

return $this->withErrorHandling(function () use ($authRequest) {
    return $this->convertResponse(
        $this->server->completeAuthorizationRequest($authRequest, new Psr7Response)
    );
});

[hafezdivandari]

Hi @Sephster, hope you’re doing well. Any progress on the PRs related to Laravel Passport? I’ve listed them all here.

[hafezdivandari]

Fixed via laravel/passport#1791