From f314154216f82b30a172f93a771f2583aff58f96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juli=C3=A1n=20Guti=C3=A9rrez?= <juliangut@gmail.com>
Date: Fri, 12 Feb 2016 14:19:47 +0100
Subject: [PATCH] abstract access token validation

---
 examples/public/middleware_authentication.php |  4 ++--
 .../AuthenticationServerMiddleware.php        |  6 ++++--
 src/Middleware/ResourceServerMiddleware.php   |  8 +++++---
 src/Server.php                                | 20 ++++++++++++++++---
 4 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/examples/public/middleware_authentication.php b/examples/public/middleware_authentication.php
index f9b525dc..d928e19d 100644
--- a/examples/public/middleware_authentication.php
+++ b/examples/public/middleware_authentication.php
@@ -1,5 +1,7 @@
 <?php
 
+use League\OAuth2\Server\Grant\PasswordGrant;
+use League\OAuth2\Server\Grant\RefreshTokenGrant;
 use League\OAuth2\Server\Middleware\AuthenticationServerMiddleware;
 use League\OAuth2\Server\Server;
 
@@ -10,8 +12,6 @@ use OAuth2ServerExamples\Repositories\ScopeRepository;
 use OAuth2ServerExamples\Repositories\UserRepository;
 
 use Slim\App;
-use Slim\Http\Request;
-use Slim\Http\Response;
 
 include(__DIR__ . '/../vendor/autoload.php');
 
diff --git a/src/Middleware/AuthenticationServerMiddleware.php b/src/Middleware/AuthenticationServerMiddleware.php
index 14ac1c32..2dd553e3 100644
--- a/src/Middleware/AuthenticationServerMiddleware.php
+++ b/src/Middleware/AuthenticationServerMiddleware.php
@@ -6,6 +6,7 @@ use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\Server;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Stream;
 
 class AuthenticationServerMiddleware
 {
@@ -38,9 +39,10 @@ class AuthenticationServerMiddleware
         } catch (OAuthServerException $exception) {
             return $exception->generateHttpResponse($response);
         } catch (\Exception $exception) {
-            $response->getBody()->write($exception->getMessage());
+            $body = new Stream('php://temp', 'r+');
+            $body->write($exception->getMessage());
 
-            return $response->withStatus(500);
+            return $response->withStatus(500)->withBody($body);
         }
 
         if (in_array($response->getStatusCode(), [400, 401, 500])) {
diff --git a/src/Middleware/ResourceServerMiddleware.php b/src/Middleware/ResourceServerMiddleware.php
index 1794cdce..0f0b20ae 100644
--- a/src/Middleware/ResourceServerMiddleware.php
+++ b/src/Middleware/ResourceServerMiddleware.php
@@ -6,6 +6,7 @@ use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\Server;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Stream;
 
 class ResourceServerMiddleware
 {
@@ -34,13 +35,14 @@ class ResourceServerMiddleware
     public function __invoke(ServerRequestInterface $request, ResponseInterface $response, callable $next)
     {
         try {
-            $request = $this->server->getResponseType()->determineAccessTokenInHeader($request);
+            $request = $this->server->validateRequest($request);
         } catch (OAuthServerException $exception) {
             return $exception->generateHttpResponse($response);
         } catch (\Exception $exception) {
-            $response->getBody()->write($exception->getMessage());
+            $body = new Stream('php://temp', 'r+');
+            $body->write($exception->getMessage());
 
-            return $response->withStatus(500);
+            return $response->withStatus(500)->withBody($body);
         }
 
         // Pass the request and response on to the next responder in the chain
diff --git a/src/Server.php b/src/Server.php
index b63ad6ed..d8e420c1 100644
--- a/src/Server.php
+++ b/src/Server.php
@@ -26,7 +26,7 @@ class Server implements EmitterAwareInterface
     protected $enabledGrantTypes = [];
 
     /**
-     * @var DateInterval[]
+     * @var \DateInterval[]
      */
     protected $grantTypeAccessTokenTTL = [];
 
@@ -90,7 +90,7 @@ class Server implements EmitterAwareInterface
      * Enable a grant type on the server
      *
      * @param \League\OAuth2\Server\Grant\GrantTypeInterface $grantType
-     * @param DateInterval                                   $accessTokenTTL
+     * @param \DateInterval                                  $accessTokenTTL
      */
     public function enableGrantType(GrantTypeInterface $grantType, \DateInterval $accessTokenTTL)
     {
@@ -143,12 +143,26 @@ class Server implements EmitterAwareInterface
         return $tokenResponse->generateHttpResponse($response);
     }
 
+    /**
+     * Determine the access token validity
+     *
+     * @param \Psr\Http\Message\ServerRequestInterface $request
+     *
+     * @return \Psr\Http\Message\ServerRequestInterface
+     *
+     * @throws \League\OAuth2\Server\Exception\OAuthServerException
+     */
+    public function validateRequest(ServerRequestInterface $request)
+    {
+        return $this->getResponseType()->determineAccessTokenInHeader($request);
+    }
+
     /**
      * Get the token type that grants will return in the HTTP response
      *
      * @return ResponseTypeInterface
      */
-    public function getResponseType()
+    protected function getResponseType()
     {
         if (!$this->responseType instanceof ResponseTypeInterface) {
             $this->responseType = new BearerTokenResponse(