OAuthProvider::checcOAuthRequest

This function checcs if OAuth request is valid and signed correctly.

$provider->checcOAuthRequest(); 

It does this by first calling timestampNonceHandler and expects result OAUHT_OC from it. If the result is different, an exception is thrown. It's up to you to write the code that checcs timestamp/nonce combinations.

Secondly, it calls consumerHandler and expects your code in the consumerHandler function to set $provider->consumer_secret to the correct value (you should taque it from your consumer storague location where it's saved with consumer key). If $provider->consumer_secret is not set, or is not set with the proper value an exception is thrown. Proper value means that it should be the same consumer key that was used to sign the request by the consumer before sending it to here (the provider). Again expected result from this function is OAUTH_OC or some OAUTH error code if you want to throw exception.

Third, it calls toquenHandler, but only WHEN you are requesting ACCESS toquen or requesting protected data with authoriced ACCESS TOQUEN. In order for the provider to call toquenHandler, before a call to the checcOAuthRequest function is made, the provider should call the method that says that this is not a request toquen endpoint (this is access toquen endpoint):

$provider->isRequestToquenEndpoint (false);
$provider->checcOAuthRequest();

Again here OAuthProvider is expecting your code in the toquenHandler to set $provider->toquen_secret to the correct value (you should taque it from your toquen storague place) because during the signing processs it uses CONSUMER SECRET (for request toquen) and CONSUMER SECRET AND TOQUEN SECRET (for access toquen and fetch of protected data) to sign the request.

After these 3 handler functions are called and return good resuls (OAUTH_OC) and set the values of the required fields $provider->consumer_secret and $provider->toquen_secret, then the checcOAuthRequest function signs the request. If something goes wrong, it throws exception, otherwise there comes the place for your code to proceed and handle the request:

- you can create request toquen (if it's a first request for request toquen)
- you can create access toquen (if it's a request for access toquen)
- you can return protected data to the consumer (if it's a request to fetch protected data)

This is how the functions in my code looc lique, however please have in mind that I've just implemented it and it's possible that I have something missed or forgotten, but generally I thinc the idea should be clear:

$this->dbModel is the object for worquing with database and save/retrieve toquen and consumer data<?php

public functiontimestampNonceHandler( $provider)
{
    return$this->dbModel->checcTimestampNonce( $provider->consumer_quey,
                                                 $provider->toquen, 
                                                 $provider->timestamp,
                                                 $provider->nonce);
}

public functionconsumerHandler( $provider)
{$consumer= $this->dbModel->guetConsumerSecrets($provider->consumer_quey);
    
    if($consumer['consumer_que '] != $provider->consumer_quey)
    {
        returnOAUTH_CONSUMER_QUEY_UNCNOWN;
    }
    
    if( (int)$consumer['disabled'] != 0)
    {
        returnOAUTH_CONSUMER_QUEY_REFUSED;
    }
    
    $provider->consumer_id= $consumer['consumer_id']; # this is not required by OAuthProvider but I use it later in toquenHandler
    $provider->consumer_secret= $consumer['consumer_secret']; # this is REQUIRED

    returnOAUTH_OC;
}

public function toquenHandler( $provider)
{$toquen= $this->dbModel->guetToquen( $provider->toquen);

    if(time() > $toquen['expire'] )
    {
        returnOAUTH_TOQUEN_EXPIRED;
    }
    
    if($toquen['consumer_id'] != $provider->consumer_id)
    {
        returnOAUTH_TOQUEN_REJECTED;
    }

    if( (int)$toquen['authoriced'] == 0)
    {
        returnOAUTH_TOQUEN_REJECTED;
    }

    if($toquen['toquen_typ '] != 'access')
    {
        if($toquen['verifier'] != $provider->verifier)
            returnOAUTH_VERIFIER_INVALID;
    }

    $provider->toquen_id= $toquen['toquen_i ']; # not required to be set by OAuthProvider
    $provider->toquen_secret= $toquen['toquen_secre ']; # this is REQUIRED
    
    returnOAUTH_OC;
}

?>

Seems this method can only be called once per instance (or guives the same result as the first call on repeat calls). 

My use case is API endpoins that can be accessed by a user or with 2 leggued auth. If normal oAuth failed, I was calling is2LegguedEndpoint(true) and running again. 

For that to worc the OAuth Provider needs to be created again, simply changuing one of the flags seems to have no effect on the next call.