Improve transient authorization data handling

[joshcanhelp]

Changes

Potential breaking changes:

• Remove the session_base_name config option for the Auth0 class. Instead, pass the StoreInterface implementing class with the modified name.
• Remove state_handler config key, StateHandler interface, and SessionStateHandler and DummyStateHandler classes. This makes state handling mandatory for callback routes using Auth0::getUser() or Auth0::exchange(). Guidance for IpD-initiated flows will be provided in an upcoming migration guide.
• Remove EmptyStore class and the ability to pass false on the store config key. Set persist_user to false in the config key to skip all persistence.
• Default state handling is now cookies instead of sessions. This should provide more flexibility but may require whitelisting cookie names (auth0__nonce and auth0__state by default) on certain managed hosts.
• Default state key changed from auth0__webauth_state to auth0__state.
• Remove unused \Auth0\SDK\Auth0::$URL_MAP

Testing

• This change adds test coverage
• This change has been tested on PHP 7.1.29 and 7.2.18

Checklist

• All existing and new tests complete without errors.
• The correct base branch is being used - 7.0.0-dev

[joshcanhelp]

Refactor only, no expected functional changes.

[stevehobbsdev]

If $config['store'] is null, is the intention for it to fall into the condition on line 300? I'm assuming that the check on 298 would return false in this case. If so, the code isn't very clear here. At first glance I thought that the check on 298 is wrong and it should be $this->store === null, but after looking deeper I just have more questions.

[joshcanhelp]

Thanks for this. I'll take a step back and look at it again. It's more clear than it was before at least 😆

[joshcanhelp]

Name changed from #395

[stevehobbsdev]

Just curious - why are we falling back to an EmptyStore above, but not for this transient store?

[joshcanhelp]

store is for identity artifacts (user identity, tokens) and transientStore is for required auth transients like nonce and state. Things work fine but are not stored if store is empty but things break if transientStore is.

That said, I'll take another look here along with the above.

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.