<h2>File Contents: /home/planet5/public_html/wp-content/plugins/google-site-kit/third-party/google/auth/src/OAuth2.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-content/plugins/google-site-kit/third-party/google/auth/src/OAuth2.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php

/*
 * Copyright 2015 Google Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an &quot;AS IS&quot; BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
namespace Google\Site_Kit_Dependencies\Google\Auth;

use Google\Site_Kit_Dependencies\Firebase\JWT\JWT;
use Google\Site_Kit_Dependencies\Firebase\JWT\Key;
use Google\Site_Kit_Dependencies\Google\Auth\HttpHandler\HttpClientCache;
use Google\Site_Kit_Dependencies\Google\Auth\HttpHandler\HttpHandlerFactory;
use Google\Site_Kit_Dependencies\GuzzleHttp\Psr7\Query;
use Google\Site_Kit_Dependencies\GuzzleHttp\Psr7\Request;
use Google\Site_Kit_Dependencies\GuzzleHttp\Psr7\Utils;
use InvalidArgumentException;
use Google\Site_Kit_Dependencies\Psr\Http\Message\RequestInterface;
use Google\Site_Kit_Dependencies\Psr\Http\Message\ResponseInterface;
use Google\Site_Kit_Dependencies\Psr\Http\Message\UriInterface;
/**
 * OAuth2 supports authentication by OAuth2 2-legged flows.
 *
 * It primary supports
 * - service account authorization
 * - authorization where a user already has an access token
 */
class OAuth2 implements FetchAuthTokenInterface
{
    const DEFAULT_EXPIRY_SECONDS = 3600;
    // 1 hour
    const DEFAULT_SKEW_SECONDS = 60;
    // 1 minute
    const JWT_URN = &#039;urn:ietf:params:oauth:grant-type:jwt-bearer&#039;;
    const STS_URN = &#039;urn:ietf:params:oauth:grant-type:token-exchange&#039;;
    private const STS_REQUESTED_TOKEN_TYPE = &#039;urn:ietf:params:oauth:token-type:access_token&#039;;
    /**
     * TODO: determine known methods from the keys of JWT::methods.
     *
     * @var array&lt;string&gt;
     */
    public static $knownSigningAlgorithms = [&#039;HS256&#039;, &#039;HS512&#039;, &#039;HS384&#039;, &#039;RS256&#039;];
    /**
     * The well known grant types.
     *
     * @var array&lt;string&gt;
     */
    public static $knownGrantTypes = [&#039;authorization_code&#039;, &#039;refresh_token&#039;, &#039;password&#039;, &#039;client_credentials&#039;];
    /**
     * - authorizationUri
     *   The authorization server&#039;s HTTP endpoint capable of
     *   authenticating the end-user and obtaining authorization.
     *
     * @var ?UriInterface
     */
    private $authorizationUri;
    /**
     * - tokenCredentialUri
     *   The authorization server&#039;s HTTP endpoint capable of issuing
     *   tokens and refreshing expired tokens.
     *
     * @var UriInterface
     */
    private $tokenCredentialUri;
    /**
     * The redirection URI used in the initial request.
     *
     * @var ?string
     */
    private $redirectUri;
    /**
     * A unique identifier issued to the client to identify itself to the
     * authorization server.
     *
     * @var string
     */
    private $clientId;
    /**
     * A shared symmetric secret issued by the authorization server, which is
     * used to authenticate the client.
     *
     * @var string
     */
    private $clientSecret;
    /**
     * The resource owner&#039;s username.
     *
     * @var ?string
     */
    private $username;
    /**
     * The resource owner&#039;s password.
     *
     * @var ?string
     */
    private $password;
    /**
     * The scope of the access request, expressed either as an Array or as a
     * space-delimited string.
     *
     * @var ?array&lt;string&gt;
     */
    private $scope;
    /**
     * An arbitrary string designed to allow the client to maintain state.
     *
     * @var string
     */
    private $state;
    /**
     * The authorization code issued to this client.
     *
     * Only used by the authorization code access grant type.
     *
     * @var ?string
     */
    private $code;
    /**
     * The issuer ID when using assertion profile.
     *
     * @var ?string
     */
    private $issuer;
    /**
     * The target audience for assertions.
     *
     * @var string
     */
    private $audience;
    /**
     * The target sub when issuing assertions.
     *
     * @var string
     */
    private $sub;
    /**
     * The number of seconds assertions are valid for.
     *
     * @var int
     */
    private $expiry;
    /**
     * The signing key when using assertion profile.
     *
     * @var ?string
     */
    private $signingKey;
    /**
     * The signing key id when using assertion profile. Param kid in jwt header
     *
     * @var string
     */
    private $signingKeyId;
    /**
     * The signing algorithm when using an assertion profile.
     *
     * @var ?string
     */
    private $signingAlgorithm;
    /**
     * The refresh token associated with the access token to be refreshed.
     *
     * @var ?string
     */
    private $refreshToken;
    /**
     * The current access token.
     *
     * @var string
     */
    private $accessToken;
    /**
     * The current ID token.
     *
     * @var string
     */
    private $idToken;
    /**
     * The scopes granted to the current access token
     *
     * @var string
     */
    private $grantedScope;
    /**
     * The lifetime in seconds of the current access token.
     *
     * @var ?int
     */
    private $expiresIn;
    /**
     * The expiration time of the access token as a number of seconds since the
     * unix epoch.
     *
     * @var ?int
     */
    private $expiresAt;
    /**
     * The issue time of the access token as a number of seconds since the unix
     * epoch.
     *
     * @var ?int
     */
    private $issuedAt;
    /**
     * The current grant type.
     *
     * @var ?string
     */
    private $grantType;
    /**
     * When using an extension grant type, this is the set of parameters used by
     * that extension.
     *
     * @var array&lt;mixed&gt;
     */
    private $extensionParams;
    /**
     * When using the toJwt function, these claims will be added to the JWT
     * payload.
     *
     * @var array&lt;mixed&gt;
     */
    private $additionalClaims;
    /**
     * The code verifier for PKCE for OAuth 2.0. When set, the authorization
     * URI will contain the Code Challenge and Code Challenge Method querystring
     * parameters, and the token URI will contain the Code Verifier parameter.
     *
     * @see https://datatracker.ietf.org/doc/html/rfc7636
     * @var ?string
     */
    private $codeVerifier;
    /**
     * For STS requests.
     * A URI that indicates the target service or resource where the client
     * intends to use the requested security token.
     */
    private ?string $resource;
    /**
     * For STS requests.
     * A fetcher for the &quot;subject_token&quot;, which is a security token that
     * represents the identity of the party on behalf of whom the request is
     * being made.
     */
    private ?ExternalAccountCredentialSourceInterface $subjectTokenFetcher;
    /**
     * For STS requests.
     * An identifier, that indicates the type of the security token in the
     * subjectToken parameter.
     */
    private ?string $subjectTokenType;
    /**
     * For STS requests.
     * A security token that represents the identity of the acting party.
     */
    private ?string $actorToken;
    /**
     * For STS requests.
     * An identifier that indicates the type of the security token in the
     * actorToken parameter.
     */
    private ?string $actorTokenType;
    /**
     * From STS response.
     * An identifier for the representation of the issued security token.
     */
    private ?string $issuedTokenType = null;
    /**
     * From STS response.
     * An identifier for the representation of the issued security token.
     *
     * @var array&lt;mixed&gt;
     */
    private array $additionalOptions;
    /**
     * Create a new OAuthCredentials.
     *
     * The configuration array accepts various options
     *
     * - authorizationUri
     *   The authorization server&#039;s HTTP endpoint capable of
     *   authenticating the end-user and obtaining authorization.
     *
     * - tokenCredentialUri
     *   The authorization server&#039;s HTTP endpoint capable of issuing
     *   tokens and refreshing expired tokens.
     *
     * - clientId
     *   A unique identifier issued to the client to identify itself to the
     *   authorization server.
     *
     * - clientSecret
     *   A shared symmetric secret issued by the authorization server,
     *   which is used to authenticate the client.
     *
     * - scope
     *   The scope of the access request, expressed either as an Array
     *   or as a space-delimited String.
     *
     * - state
     *   An arbitrary string designed to allow the client to maintain state.
     *
     * - redirectUri
     *   The redirection URI used in the initial request.
     *
     * - username
     *   The resource owner&#039;s username.
     *
     * - password
     *   The resource owner&#039;s password.
     *
     * - issuer
     *   Issuer ID when using assertion profile
     *
     * - audience
     *   Target audience for assertions
     *
     * - expiry
     *   Number of seconds assertions are valid for
     *
     * - signingKey
     *   Signing key when using assertion profile
     *
     * - signingKeyId
     *   Signing key id when using assertion profile
     *
     * - refreshToken
     *   The refresh token associated with the access token
     *   to be refreshed.
     *
     * - accessToken
     *   The current access token for this client.
     *
     * - idToken
     *   The current ID token for this client.
     *
     * - extensionParams
     *   When using an extension grant type, this is the set of parameters used
     *   by that extension.
     *
     * - codeVerifier
     *   The code verifier for PKCE for OAuth 2.0.
     *
     * - resource
     *   The target service or resource where the client ntends to use the
     *   requested security token.
     *
     * - subjectTokenFetcher
     *    A fetcher for the &quot;subject_token&quot;, which is a security token that
     *    represents the identity of the party on behalf of whom the request is
     *    being made.
     *
     * - subjectTokenType
     *   An identifier that indicates the type of the security token in the
     *   subjectToken parameter.
     *
     * - actorToken
     *   A security token that represents the identity of the acting party.
     *
     * - actorTokenType
     *   An identifier for the representation of the issued security token.
     *
     * @param array&lt;mixed&gt; $config Configuration array
     */
    public function __construct(array $config)
    {
        $opts = array_merge([&#039;expiry&#039; =&gt; self::DEFAULT_EXPIRY_SECONDS, &#039;extensionParams&#039; =&gt; [], &#039;authorizationUri&#039; =&gt; null, &#039;redirectUri&#039; =&gt; null, &#039;tokenCredentialUri&#039; =&gt; null, &#039;state&#039; =&gt; null, &#039;username&#039; =&gt; null, &#039;password&#039; =&gt; null, &#039;clientId&#039; =&gt; null, &#039;clientSecret&#039; =&gt; null, &#039;issuer&#039; =&gt; null, &#039;sub&#039; =&gt; null, &#039;audience&#039; =&gt; null, &#039;signingKey&#039; =&gt; null, &#039;signingKeyId&#039; =&gt; null, &#039;signingAlgorithm&#039; =&gt; null, &#039;scope&#039; =&gt; null, &#039;additionalClaims&#039; =&gt; [], &#039;codeVerifier&#039; =&gt; null, &#039;resource&#039; =&gt; null, &#039;subjectTokenFetcher&#039; =&gt; null, &#039;subjectTokenType&#039; =&gt; null, &#039;actorToken&#039; =&gt; null, &#039;actorTokenType&#039; =&gt; null, &#039;additionalOptions&#039; =&gt; []], $config);
        $this-&gt;setAuthorizationUri($opts[&#039;authorizationUri&#039;]);
        $this-&gt;setRedirectUri($opts[&#039;redirectUri&#039;]);
        $this-&gt;setTokenCredentialUri($opts[&#039;tokenCredentialUri&#039;]);
        $this-&gt;setState($opts[&#039;state&#039;]);
        $this-&gt;setUsername($opts[&#039;username&#039;]);
        $this-&gt;setPassword($opts[&#039;password&#039;]);
        $this-&gt;setClientId($opts[&#039;clientId&#039;]);
        $this-&gt;setClientSecret($opts[&#039;clientSecret&#039;]);
        $this-&gt;setIssuer($opts[&#039;issuer&#039;]);
        $this-&gt;setSub($opts[&#039;sub&#039;]);
        $this-&gt;setExpiry($opts[&#039;expiry&#039;]);
        $this-&gt;setAudience($opts[&#039;audience&#039;]);
        $this-&gt;setSigningKey($opts[&#039;signingKey&#039;]);
        $this-&gt;setSigningKeyId($opts[&#039;signingKeyId&#039;]);
        $this-&gt;setSigningAlgorithm($opts[&#039;signingAlgorithm&#039;]);
        $this-&gt;setScope($opts[&#039;scope&#039;]);
        $this-&gt;setExtensionParams($opts[&#039;extensionParams&#039;]);
        $this-&gt;setAdditionalClaims($opts[&#039;additionalClaims&#039;]);
        $this-&gt;setCodeVerifier($opts[&#039;codeVerifier&#039;]);
        // for STS
        $this-&gt;resource = $opts[&#039;resource&#039;];
        $this-&gt;subjectTokenFetcher = $opts[&#039;subjectTokenFetcher&#039;];
        $this-&gt;subjectTokenType = $opts[&#039;subjectTokenType&#039;];
        $this-&gt;actorToken = $opts[&#039;actorToken&#039;];
        $this-&gt;actorTokenType = $opts[&#039;actorTokenType&#039;];
        $this-&gt;additionalOptions = $opts[&#039;additionalOptions&#039;];
        $this-&gt;updateToken($opts);
    }
    /**
     * Verifies the idToken if present.
     *
     * - if none is present, return null
     * - if present, but invalid, raises DomainException.
     * - otherwise returns the payload in the idtoken as a PHP object.
     *
     * The behavior of this method varies depending on the version of
     * `firebase/php-jwt` you are using. In versions 6.0 and above, you cannot
     * provide multiple $allowed_algs, and instead must provide an array of Key
     * objects as the $publicKey.
     *
     * @param string|Key|Key[] $publicKey The public key to use to authenticate the token
     * @param string|array&lt;string&gt; $allowed_algs algorithm or array of supported verification algorithms.
     *        Providing more than one algorithm will throw an exception.
     * @throws \DomainException if the token is missing an audience.
     * @throws \DomainException if the audience does not match the one set in
     *         the OAuth2 class instance.
     * @throws \UnexpectedValueException If the token is invalid
     * @throws \InvalidArgumentException If more than one value for allowed_algs is supplied
     * @throws \Firebase\JWT\SignatureInvalidException If the signature is invalid.
     * @throws \Firebase\JWT\BeforeValidException If the token is not yet valid.
     * @throws \Firebase\JWT\ExpiredException If the token has expired.
     * @return null|object
     */
    public function verifyIdToken($publicKey = null, $allowed_algs = [])
    {
        $idToken = $this-&gt;getIdToken();
        if (is_null($idToken)) {
            return null;
        }
        $resp = $this-&gt;jwtDecode($idToken, $publicKey, $allowed_algs);
        if (!property_exists($resp, &#039;aud&#039;)) {
            throw new \DomainException(&#039;No audience found the id token&#039;);
        }
        if ($resp-&gt;aud != $this-&gt;getAudience()) {
            throw new \DomainException(&#039;Wrong audience present in the id token&#039;);
        }
        return $resp;
    }
    /**
     * Obtains the encoded jwt from the instance data.
     *
     * @param array&lt;mixed&gt; $config array optional configuration parameters
     * @return string
     */
    public function toJwt(array $config = [])
    {
        if (is_null($this-&gt;getSigningKey())) {
            throw new \DomainException(&#039;No signing key available&#039;);
        }
        if (is_null($this-&gt;getSigningAlgorithm())) {
            throw new \DomainException(&#039;No signing algorithm specified&#039;);
        }
        $now = time();
        $opts = array_merge([&#039;skew&#039; =&gt; self::DEFAULT_SKEW_SECONDS], $config);
        $assertion = [&#039;iss&#039; =&gt; $this-&gt;getIssuer(), &#039;exp&#039; =&gt; $now + $this-&gt;getExpiry(), &#039;iat&#039; =&gt; $now - $opts[&#039;skew&#039;]];
        foreach ($assertion as $k =&gt; $v) {
            if (is_null($v)) {
                throw new \DomainException($k . &#039; should not be null&#039;);
            }
        }
        if (!is_null($this-&gt;getAudience())) {
            $assertion[&#039;aud&#039;] = $this-&gt;getAudience();
        }
        if (!is_null($this-&gt;getScope())) {
            $assertion[&#039;scope&#039;] = $this-&gt;getScope();
        }
        if (empty($assertion[&#039;scope&#039;]) &amp;&amp; empty($assertion[&#039;aud&#039;])) {
            throw new \DomainException(&#039;one of scope or aud should not be null&#039;);
        }
        if (!is_null($this-&gt;getSub())) {
            $assertion[&#039;sub&#039;] = $this-&gt;getSub();
        }
        $assertion += $this-&gt;getAdditionalClaims();
        return JWT::encode($assertion, $this-&gt;getSigningKey(), $this-&gt;getSigningAlgorithm(), $this-&gt;getSigningKeyId());
    }
    /**
     * Generates a request for token credentials.
     *
     * @param callable $httpHandler callback which delivers psr7 request
     * @return RequestInterface the authorization Url.
     */
    public function generateCredentialsRequest(?callable $httpHandler = null)
    {
        $uri = $this-&gt;getTokenCredentialUri();
        if (is_null($uri)) {
            throw new \DomainException(&#039;No token credential URI was set.&#039;);
        }
        $grantType = $this-&gt;getGrantType();
        $params = [&#039;grant_type&#039; =&gt; $grantType];
        switch ($grantType) {
            case &#039;authorization_code&#039;:
                $params[&#039;code&#039;] = $this-&gt;getCode();
                $params[&#039;redirect_uri&#039;] = $this-&gt;getRedirectUri();
                if ($this-&gt;codeVerifier) {
                    $params[&#039;code_verifier&#039;] = $this-&gt;codeVerifier;
                }
                $this-&gt;addClientCredentials($params);
                break;
            case &#039;password&#039;:
                $params[&#039;username&#039;] = $this-&gt;getUsername();
                $params[&#039;password&#039;] = $this-&gt;getPassword();
                $this-&gt;addClientCredentials($params);
                break;
            case &#039;refresh_token&#039;:
                $params[&#039;refresh_token&#039;] = $this-&gt;getRefreshToken();
                $this-&gt;addClientCredentials($params);
                break;
            case self::JWT_URN:
                $params[&#039;assertion&#039;] = $this-&gt;toJwt();
                break;
            case self::STS_URN:
                $token = $this-&gt;subjectTokenFetcher-&gt;fetchSubjectToken($httpHandler);
                $params[&#039;subject_token&#039;] = $token;
                $params[&#039;subject_token_type&#039;] = $this-&gt;subjectTokenType;
                $params += array_filter([&#039;resource&#039; =&gt; $this-&gt;resource, &#039;audience&#039; =&gt; $this-&gt;audience, &#039;scope&#039; =&gt; $this-&gt;getScope(), &#039;requested_token_type&#039; =&gt; self::STS_REQUESTED_TOKEN_TYPE, &#039;actor_token&#039; =&gt; $this-&gt;actorToken, &#039;actor_token_type&#039; =&gt; $this-&gt;actorTokenType]);
                if ($this-&gt;additionalOptions) {
                    $params[&#039;options&#039;] = json_encode($this-&gt;additionalOptions);
                }
                break;
            default:
                if (!is_null($this-&gt;getRedirectUri())) {
                    # Grant type was supposed to be &#039;authorization_code&#039;, as there
                    # is a redirect URI.
                    throw new \DomainException(&#039;Missing authorization code&#039;);
                }
                unset($params[&#039;grant_type&#039;]);
                if (!is_null($grantType)) {
                    $params[&#039;grant_type&#039;] = $grantType;
                }
                $params = array_merge($params, $this-&gt;getExtensionParams());
        }
        $headers = [&#039;Cache-Control&#039; =&gt; &#039;no-store&#039;, &#039;Content-Type&#039; =&gt; &#039;application/x-www-form-urlencoded&#039;];
        return new Request(&#039;POST&#039;, $uri, $headers, Query::build($params));
    }
    /**
     * Fetches the auth tokens based on the current state.
     *
     * @param callable $httpHandler callback which delivers psr7 request
     * @return array&lt;mixed&gt; the response
     */
    public function fetchAuthToken(?callable $httpHandler = null)
    {
        if (is_null($httpHandler)) {
            $httpHandler = HttpHandlerFactory::build(HttpClientCache::getHttpClient());
        }
        $response = $httpHandler($this-&gt;generateCredentialsRequest($httpHandler));
        $credentials = $this-&gt;parseTokenResponse($response);
        $this-&gt;updateToken($credentials);
        if (isset($credentials[&#039;scope&#039;])) {
            $this-&gt;setGrantedScope($credentials[&#039;scope&#039;]);
        }
        return $credentials;
    }
    /**
     * Obtains a key that can used to cache the results of #fetchAuthToken.
     *
     * The key is derived from the scopes.
     *
     * @return ?string a key that may be used to cache the auth token.
     */
    public function getCacheKey()
    {
        if (is_array($this-&gt;scope)) {
            return implode(&#039;:&#039;, $this-&gt;scope);
        }
        if ($this-&gt;audience) {
            return $this-&gt;audience;
        }
        // If scope has not set, return null to indicate no caching.
        return null;
    }
    /**
     * Parses the fetched tokens.
     *
     * @param ResponseInterface $resp the response.
     * @return array&lt;mixed&gt; the tokens parsed from the response body.
     * @throws \Exception
     */
    public function parseTokenResponse(ResponseInterface $resp)
    {
        $body = (string) $resp-&gt;getBody();
        if ($resp-&gt;hasHeader(&#039;Content-Type&#039;) &amp;&amp; $resp-&gt;getHeaderLine(&#039;Content-Type&#039;) == &#039;application/x-www-form-urlencoded&#039;) {
            $res = [];
            parse_str($body, $res);
            return $res;
        }
        // Assume it&#039;s JSON; if it&#039;s not throw an exception
        if (null === $res = json_decode($body, \true)) {
            throw new \Exception(&#039;Invalid JSON response&#039;);
        }
        return $res;
    }
    /**
     * Updates an OAuth 2.0 client.
     *
     * Example:
     * ```
     * $oauth-&gt;updateToken([
     *     &#039;refresh_token&#039; =&gt; &#039;n4E9O119d&#039;,
     *     &#039;access_token&#039; =&gt; &#039;FJQbwq9&#039;,
     *     &#039;expires_in&#039; =&gt; 3600
     * ]);
     * ```
     *
     * @param array&lt;mixed&gt; $config
     *  The configuration parameters related to the token.
     *
     *  - refresh_token
     *    The refresh token associated with the access token
     *    to be refreshed.
     *
     *  - access_token
     *    The current access token for this client.
     *
     *  - id_token
     *    The current ID token for this client.
     *
     *  - expires_in
     *    The time in seconds until access token expiration.
     *
     *  - expires_at
     *    The time as an integer number of seconds since the Epoch
     *
     *  - issued_at
     *    The timestamp that the token was issued at.
     * @return void
     */
    public function updateToken(array $config)
    {
        $opts = array_merge([&#039;extensionParams&#039; =&gt; [], &#039;access_token&#039; =&gt; null, &#039;id_token&#039; =&gt; null, &#039;expires_in&#039; =&gt; null, &#039;expires_at&#039; =&gt; null, &#039;issued_at&#039; =&gt; null, &#039;scope&#039; =&gt; null], $config);
        $this-&gt;setExpiresAt($opts[&#039;expires_at&#039;]);
        $this-&gt;setExpiresIn($opts[&#039;expires_in&#039;]);
        // By default, the token is issued at `Time.now` when `expiresIn` is set,
        // but this can be used to supply a more precise time.
        if (!is_null($opts[&#039;issued_at&#039;])) {
            $this-&gt;setIssuedAt($opts[&#039;issued_at&#039;]);
        }
        $this-&gt;setAccessToken($opts[&#039;access_token&#039;]);
        $this-&gt;setIdToken($opts[&#039;id_token&#039;]);
        // The refresh token should only be updated if a value is explicitly
        // passed in, as some access token responses do not include a refresh
        // token.
        if (array_key_exists(&#039;refresh_token&#039;, $opts)) {
            $this-&gt;setRefreshToken($opts[&#039;refresh_token&#039;]);
        }
        // Required for STS response. An identifier for the representation of
        // the issued security token.
        if (array_key_exists(&#039;issued_token_type&#039;, $opts)) {
            $this-&gt;issuedTokenType = $opts[&#039;issued_token_type&#039;];
        }
    }
    /**
     * Builds the authorization Uri that the user should be redirected to.
     *
     * @param array&lt;mixed&gt; $config configuration options that customize the return url.
     * @return UriInterface the authorization Url.
     * @throws InvalidArgumentException
     */
    public function buildFullAuthorizationUri(array $config = [])
    {
        if (is_null($this-&gt;getAuthorizationUri())) {
            throw new InvalidArgumentException(&#039;requires an authorizationUri to have been set&#039;);
        }
        $params = array_merge([&#039;response_type&#039; =&gt; &#039;code&#039;, &#039;access_type&#039; =&gt; &#039;offline&#039;, &#039;client_id&#039; =&gt; $this-&gt;clientId, &#039;redirect_uri&#039; =&gt; $this-&gt;redirectUri, &#039;state&#039; =&gt; $this-&gt;state, &#039;scope&#039; =&gt; $this-&gt;getScope()], $config);
        // Validate the auth_params
        if (is_null($params[&#039;client_id&#039;])) {
            throw new InvalidArgumentException(&#039;missing the required client identifier&#039;);
        }
        if (is_null($params[&#039;redirect_uri&#039;])) {
            throw new InvalidArgumentException(&#039;missing the required redirect URI&#039;);
        }
        if (!empty($params[&#039;prompt&#039;]) &amp;&amp; !empty($params[&#039;approval_prompt&#039;])) {
            throw new InvalidArgumentException(&#039;prompt and approval_prompt are mutually exclusive&#039;);
        }
        if ($this-&gt;codeVerifier) {
            $params[&#039;code_challenge&#039;] = $this-&gt;getCodeChallenge($this-&gt;codeVerifier);
            $params[&#039;code_challenge_method&#039;] = $this-&gt;getCodeChallengeMethod();
        }
        // Construct the uri object; return it if it is valid.
        $result = clone $this-&gt;authorizationUri;
        $existingParams = Query::parse($result-&gt;getQuery());
        $result = $result-&gt;withQuery(Query::build(array_merge($existingParams, $params)));
        if ($result-&gt;getScheme() != &#039;https&#039;) {
            throw new InvalidArgumentException(&#039;Authorization endpoint must be protected by TLS&#039;);
        }
        return $result;
    }
    /**
     * @return string|null
     */
    public function getCodeVerifier(): ?string
    {
        return $this-&gt;codeVerifier;
    }
    /**
     * A cryptographically random string that is used to correlate the
     * authorization request to the token request.
     *
     * The code verifier for PKCE for OAuth 2.0. When set, the authorization
     * URI will contain the Code Challenge and Code Challenge Method querystring
     * parameters, and the token URI will contain the Code Verifier parameter.
     *
     * @see https://datatracker.ietf.org/doc/html/rfc7636
     *
     * @param string|null $codeVerifier
     */
    public function setCodeVerifier(?string $codeVerifier): void
    {
        $this-&gt;codeVerifier = $codeVerifier;
    }
    /**
     * Generates a random 128-character string for the &quot;code_verifier&quot; parameter
     * in PKCE for OAuth 2.0. This is a cryptographically random string that is
     * determined using random_int, hashed using &quot;hash&quot; and sha256, and base64
     * encoded.
     *
     * When this method is called, the code verifier is set on the object.
     *
     * @return string
     */
    public function generateCodeVerifier(): string
    {
        return $this-&gt;codeVerifier = $this-&gt;generateRandomString(128);
    }
    private function getCodeChallenge(string $randomString): string
    {
        return rtrim(strtr(base64_encode(hash(&#039;sha256&#039;, $randomString, \true)), &#039;+/&#039;, &#039;-_&#039;), &#039;=&#039;);
    }
    private function getCodeChallengeMethod(): string
    {
        return &#039;S256&#039;;
    }
    private function generateRandomString(int $length): string
    {
        $validChars = &#039;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~&#039;;
        $validCharsLen = strlen($validChars);
        $str = &#039;&#039;;
        $i = 0;
        while ($i++ &lt; $length) {
            $str .= $validChars[random_int(0, $validCharsLen - 1)];
        }
        return $str;
    }
    /**
     * Sets the authorization server&#039;s HTTP endpoint capable of authenticating
     * the end-user and obtaining authorization.
     *
     * @param string $uri
     * @return void
     */
    public function setAuthorizationUri($uri)
    {
        $this-&gt;authorizationUri = $this-&gt;coerceUri($uri);
    }
    /**
     * Gets the authorization server&#039;s HTTP endpoint capable of authenticating
     * the end-user and obtaining authorization.
     *
     * @return ?UriInterface
     */
    public function getAuthorizationUri()
    {
        return $this-&gt;authorizationUri;
    }
    /**
     * Gets the authorization server&#039;s HTTP endpoint capable of issuing tokens
     * and refreshing expired tokens.
     *
     * @return ?UriInterface
     */
    public function getTokenCredentialUri()
    {
        return $this-&gt;tokenCredentialUri;
    }
    /**
     * Sets the authorization server&#039;s HTTP endpoint capable of issuing tokens
     * and refreshing expired tokens.
     *
     * @param string $uri
     * @return void
     */
    public function setTokenCredentialUri($uri)
    {
        $this-&gt;tokenCredentialUri = $this-&gt;coerceUri($uri);
    }
    /**
     * Gets the redirection URI used in the initial request.
     *
     * @return ?string
     */
    public function getRedirectUri()
    {
        return $this-&gt;redirectUri;
    }
    /**
     * Sets the redirection URI used in the initial request.
     *
     * @param ?string $uri
     * @return void
     */
    public function setRedirectUri($uri)
    {
        if (is_null($uri)) {
            $this-&gt;redirectUri = null;
            return;
        }
        // redirect URI must be absolute
        if (!$this-&gt;isAbsoluteUri($uri)) {
            // &quot;postmessage&quot; is a reserved URI string in Google-land
            // @see https://developers.google.com/identity/sign-in/web/server-side-flow
            if (&#039;postmessage&#039; !== (string) $uri) {
                throw new InvalidArgumentException(&#039;Redirect URI must be absolute&#039;);
            }
        }
        $this-&gt;redirectUri = (string) $uri;
    }
    /**
     * Gets the scope of the access requests as a space-delimited String.
     *
     * @return ?string
     */
    public function getScope()
    {
        if (is_null($this-&gt;scope)) {
            return $this-&gt;scope;
        }
        return implode(&#039; &#039;, $this-&gt;scope);
    }
    /**
     * Sets the scope of the access request, expressed either as an Array or as
     * a space-delimited String.
     *
     * @param string|array&lt;string&gt;|null $scope
     * @return void
     * @throws InvalidArgumentException
     */
    public function setScope($scope)
    {
        if (is_null($scope)) {
            $this-&gt;scope = null;
        } elseif (is_string($scope)) {
            $this-&gt;scope = explode(&#039; &#039;, $scope);
        } elseif (is_array($scope)) {
            foreach ($scope as $s) {
                $pos = strpos($s, &#039; &#039;);
                if ($pos !== \false) {
                    throw new InvalidArgumentException(&#039;array scope values should not contain spaces&#039;);
                }
            }
            $this-&gt;scope = $scope;
        } else {
            throw new InvalidArgumentException(&#039;scopes should be a string or array of strings&#039;);
        }
    }
    /**
     * Gets the current grant type.
     *
     * @return ?string
     */
    public function getGrantType()
    {
        if (!is_null($this-&gt;grantType)) {
            return $this-&gt;grantType;
        }
        // Returns the inferred grant type, based on the current object instance
        // state.
        if (!is_null($this-&gt;code)) {
            return &#039;authorization_code&#039;;
        }
        if (!is_null($this-&gt;refreshToken)) {
            return &#039;refresh_token&#039;;
        }
        if (!is_null($this-&gt;username) &amp;&amp; !is_null($this-&gt;password)) {
            return &#039;password&#039;;
        }
        if (!is_null($this-&gt;issuer) &amp;&amp; !is_null($this-&gt;signingKey)) {
            return self::JWT_URN;
        }
        if (!is_null($this-&gt;subjectTokenFetcher) &amp;&amp; !is_null($this-&gt;subjectTokenType)) {
            return self::STS_URN;
        }
        return null;
    }
    /**
     * Sets the current grant type.
     *
     * @param string $grantType
     * @return void
     * @throws InvalidArgumentException
     */
    public function setGrantType($grantType)
    {
        if (in_array($grantType, self::$knownGrantTypes)) {
            $this-&gt;grantType = $grantType;
        } else {
            // validate URI
            if (!$this-&gt;isAbsoluteUri($grantType)) {
                throw new InvalidArgumentException(&#039;invalid grant type&#039;);
            }
            $this-&gt;grantType = (string) $grantType;
        }
    }
    /**
     * Gets an arbitrary string designed to allow the client to maintain state.
     *
     * @return string
     */
    public function getState()
    {
        return $this-&gt;state;
    }
    /**
     * Sets an arbitrary string designed to allow the client to maintain state.
     *
     * @param string $state
     * @return void
     */
    public function setState($state)
    {
        $this-&gt;state = $state;
    }
    /**
     * Gets the authorization code issued to this client.
     *
     * @return string
     */
    public function getCode()
    {
        return $this-&gt;code;
    }
    /**
     * Sets the authorization code issued to this client.
     *
     * @param string $code
     * @return void
     */
    public function setCode($code)
    {
        $this-&gt;code = $code;
    }
    /**
     * Gets the resource owner&#039;s username.
     *
     * @return string
     */
    public function getUsername()
    {
        return $this-&gt;username;
    }
    /**
     * Sets the resource owner&#039;s username.
     *
     * @param string $username
     * @return void
     */
    public function setUsername($username)
    {
        $this-&gt;username = $username;
    }
    /**
     * Gets the resource owner&#039;s password.
     *
     * @return string
     */
    public function getPassword()
    {
        return $this-&gt;password;
    }
    /**
     * Sets the resource owner&#039;s password.
     *
     * @param string $password
     * @return void
     */
    public function setPassword($password)
    {
        $this-&gt;password = $password;
    }
    /**
     * Sets a unique identifier issued to the client to identify itself to the
     * authorization server.
     *
     * @return string
     */
    public function getClientId()
    {
        return $this-&gt;clientId;
    }
    /**
     * Sets a unique identifier issued to the client to identify itself to the
     * authorization server.
     *
     * @param string $clientId
     * @return void
     */
    public function setClientId($clientId)
    {
        $this-&gt;clientId = $clientId;
    }
    /**
     * Gets a shared symmetric secret issued by the authorization server, which
     * is used to authenticate the client.
     *
     * @return string
     */
    public function getClientSecret()
    {
        return $this-&gt;clientSecret;
    }
    /**
     * Sets a shared symmetric secret issued by the authorization server, which
     * is used to authenticate the client.
     *
     * @param string $clientSecret
     * @return void
     */
    public function setClientSecret($clientSecret)
    {
        $this-&gt;clientSecret = $clientSecret;
    }
    /**
     * Gets the Issuer ID when using assertion profile.
     *
     * @return ?string
     */
    public function getIssuer()
    {
        return $this-&gt;issuer;
    }
    /**
     * Sets the Issuer ID when using assertion profile.
     *
     * @param string $issuer
     * @return void
     */
    public function setIssuer($issuer)
    {
        $this-&gt;issuer = $issuer;
    }
    /**
     * Gets the target sub when issuing assertions.
     *
     * @return ?string
     */
    public function getSub()
    {
        return $this-&gt;sub;
    }
    /**
     * Sets the target sub when issuing assertions.
     *
     * @param string $sub
     * @return void
     */
    public function setSub($sub)
    {
        $this-&gt;sub = $sub;
    }
    /**
     * Gets the target audience when issuing assertions.
     *
     * @return ?string
     */
    public function getAudience()
    {
        return $this-&gt;audience;
    }
    /**
     * Sets the target audience when issuing assertions.
     *
     * @param string $audience
     * @return void
     */
    public function setAudience($audience)
    {
        $this-&gt;audience = $audience;
    }
    /**
     * Gets the signing key when using an assertion profile.
     *
     * @return ?string
     */
    public function getSigningKey()
    {
        return $this-&gt;signingKey;
    }
    /**
     * Sets the signing key when using an assertion profile.
     *
     * @param string $signingKey
     * @return void
     */
    public function setSigningKey($signingKey)
    {
        $this-&gt;signingKey = $signingKey;
    }
    /**
     * Gets the signing key id when using an assertion profile.
     *
     * @return ?string
     */
    public function getSigningKeyId()
    {
        return $this-&gt;signingKeyId;
    }
    /**
     * Sets the signing key id when using an assertion profile.
     *
     * @param string $signingKeyId
     * @return void
     */
    public function setSigningKeyId($signingKeyId)
    {
        $this-&gt;signingKeyId = $signingKeyId;
    }
    /**
     * Gets the signing algorithm when using an assertion profile.
     *
     * @return ?string
     */
    public function getSigningAlgorithm()
    {
        return $this-&gt;signingAlgorithm;
    }
    /**
     * Sets the signing algorithm when using an assertion profile.
     *
     * @param ?string $signingAlgorithm
     * @return void
     */
    public function setSigningAlgorithm($signingAlgorithm)
    {
        if (is_null($signingAlgorithm)) {
            $this-&gt;signingAlgorithm = null;
        } elseif (!in_array($signingAlgorithm, self::$knownSigningAlgorithms)) {
            throw new InvalidArgumentException(&#039;unknown signing algorithm&#039;);
        } else {
            $this-&gt;signingAlgorithm = $signingAlgorithm;
        }
    }
    /**
     * Gets the set of parameters used by extension when using an extension
     * grant type.
     *
     * @return array&lt;mixed&gt;
     */
    public function getExtensionParams()
    {
        return $this-&gt;extensionParams;
    }
    /**
     * Sets the set of parameters used by extension when using an extension
     * grant type.
     *
     * @param array&lt;mixed&gt; $extensionParams
     * @return void
     */
    public function setExtensionParams($extensionParams)
    {
        $this-&gt;extensionParams = $extensionParams;
    }
    /**
     * Gets the number of seconds assertions are valid for.
     *
     * @return int
     */
    public function getExpiry()
    {
        return $this-&gt;expiry;
    }
    /**
     * Sets the number of seconds assertions are valid for.
     *
     * @param int $expiry
     * @return void
     */
    public function setExpiry($expiry)
    {
        $this-&gt;expiry = $expiry;
    }
    /**
     * Gets the lifetime of the access token in seconds.
     *
     * @return int
     */
    public function getExpiresIn()
    {
        return $this-&gt;expiresIn;
    }
    /**
     * Sets the lifetime of the access token in seconds.
     *
     * @param ?int $expiresIn
     * @return void
     */
    public function setExpiresIn($expiresIn)
    {
        if (is_null($expiresIn)) {
            $this-&gt;expiresIn = null;
            $this-&gt;issuedAt = null;
        } else {
            $this-&gt;issuedAt = time();
            $this-&gt;expiresIn = (int) $expiresIn;
        }
    }
    /**
     * Gets the time the current access token expires at.
     *
     * @return ?int
     */
    public function getExpiresAt()
    {
        if (!is_null($this-&gt;expiresAt)) {
            return $this-&gt;expiresAt;
        }
        if (!is_null($this-&gt;issuedAt) &amp;&amp; !is_null($this-&gt;expiresIn)) {
            return $this-&gt;issuedAt + $this-&gt;expiresIn;
        }
        return null;
    }
    /**
     * Returns true if the acccess token has expired.
     *
     * @return bool
     */
    public function isExpired()
    {
        $expiration = $this-&gt;getExpiresAt();
        $now = time();
        return !is_null($expiration) &amp;&amp; $now &gt;= $expiration;
    }
    /**
     * Sets the time the current access token expires at.
     *
     * @param int $expiresAt
     * @return void
     */
    public function setExpiresAt($expiresAt)
    {
        $this-&gt;expiresAt = $expiresAt;
    }
    /**
     * Gets the time the current access token was issued at.
     *
     * @return ?int
     */
    public function getIssuedAt()
    {
        return $this-&gt;issuedAt;
    }
    /**
     * Sets the time the current access token was issued at.
     *
     * @param int $issuedAt
     * @return void
     */
    public function setIssuedAt($issuedAt)
    {
        $this-&gt;issuedAt = $issuedAt;
    }
    /**
     * Gets the current access token.
     *
     * @return ?string
     */
    public function getAccessToken()
    {
        return $this-&gt;accessToken;
    }
    /**
     * Sets the current access token.
     *
     * @param string $accessToken
     * @return void
     */
    public function setAccessToken($accessToken)
    {
        $this-&gt;accessToken = $accessToken;
    }
    /**
     * Gets the current ID token.
     *
     * @return ?string
     */
    public function getIdToken()
    {
        return $this-&gt;idToken;
    }
    /**
     * Sets the current ID token.
     *
     * @param string $idToken
     * @return void
     */
    public function setIdToken($idToken)
    {
        $this-&gt;idToken = $idToken;
    }
    /**
     * Get the granted space-separated scopes (if they exist) for the last
     * fetched token.
     *
     * @return string|null
     */
    public function getGrantedScope()
    {
        return $this-&gt;grantedScope;
    }
    /**
     * Sets the current ID token.
     *
     * @param string $grantedScope
     * @return void
     */
    public function setGrantedScope($grantedScope)
    {
        $this-&gt;grantedScope = $grantedScope;
    }
    /**
     * Gets the refresh token associated with the current access token.
     *
     * @return ?string
     */
    public function getRefreshToken()
    {
        return $this-&gt;refreshToken;
    }
    /**
     * Sets the refresh token associated with the current access token.
     *
     * @param string $refreshToken
     * @return void
     */
    public function setRefreshToken($refreshToken)
    {
        $this-&gt;refreshToken = $refreshToken;
    }
    /**
     * Sets additional claims to be included in the JWT token
     *
     * @param array&lt;mixed&gt; $additionalClaims
     * @return void
     */
    public function setAdditionalClaims(array $additionalClaims)
    {
        $this-&gt;additionalClaims = $additionalClaims;
    }
    /**
     * Gets the additional claims to be included in the JWT token.
     *
     * @return array&lt;mixed&gt;
     */
    public function getAdditionalClaims()
    {
        return $this-&gt;additionalClaims;
    }
    /**
     * Gets the additional claims to be included in the JWT token.
     *
     * @return ?string
     */
    public function getIssuedTokenType()
    {
        return $this-&gt;issuedTokenType;
    }
    /**
     * The expiration of the last received token.
     *
     * @return array&lt;mixed&gt;|null
     */
    public function getLastReceivedToken()
    {
        if ($token = $this-&gt;getAccessToken()) {
            // the bare necessity of an auth token
            $authToken = [&#039;access_token&#039; =&gt; $token, &#039;expires_at&#039; =&gt; $this-&gt;getExpiresAt()];
        } elseif ($idToken = $this-&gt;getIdToken()) {
            $authToken = [&#039;id_token&#039; =&gt; $idToken, &#039;expires_at&#039; =&gt; $this-&gt;getExpiresAt()];
        } else {
            return null;
        }
        if ($expiresIn = $this-&gt;getExpiresIn()) {
            $authToken[&#039;expires_in&#039;] = $expiresIn;
        }
        if ($issuedAt = $this-&gt;getIssuedAt()) {
            $authToken[&#039;issued_at&#039;] = $issuedAt;
        }
        if ($refreshToken = $this-&gt;getRefreshToken()) {
            $authToken[&#039;refresh_token&#039;] = $refreshToken;
        }
        return $authToken;
    }
    /**
     * Get the client ID.
     *
     * Alias of {@see Google\Auth\OAuth2::getClientId()}.
     *
     * @param callable $httpHandler
     * @return string
     * @access private
     */
    public function getClientName(?callable $httpHandler = null)
    {
        return $this-&gt;getClientId();
    }
    /**
     * @todo handle uri as array
     *
     * @param ?string $uri
     * @return null|UriInterface
     */
    private function coerceUri($uri)
    {
        if (is_null($uri)) {
            return null;
        }
        return Utils::uriFor($uri);
    }
    /**
     * @param string $idToken
     * @param Key|Key[]|string|string[] $publicKey
     * @param string|string[] $allowedAlgs
     * @return object
     */
    private function jwtDecode($idToken, $publicKey, $allowedAlgs)
    {
        $keys = $this-&gt;getFirebaseJwtKeys($publicKey, $allowedAlgs);
        // Default exception if none are caught. We are using the same exception
        // class and message from firebase/php-jwt to preserve backwards
        // compatibility.
        $e = new \InvalidArgumentException(&#039;Key may not be empty&#039;);
        foreach ($keys as $key) {
            try {
                return JWT::decode($idToken, $key);
            } catch (\Exception $e) {
                // try next alg
            }
        }
        throw $e;
    }
    /**
     * @param Key|Key[]|string|string[] $publicKey
     * @param string|string[] $allowedAlgs
     * @return Key[]
     */
    private function getFirebaseJwtKeys($publicKey, $allowedAlgs)
    {
        // If $publicKey is instance of Key, return it
        if ($publicKey instanceof Key) {
            return [$publicKey];
        }
        // If $allowedAlgs is empty, $publicKey must be Key or Key[].
        if (empty($allowedAlgs)) {
            $keys = [];
            foreach ((array) $publicKey as $kid =&gt; $pubKey) {
                if (!$pubKey instanceof Key) {
                    throw new \InvalidArgumentException(sprintf(&#039;When allowed algorithms is empty, the public key must&#039; . &#039;be an instance of %s or an array of %s objects&#039;, Key::class, Key::class));
                }
                $keys[$kid] = $pubKey;
            }
            return $keys;
        }
        $allowedAlg = null;
        if (is_string($allowedAlgs)) {
            $allowedAlg = $allowedAlgs;
        } elseif (is_array($allowedAlgs)) {
            if (count($allowedAlgs) &gt; 1) {
                throw new \InvalidArgumentException(&#039;To have multiple allowed algorithms, You must provide an&#039; . &#039; array of Firebase\JWT\Key objects.&#039; . &#039; See https://github.com/firebase/php-jwt for more information.&#039;);
            }
            $allowedAlg = array_pop($allowedAlgs);
        } else {
            throw new \InvalidArgumentException(&#039;allowed algorithms must be a string or array.&#039;);
        }
        if (is_array($publicKey)) {
            // When publicKey is greater than 1, create keys with the single alg.
            $keys = [];
            foreach ($publicKey as $kid =&gt; $pubKey) {
                if ($pubKey instanceof Key) {
                    $keys[$kid] = $pubKey;
                } else {
                    $keys[$kid] = new Key($pubKey, $allowedAlg);
                }
            }
            return $keys;
        }
        return [new Key($publicKey, $allowedAlg)];
    }
    /**
     * Determines if the URI is absolute based on its scheme and host or path
     * (RFC 3986).
     *
     * @param string $uri
     * @return bool
     */
    private function isAbsoluteUri($uri)
    {
        $uri = $this-&gt;coerceUri($uri);
        return $uri-&gt;getScheme() &amp;&amp; ($uri-&gt;getHost() || $uri-&gt;getPath());
    }
    /**
     * @param array&lt;mixed&gt; $params
     * @return array&lt;mixed&gt;
     */
    private function addClientCredentials(&amp;$params)
    {
        $clientId = $this-&gt;getClientId();
        $clientSecret = $this-&gt;getClientSecret();
        if ($clientId &amp;&amp; $clientSecret) {
            $params[&#039;client_id&#039;] = $clientId;
            $params[&#039;client_secret&#039;] = $clientSecret;
        }
        return $params;
    }
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-content%2Fplugins%2Fgoogle-site-kit%2Fthird-party%2Fgoogle%2Fauth%2Fsrc'>⬅ Back to Directory</a>