feat: add a configuration option to support clients that don't require consent

[lart2150]

for internal applications you might want to skip prompting for consent. With this change you can set your clients array like the array below to not prompt users for consent.

return array(
	'client_id_random_string' => array(
		'name' => 'The name of the Client',
		'secret' => 'a secret string',
		'redirect_uri' => 'https://example.com/redirect.uri',
		'grant_types' => array( 'authorization_code' ),
		'requires_consent' => false,
	),

[ashfame]

Thanks @lart2150 for the PR! Looks good except a minor suggestion for a stricter check in place.

I can also just push that change myself, but waiting for a bit since I need to consult my colleagues on whether they also think this PR warrants a major bump in version since it introduces a breaking change.

[ashfame]

@akirk @psrpinto Looking for your input - this PR changes the constructor signature in AuthenticateHandler (from array $clients to ClientCredentialsStorage $clients) and AuthorizeHandler (added argument of ClientCredentialsStorage $clients).

Even though these classes might not be commonly instantiated directly, do you agree this warrants a major version bump given the breaking API changes?

[psrpinto]

At first sight this looks like a good change to me, but indeed, either we make it backwards-compatible (by accepting either an array or an instance of ClientCredentialsStorage), or we should bump the major version.

[lart2150]

At first sight this looks like a good change to me, but indeed, either we make it backwards-compatible (by accepting either an array or an instance of ClientCredentialsStorage), or we should bump the major version.

Are you targeting php 8 so I could type hint AuthorizeHandler/AuthenticateHandler
array|ClientCredentialsStorage $clients
I don't see a php version in the composer.json

[ashfame]

@lart2150 That would be PHP 7.4, same as WordPress.

[lart2150]

Any preference how to handle the change? If we want to keep api compatibility I think we could do
AuthenticateHandler
public function __construct( ConsentStorage $consent_storage, mixed $clients ) {

AuthorizeHandler
public function __construct( OAuth2Server $server, ConsentStorage $consent_storage, ClientCredentialsStorage $clients = null) {

I'm not a big fan of using mixed. I can also revert the change to the AuthenticateHandler contractor and convert the array to ClientCredentialsStorage inside the constructor.

I think the last option is to go with the api change and bump the version accordingly.

[ashfame]

Sorry for the long wait. Let's just bump the major version. Merging PR.