Merge branch 'release/0.4.1'

Removed null value of expires/expiresIn parameter

.travis.yml

@@ -0,0 +1,8 @@
+language: php
+
+php:
+  - 5.3
+  - 5.4
+
+before_script: composer install
+script: phpunit -c build/phpunit.xml

README.md

@@ -8,8 +8,8 @@ The framework is provided as a Composer package which can be installed by adding
 
 ```javascript
 {
-	"require": {  
-		"lncd\Oauth2": "*"  
+	"require": {
+		"lncd\Oauth2": "*"
 	}
 }
 ```
@@ -22,7 +22,12 @@ Check out the [wiki](https://github.com/lncd/OAuth2/wiki)
 
 ### Authentication Server
 
-The authentication server is a flexible class that supports the standard authorization code grant.
+The authentication server is a flexible class that supports the following grants:
+
+* authentication code
+* refresh token
+* client credentials
+* password (user credentials)
 
 ### Resource Server
 

build/phpunit.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<phpunit colors="true" convertNoticesToExceptions="true" convertWarningsToExceptions="true" stopOnError="false" stopOnFailure="false" stopOnIncomplete="false" stopOnSkipped="false">
+<phpunit colors="true" convertNoticesToExceptions="true" convertWarningsToExceptions="true" stopOnError="false" stopOnFailure="false" stopOnIncomplete="false" stopOnSkipped="false" bootstrap="../tests/Bootstrap.php">
 	<testsuites>
 		<testsuite name="Authentication Server">
 			<directory suffix="test.php">../tests/authentication</directory>
@@ -13,10 +13,12 @@
 			<directory suffix=".php">PEAR_INSTALL_DIR</directory>
 			<directory suffix=".php">PHP_LIBDIR</directory>
 			<directory suffix=".php">../vendor/composer</directory>
+			<directory suffix=".php">../tests</directory>
 		</blacklist>
 	</filter>
 	<logging>
-		<log type="coverage-html" target="coverage" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="35" highLowerBound="70"/>
+		<log type="coverage-html" target="coverage" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="50" highLowerBound="90"/>
+		<log type="coverage-text" target="php://stdout" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="50" highLowerBound="90"/>
 		<log type="coverage-clover" target="logs/clover.xml"/>
 		<log type="junit" target="logs/junit.xml" logIncompleteSkipped="false"/>
 	</logging>

composer.json

@@ -1,7 +1,7 @@
 {
 	"name": "lncd/oauth2",
 	"description": "OAuth 2.0 Framework",
-	"version": "0.3",
+	"version": "0.4.1",
 	"homepage": "https://github.com/lncd/OAuth2",
 	"license": "MIT",
 	"require": {
@@ -29,7 +29,7 @@
 		{
 			"name": "Alex Bilbie",
 			"email": "hello@alexbilbie.com",
-			"homepage": "http://www.httpster.org",
+			"homepage": "http://www.alexbilbie.com",
 			"role": "Developer"
 		}
 	],

sql/database.sql

@@ -20,12 +20,13 @@ CREATE TABLE `client_endpoints` (
 -- Create syntax for TABLE 'oauth_sessions'
 CREATE TABLE `oauth_sessions` (
   `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
-  `client_id` varchar(32) NOT NULL DEFAULT '',
-  `redirect_uri` varchar(250) NOT NULL DEFAULT '',
+  `client_id` varchar(40) NOT NULL DEFAULT '',
+  `redirect_uri` varchar(250) DEFAULT '',
   `owner_type` enum('user','client') NOT NULL DEFAULT 'user',
   `owner_id` varchar(255) DEFAULT NULL,
   `auth_code` varchar(40) DEFAULT '',
   `access_token` varchar(40) DEFAULT '',
+  `refresh_token` varchar(40) NOT NULL,
   `access_token_expires` int(10) DEFAULT NULL,
   `stage` enum('requested','granted') NOT NULL DEFAULT 'requested',
   `first_requested` int(10) unsigned NOT NULL,
@@ -56,4 +57,4 @@ CREATE TABLE `oauth_session_scopes` (
   KEY `scope` (`scope`),
   CONSTRAINT `oauth_session_scopes_ibfk_3` FOREIGN KEY (`scope`) REFERENCES `scopes` (`scope`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `oauth_session_scopes_ibfk_4` FOREIGN KEY (`session_id`) REFERENCES `oauth_sessions` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

src/Oauth2/Authentication/Database.php

@@ -6,30 +6,42 @@ interface Database
 {
     /**
      * Validate a client
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * # Client ID + redirect URI
      * SELECT clients.id FROM clients LEFT JOIN client_endpoints ON
      *  client_endpoints.client_id = clients.id WHERE clients.id = $clientId AND
      *  client_endpoints.redirect_uri = $redirectUri
-     * 
+     *
      * # Client ID + client secret
      * SELECT clients.id FROM clients  WHERE clients.id = $clientId AND
      *  clients.secret = $clientSecret
-     * 
+     *
      * # Client ID + client secret + redirect URI
      * SELECT clients.id FROM clients LEFT JOIN client_endpoints ON
      *  client_endpoints.client_id = clients.id WHERE clients.id = $clientId AND
      *  clients.secret = $clientSecret AND client_endpoints.redirect_uri =
      *  $redirectUri
      * </code>
-     * 
-     * @param  string $clientId     The client's ID
+     *
+     * Response:
+     *
+     * <code>
+     * Array
+     * (
+     *     [client_id] => (string) The client ID
+     *     [client secret] => (string) The client secret
+     *     [redirect_uri] => (string) The redirect URI used in this request
+     *     [name] => (string) The name of the client
+     * )
+     * </code>
+     *
+     * @param  string $clientId       The client's ID
      * @param  string $clientSecret The client's secret (default = "null")
-     * @param  string $redirectUri  The client's redirect URI (default = "null")
-     * @return [type]               [description]
+     * @param  string $redirectUri   The client's redirect URI (default = "null")
+     * @return  bool|array               Returns false if the validation fails, array on success
      */
     public function validateClient(
         $clientId,
@@ -39,24 +51,25 @@ interface Database
 
     /**
      * Create a new OAuth session
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * INSERT INTO oauth_sessions (client_id, redirect_uri, owner_type,
-     *  owner_id, auth_code, access_token, stage, first_requested, last_updated)
-     *  VALUES ($clientId, $redirectUri, $type, $typeId, $authCode,
-     *  $accessToken, $stage, UNIX_TIMESTAMP(NOW()), UNIX_TIMESTAMP(NOW()))
+     * owner_id, auth_code, access_token, refresh_token, stage, first_requested,
+     * last_updated) VALUES ($clientId, $redirectUri, $type, $typeId, $authCode,
+     * $accessToken, $stage, UNIX_TIMESTAMP(NOW()), UNIX_TIMESTAMP(NOW()))
      * </code>
-     * 
-     * @param  string $clientId    The client ID
-     * @param  string $redirectUri The redirect URI
-     * @param  string $type        The session owner's type (default = "user")
-     * @param  string $typeId      The session owner's ID (default = "null")
-     * @param  string $authCode    The authorisation code (default = "null")
-     * @param  string $accessToken The access token (default = "null")
-     * @param  string $stage       The stage of the session (default ="request")
-     * @return [type]              [description]
+     *
+     * @param  string $clientId     The client ID
+     * @param  string $redirectUri  The redirect URI
+     * @param  string $type         The session owner's type (default = "user")
+     * @param  string $typeId       The session owner's ID (default = "null")
+     * @param  string $authCode     The authorisation code (default = "null")
+     * @param  string $accessToken  The access token (default = "null")
+     * @param  string $refreshToken The refresh token (default = "null")
+     * @param  string $stage        The stage of the session (default ="request")
+     * @return  int The session ID
      */
     public function newSession(
         $clientId,
@@ -65,47 +78,50 @@ interface Database
         $typeId = null,
         $authCode = null,
         $accessToken = null,
+        $refreshToken = null,
         $accessTokenExpire = null,
         $stage = 'requested'
     );
 
     /**
      * Update an OAuth session
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * UPDATE oauth_sessions SET auth_code = $authCode, access_token =
      *  $accessToken, stage = $stage, last_updated = UNIX_TIMESTAMP(NOW()) WHERE
      *  id = $sessionId
      * </code>
-     * 
-     * @param  string $sessionId   The session ID
-     * @param  string $authCode    The authorisation code (default = "null")
-     * @param  string $accessToken The access token (default = "null")
-     * @param  string $stage       The stage of the session (default ="request")
-     * @return void
+     *
+     * @param  string $sessionId    The session ID
+     * @param  string $authCode     The authorisation code (default = "null")
+     * @param  string $accessToken  The access token (default = "null")
+     * @param  string $refreshToken The refresh token (default = "null")
+     * @param  string $stage        The stage of the session (default ="request")
+     * @return  void
      */
     public function updateSession(
         $sessionId,
         $authCode = null,
         $accessToken = null,
+        $refreshToken = null,
         $accessTokenExpire = null,
         $stage = 'requested'
     );
 
     /**
      * Delete an OAuth session
-     * 
+     *
      * <code>
      * DELETE FROM oauth_sessions WHERE client_id = $clientId AND owner_type =
      *  $type AND owner_id = $typeId
      * </code>
-     * 
+     *
      * @param  string $clientId The client ID
-     * @param  string $type     The session owner's type 
+     * @param  string $type     The session owner's type
      * @param  string $typeId   The session owner's ID
-     * @return [type]           [description]
+     * @return  void
      */
     public function deleteSession(
         $clientId,
@@ -113,18 +129,39 @@ interface Database
         $typeId
     );
 
+    public function validateRefreshToken($refreshToken, $clientId);
+
+    /**
+     * Update the refresh token
+     *
+     * Database query:
+     *
+     * <code>
+     * UPDATE oauth_sessions SET access_token = $newAccessToken, refresh_token =
+     *  $newRefreshToken, access_toke_expires = $accessTokenExpires, last_updated = UNIX_TIMESTAMP(NOW()) WHERE
+     *  id = $sessionId
+     * </code>
+     *
+     * @param  string $sessionId             The session ID
+     * @param  string $newAccessToken        The new access token for this session
+     * @param  string $newRefreshToken       The new refresh token for the session
+     * @param  int    $accessTokenExpires    The UNIX timestamp of when the new token expires
+     * @return void
+     */
+    public function updateRefreshToken($sessionId, $newAccessToken, $newRefreshToken, $accessTokenExpires);
+
     /**
      * Validate that an authorisation code is valid
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * SELECT id FROM oauth_sessions WHERE client_id = $clientID AND
      *  redirect_uri = $redirectUri AND auth_code = $authCode
      * </code>
-     * 
+     *
      * Response:
-     * 
+     *
      * <code>
      * Array
      * (
@@ -141,12 +178,12 @@ interface Database
      *      last updated
      * )
      * </code>
-     * 
+     *
      * @param  string     $clientId    The client ID
      * @param  string     $redirectUri The redirect URI
      * @param  string     $authCode    The authorisation code
-     * @return int|bool                Returns the session ID if the auth code
-     *  is valid otherwise returns false 
+     * @return  int|bool   Returns the session ID if the auth code
+     *  is valid otherwise returns false
      */
     public function validateAuthCode(
         $clientId,
@@ -156,18 +193,18 @@ interface Database
 
     /**
      * Return the session ID for a given session owner and client combination
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * SELECT id FROM oauth_sessions WHERE client_id = $clientId
      *  AND owner_type = $type AND owner_id = $typeId
      * </code>
-     * 
-     * @param  string      $type     The session owner's type 
+     *
+     * @param  string      $type     The session owner's type
      * @param  string      $typeId   The session owner's ID
      * @param  string      $clientId The client ID
-     * @return string|null           Return the session ID as an integer if 
+     * @return string|null           Return the session ID as an integer if
      *  found otherwise returns false
      */
     public function hasSession(
@@ -178,13 +215,13 @@ interface Database
 
     /**
      * Return the access token for a given session
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * SELECT access_token FROM oauth_sessions WHERE id = $sessionId
      * </code>
-     * 
+     *
      * @param  int         $sessionId The OAuth session ID
      * @return string|null            Returns the access token as a string if
      *  found otherwise returns null
@@ -193,13 +230,13 @@ interface Database
 
     /**
      * Removes an authorisation code associated with a session
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * UPDATE oauth_sessions SET auth_code = NULL WHERE id = $sessionId
      * </code>
-     * 
+     *
      * @param  int    $sessionId The OAuth session ID
      * @return void
      */
@@ -207,14 +244,14 @@ interface Database
 
     /**
      * Sets a sessions access token
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
-     * UPDATE oauth_sessions SET access_token = $accessToken WHERE id = 
+     * UPDATE oauth_sessions SET access_token = $accessToken WHERE id =
      *  $sessionId
      * </code>
-     * 
+     *
      * @param int    $sessionId   The OAuth session ID
      * @param string $accessToken The access token
      * @return void
@@ -226,14 +263,14 @@ interface Database
 
     /**
      * Associates a session with a scope
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
-     * INSERT INTO oauth_session_scopes (session_id, scope) VALUE ($sessionId, 
+     * INSERT INTO oauth_session_scopes (session_id, scope) VALUE ($sessionId,
      *  $scope)
      * </code>
-     * 
+     *
      * @param int    $sessionId The session ID
      * @param string $scope     The scope
      * @return void
@@ -245,15 +282,15 @@ interface Database
 
     /**
      * Return information about a scope
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * SELECT * FROM scopes WHERE scope = $scope
      * </code>
-     * 
+     *
      * Response:
-     * 
+     *
      * <code>
      * Array
      * (
@@ -263,22 +300,22 @@ interface Database
      *     [description] => (string) The scope's description
      * )
      * </code>
-     * 
+     *
      * @param  string $scope The scope
-     * @return array         
+     * @return array
      */
     public function getScope($scope);
 
     /**
      * Associate a session's scopes with an access token
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
-     * UPDATE oauth_session_scopes SET access_token = $accessToken WHERE 
+     * UPDATE oauth_session_scopes SET access_token = $accessToken WHERE
      *  session_id = $sessionId
      * </code>
-     * 
+     *
      * @param  int    $sessionId   The session ID
      * @param  string $accessToken The access token
      * @return void
@@ -290,17 +327,17 @@ interface Database
 
     /**
      * Return the scopes associated with an access token
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
-     * SELECT scopes.scope, scopes.name, scopes.description FROM 
-     * oauth_session_scopes JOIN scopes ON oauth_session_scopes.scope = 
+     * SELECT scopes.scope, scopes.name, scopes.description FROM
+     * oauth_session_scopes JOIN scopes ON oauth_session_scopes.scope =
      *  scopes.scope WHERE access_token = $accessToken
      * </code>
-     * 
+     *
      * Response:
-     * 
+     *
      * <code>
      * Array
      * (
@@ -312,7 +349,7 @@ interface Database
      *         )
      * )
      * </code>
-     * 
+     *
      * @param  string $accessToken The access token
      * @return array
      */

src/Oauth2/Authentication/Server.php

@@ -30,24 +30,31 @@ class Server
      * @var array
      */
     private $_config = array(
-        'scope_delimeter'       =>  ',',
-        'access_token_ttl'   =>  null
+        'scope_delimeter'    =>  ',',
+        'access_token_ttl'   =>  3600
     );
 
     /**
      * Supported response types
      * @var array
      */
-    private $_responseTypes =   array(
+    private $_responseTypes = array(
         'code'
     );
-    
+
     /**
      * Supported grant types
      * @var array
      */
-    private $_grantTypes    =   array(
-        'authorization_code'
+    private $_grantTypes = array(
+        'authorization_code'    =>  false,
+        'client_credentials'    =>  false,
+        'password'  =>  false,
+        'refresh_token' =>  false,
+    );
+
+    private $_grantTypeCallbacks = array(
+        'password'  =>  null
     );
 
     /**
@@ -69,27 +76,29 @@ class Server
 
     /**
      * Error codes.
-     * 
+     *
      * To provide i8ln errors just overwrite the keys
-     * 
+     *
      * @var array
      */
     public $errors = array(
-        'invalid_request'   =>  'The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the "%s" parameter.',
-        'unauthorized_client'   =>  'The client is not authorized to request an access token using this method.',
-        'access_denied' =>  'The resource owner or authorization server denied the request.',
+        'invalid_request'           =>  'The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the "%s" parameter.',
+        'unauthorized_client'       =>  'The client is not authorized to request an access token using this method.',
+        'access_denied'             =>  'The resource owner or authorization server denied the request.',
         'unsupported_response_type' =>  'The authorization server does not support obtaining an access token using this method.',
-        'invalid_scope' =>  'The requested scope is invalid, unknown, or malformed. Check the "%s" scope.',
-        'server_error'  =>  'The authorization server encountered an unexpected condition which prevented it from fulfilling the request.',
+        'invalid_scope'             =>  'The requested scope is invalid, unknown, or malformed. Check the "%s" scope.',
+        'server_error'              =>  'The authorization server encountered an unexpected condition which prevented it from fulfilling the request.',
         'temporarily_unavailable'   =>  'The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server.',
-        'unsupported_grant_type'    =>  'The authorization grant type is not supported by the authorization server',
-        'invalid_client'    =>  'Client authentication failed',
-        'invalid_grant'     =>  'The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. Check the "%s" parameter.'
+        'unsupported_grant_type'    =>  'The authorization grant type "%s" is not supported by the authorization server',
+        'invalid_client'            =>  'Client authentication failed',
+        'invalid_grant'             =>  'The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. Check the "%s" parameter.',
+        'invalid_credentials'       =>  'The user credentials were incorrect.',
+        'invalid_refresh'           =>  'The refresh token is invalid.',
     );
 
     /**
      * Constructor
-     * 
+     *
      * @access public
      * @param  array $options Optional list of options to overwrite the defaults
      * @return void
@@ -97,13 +106,13 @@ class Server
     public function __construct($options = null)
     {
         if ($options !== null) {
-            $this->options = array_merge($this->_config, $options);
+            $this->_config = array_merge($this->_config, $options);
         }
     }
 
     /**
      * Register a database abstrator class
-     * 
+     *
      * @access public
      * @param  object $db A class that implements OAuth2ServerDatabase
      * @return void
@@ -113,9 +122,30 @@ class Server
         $this->_db = $db;
     }
 
+    /**
+     * Enable a grant type
+     *
+     * @access public
+     * @return void
+     */
+    public function enableGrantType($type, $callback = null)
+    {
+        if (isset($this->_grantTypes[$type])) {
+            $this->_grantTypes[$type] = true;
+        }
+
+        if (in_array($type, array_keys($this->_grantTypeCallbacks))) {
+            if (is_null($callback) || ! is_callable($callback)) {
+                throw new ServerException('No registered callback function for grant type `'.$type.'`');
+            }
+
+            $this->_grantTypeCallbacks[$type] = $callback;
+        }
+    }
+
     /**
      * Check client authorise parameters
-     * 
+     *
      * @access public
      * @param  array $authParams Optional array of parsed $_GET keys
      * @return array             Authorise request parameters
@@ -126,30 +156,22 @@ class Server
 
         // Client ID
         if ( ! isset($authParams['client_id']) && ! isset($_GET['client_id'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'client_id'), 0);
-
-        } else {
-
-            $params['client_id'] = (isset($authParams['client_id'])) ?
-                                            $authParams['client_id'] : 
-                                            $_GET['client_id'];
-
         }
 
+        $params['client_id'] = (isset($authParams['client_id'])) ?
+                                    $authParams['client_id'] :
+                                    $_GET['client_id'];
+
         // Redirect URI
         if ( ! isset($authParams['redirect_uri']) && ! isset($_GET['redirect_uri'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'redirect_uri'), 0);
-
-        } else {
-
-            $params['redirect_uri'] = (isset($authParams['redirect_uri'])) ?
-                                                $authParams['redirect_uri'] :
-                                                $_GET['redirect_uri'];
-
         }
 
+        $params['redirect_uri'] = (isset($authParams['redirect_uri'])) ?
+                                        $authParams['redirect_uri'] :
+                                        $_GET['redirect_uri'];
+
         // Validate client ID and redirect URI
         $clientDetails = $this->_dbCall(
             'validateClient',
@@ -159,35 +181,31 @@ class Server
         );
 
         if ($clientDetails === false) {
-
             throw new ClientException($this->errors['invalid_client'], 8);
         }
 
+        $params['client_details'] = $clientDetails;
+
         // Response type
         if ( ! isset($authParams['response_type']) && ! isset($_GET['response_type'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'response_type'), 0);
+        }
 
-        } else {
+        $params['response_type'] = (isset($authParams['response_type'])) ?
+                                        $authParams['response_type'] :
+                                        $_GET['response_type'];
 
-            $params['response_type'] = (isset($authParams['response_type'])) ?
-                                                $authParams['response_type'] :
-                                                $_GET['response_type'];
-
-            // Ensure response type is one that is recognised
-            if ( ! in_array($params['response_type'], $this->_responseTypes)) {
-
-                throw new ClientException($this->errors['unsupported_response_type'], 3);
-
-            }
+        // Ensure response type is one that is recognised
+        if ( ! in_array($params['response_type'], $this->_responseTypes)) {
+            throw new ClientException($this->errors['unsupported_response_type'], 3);
         }
 
         // Get and validate scopes
         if (isset($authParams['scope']) || isset($_GET['scope'])) {
 
             $scopes = (isset($_GET['scope'])) ?
-                                $_GET['scope'] :
-                                $authParams['scope'];
+                            $_GET['scope'] :
+                            $authParams['scope'];
 
             $scopes = explode($this->_config['scope_delimeter'], $scopes);
 
@@ -202,7 +220,6 @@ class Server
             }
 
             if (count($scopes) === 0) {
-
                 throw new ClientException(sprintf($this->errors['invalid_request'], 'scope'), 0);
             }
 
@@ -214,11 +231,9 @@ class Server
                     'getScope',
                     $scope
                 );
-                
+
                 if ($scopeDetails === false) {
-
                     throw new ClientException(sprintf($this->errors['invalid_scope'], $scope), 4);
-
                 }
 
                 $params['scopes'][] = $scopeDetails;
@@ -231,7 +246,7 @@ class Server
 
     /**
      * Parse a new authorise request
-     * 
+     *
      * @param  string $type            The session owner's type
      * @param  string $typeId          The session owner's ID
      * @param  array  $authoriseParams The authorise request $_GET parameters
@@ -248,11 +263,11 @@ class Server
         );
 
         // Create the new auth code
-        $authCode = $this->newAuthCode(
-            $authoriseParams['client_id'], 
+        $authCode = $this->_newAuthCode(
+            $authoriseParams['client_id'],
             'user',
             $typeId,
-            $authoriseParams['redirect_uri'], 
+            $authoriseParams['redirect_uri'],
             $authoriseParams['scopes']
         );
 
@@ -261,19 +276,19 @@ class Server
 
     /**
      * Generate a unique code
-     * 
+     *
      * Generate a unique code for an authorisation code, or token
-     * 
+     *
      * @return string A unique code
      */
-    private function generateCode()
+    private function _generateCode()
     {
         return sha1(uniqid(microtime()));
     }
 
     /**
      * Create a new authorisation code
-     * 
+     *
      * @param  string $clientId    The client ID
      * @param  string $type        The type of the owner of the session
      * @param  string $typeId      The session owner's ID
@@ -282,184 +297,151 @@ class Server
      * @param  string $accessToken The access token (default = null)
      * @return string              An authorisation code
      */
-    private function newAuthCode($clientId, $type, $typeId, $redirectUri, $scopes = array(), $accessToken = null)
+    private function _newAuthCode($clientId, $type, $typeId, $redirectUri, $scopes = array())
     {
-        $authCode = $this->generateCode();
+        $authCode = $this->_generateCode();
 
-        // If an access token exists then update the existing session with the 
-        // new authorisation code otherwise create a new session
-        if ($accessToken !== null) {
+        // Delete any existing sessions just to be sure
+        $this->_dbCall('deleteSession', $clientId, $type, $typeId);
+
+        // Create a new session
+        $sessionId = $this->_dbCall(
+            'newSession',
+            $clientId,
+            $redirectUri,
+            $type,
+            $typeId,
+            $authCode,
+            null,
+            null,
+            'requested'
+        );
+
+        // Add the scopes
+        foreach ($scopes as $key => $scope) {
 
             $this->_dbCall(
-                'updateSession',
-                $clientId,
-                $type,
-                $typeId,
-                $authCode,
-                $accessToken,
-                'request'
+                'addSessionScope',
+                $sessionId,
+                $scope['scope']
             );
-        
-        } else {
-
-            // Delete any existing sessions just to be sure
-            $this->_dbCall('deleteSession', $clientId, $type, $typeId);
-               
-            // Create a new session     
-            $sessionId = $this->_dbCall(
-                'newSession',
-                $clientId,
-                $redirectUri,
-                $type,
-                $typeId,
-                $authCode,
-                null,
-                null,
-                'request'
-            );
-                        
-            // Add the scopes
-            foreach ($scopes as $key => $scope) {
-
-                $this->_dbCall(
-                    'addSessionScope',
-                    $sessionId,
-                    $scope['scope']
-                );
-
-            }
 
         }
-        
+
         return $authCode;
     }
 
     /**
      * Issue an access token
-     * 
+     *
      * @access public
-     * 
+     *
      * @param  array $authParams Optional array of parsed $_POST keys
-     * 
+     *
      * @return array             Authorise request parameters
      */
     public function issueAccessToken($authParams = null)
     {
-        $params = array();
-
         if ( ! isset($authParams['grant_type']) && ! isset($_POST['grant_type'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'grant_type'), 0);
+        }
 
-        } else {
+        $params['grant_type'] = (isset($authParams['grant_type'])) ?
+                                    $authParams['grant_type'] :
+                                    $_POST['grant_type'];
 
-            $params['grant_type'] = (isset($authParams['grant_type'])) ?
-                                                $authParams['grant_type'] :
-                                                $_POST['grant_type'];
-
-            // Ensure grant type is one that is recognised
-            if ( ! in_array($params['grant_type'], $this->_grantTypes)) {
-
-                throw new ClientException($this->errors['unsupported_grant_type'], 7);
-
-            }
+        // Ensure grant type is one that is recognised and is enabled
+        if ( ! in_array($params['grant_type'], array_keys($this->_grantTypes)) || $this->_grantTypes[$params['grant_type']] !== true) {
+            throw new ClientException(sprintf($this->errors['unsupported_grant_type'], $params['grant_type']), 7);
         }
 
         switch ($params['grant_type'])
         {
-            
             case 'authorization_code': // Authorization code grant
-                return $this->completeAuthCodeGrant($authParams, $params);
-                break;  
+                return $this->_completeAuthCodeGrant($authParams, $params);
+                break;
 
-            case 'refresh_token': // Refresh token
-            case 'password': // Resource owner password credentials grant
             case 'client_credentials': // Client credentials grant
+                return $this->_completeClientCredentialsGrant($authParams, $params);
+                break;
+
+            case 'password': // Resource owner password credentials grant
+                return $this->_completeUserCredentialsGrant($authParams, $params);
+                break;
+
+            case 'refresh_token': // Refresh token grant
+                return $this->_completeRefreshTokenGrant($authParams, $params);
+                break;
+
+            // @codeCoverageIgnoreStart
             default: // Unsupported
                 throw new ServerException($this->errors['server_error'] . 'Tried to process an unsuppported grant type.', 5);
                 break;
         }
+        // @codeCoverageIgnoreEnd
     }
 
     /**
      * Complete the authorisation code grant
-     * 
+     *
      * @access private
-     * 
+     *
      * @param  array $authParams Array of parsed $_POST keys
      * @param  array $params     Generated parameters from issueAccessToken()
-     * 
+     *
      * @return array             Authorise request parameters
      */
-    private function completeAuthCodeGrant($authParams = array(), $params = array())
+    private function _completeAuthCodeGrant($authParams = array(), $params = array())
     {
         // Client ID
         if ( ! isset($authParams['client_id']) && ! isset($_POST['client_id'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'client_id'), 0);
-
-        } else {
-
-            $params['client_id'] = (isset($authParams['client_id'])) ?
-                                            $authParams['client_id'] :
-                                            $_POST['client_id'];
-
         }
 
+        $params['client_id'] = (isset($authParams['client_id'])) ?
+                                    $authParams['client_id'] :
+                                    $_POST['client_id'];
+
         // Client secret
         if ( ! isset($authParams['client_secret']) && ! isset($_POST['client_secret'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'client_secret'), 0);
-
-        } else {
-
-            $params['client_secret'] = (isset($authParams['client_secret'])) ?
-                                                $authParams['client_secret'] :
-                                                $_POST['client_secret'];
-
         }
 
+        $params['client_secret'] = (isset($authParams['client_secret'])) ?
+                                        $authParams['client_secret'] :
+                                        $_POST['client_secret'];
+
         // Redirect URI
         if ( ! isset($authParams['redirect_uri']) && ! isset($_POST['redirect_uri'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'redirect_uri'), 0);
-
-        } else {
-
-            $params['redirect_uri'] = (isset($authParams['redirect_uri'])) ?
-                                                $authParams['redirect_uri'] :
-                                                $_POST['redirect_uri'];
-
         }
 
+        $params['redirect_uri'] = (isset($authParams['redirect_uri'])) ?
+                                        $authParams['redirect_uri'] :
+                                        $_POST['redirect_uri'];
+
         // Validate client ID and redirect URI
         $clientDetails = $this->_dbCall(
             'validateClient',
             $params['client_id'],
-            $params['client_secret'], 
+            $params['client_secret'],
             $params['redirect_uri']
         );
 
         if ($clientDetails === false) {
-
             throw new ClientException($this->errors['invalid_client'], 8);
         }
 
         // The authorization code
         if ( ! isset($authParams['code']) && ! isset($_POST['code'])) {
-
             throw new ClientException(sprintf($this->errors['invalid_request'], 'code'), 0);
-
-        } else {
-
-            $params['code'] = (isset($authParams['code'])) ?
-                                        $authParams['code'] :
-                                        $_POST['code'];
-
         }
 
-        // Verify the authorization code matches the client_id and the
-        //  request_uri
+        $params['code'] = (isset($authParams['code'])) ?
+                                    $authParams['code'] :
+                                    $_POST['code'];
+
+        // Verify the authorization code matches the client_id and the request_uri
         $session = $this->_dbCall(
             'validateAuthCode',
             $params['client_id'],
@@ -468,73 +450,325 @@ class Server
         );
 
         if ( ! $session) {
-
             throw new ClientException(sprintf($this->errors['invalid_grant'], 'code'), 9);
-        
-        } else {
-
-            // A session ID was returned so update it with an access token,
-            //  remove the authorisation code, change the stage to 'granted'
-
-            $accessToken = $this->generateCode();
-
-            $accessTokenExpires = ($this->_config['access_token_ttl'] === null) ?
-                                    null :
-                                    time() + $this->_config['access_token_ttl'];
-
-            $this->_dbCall(
-                'updateSession',
-                $session['id'],
-                null,
-                $accessToken,
-                $accessTokenExpires,
-                'granted'
-            );
-
-            // Update the session's scopes to reference the access token
-            $this->_dbCall(
-                'updateSessionScopeAccessToken',
-                $session['id'],
-                $accessToken
-            );
-
-            return array(
-                'access_token'  =>  $accessToken,
-                'token_type'    =>  'bearer',
-                'expires_in'    =>  $this->_config['access_token_ttl']
-            );
         }
+
+        // A session ID was returned so update it with an access token,
+        //  remove the authorisation code, change the stage to 'granted'
+
+        $accessToken = $this->_generateCode();
+        $refreshToken = ($this->_grantTypes['refresh_token']) ?
+                            $this->_generateCode() :
+                            null;
+
+        $accessTokenExpires = time() + $this->_config['access_token_ttl'];
+        $accessTokenExpiresIn = $this->_config['access_token_ttl'];
+
+        $this->_dbCall(
+            'updateSession',
+            $session['id'],
+            null,
+            $accessToken,
+            $refreshToken,
+            $accessTokenExpires,
+            'granted'
+        );
+
+        // Update the session's scopes to reference the access token
+        $this->_dbCall(
+            'updateSessionScopeAccessToken',
+            $session['id'],
+            $accessToken,
+            $refreshToken
+        );
+
+        $response = array(
+            'access_token'  =>  $accessToken,
+            'token_type'    =>  'bearer',
+            'expires'       =>  $accessTokenExpires,
+            'expires_in'    =>  $accessTokenExpiresIn
+        );
+
+        if ($this->_grantTypes['refresh_token']) {
+            $response['refresh_token'] = $refreshToken;
+        }
+
+        return $response;
+    }
+
+    /**
+     * Complete the resource owner password credentials grant
+     *
+     * @access private
+     * @param  array $authParams Array of parsed $_POST keys
+     * @param  array $params     Generated parameters from issueAccessToken()
+     * @return array             Authorise request parameters
+     */
+    private function _completeClientCredentialsGrant($authParams = array(), $params = array())
+    {
+        // Client ID
+        if ( ! isset($authParams['client_id']) && ! isset($_POST['client_id'])) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'client_id'), 0);
+            // @codeCoverageIgnoreEnd
+        }
+
+        $params['client_id'] = (isset($authParams['client_id'])) ?
+                                        $authParams['client_id'] :
+                                        $_POST['client_id'];
+
+        // Client secret
+        if ( ! isset($authParams['client_secret']) && ! isset($_POST['client_secret'])) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'client_secret'), 0);
+            // @codeCoverageIgnoreEnd
+        }
+
+        $params['client_secret'] = (isset($authParams['client_secret'])) ?
+                                            $authParams['client_secret'] :
+                                            $_POST['client_secret'];
+
+        // Validate client ID and client secret
+        $clientDetails = $this->_dbCall(
+            'validateClient',
+            $params['client_id'],
+            $params['client_secret'],
+            null
+        );
+
+        if ($clientDetails === false) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException($this->errors['invalid_client'], 8);
+            // @codeCoverageIgnoreEnd
+        }
+
+        // Generate an access token
+        $accessToken = $this->_generateCode();
+        $refreshToken = ($this->_grantTypes['refresh_token']) ?
+                            $this->_generateCode() :
+                            null;
+
+        $accessTokenExpires = time() + $this->_config['access_token_ttl'];
+        $accessTokenExpiresIn = $this->_config['access_token_ttl'];
+
+        // Delete any existing sessions just to be sure
+        $this->_dbCall('deleteSession', $params['client_id'], 'client', $params['client_id']);
+
+        // Create a new session
+        $this->_dbCall('newSession', $params['client_id'], null, 'client', $params['client_id'], null, $accessToken, $refreshToken, $accessTokenExpires, 'granted');
+
+        $response = array(
+            'access_token'  =>  $accessToken,
+            'token_type'    =>  'bearer',
+            'expires'       =>  $accessTokenExpires,
+            'expires_in'    =>  $accessTokenExpiresIn
+        );
+
+        if ($this->_grantTypes['refresh_token']) {
+            $response['refresh_token'] = $refreshToken;
+        }
+
+        return $response;
+    }
+
+    /**
+     * Complete the resource owner password credentials grant
+     *
+     * @access private
+     * @param  array $authParams Array of parsed $_POST keys
+     * @param  array $params     Generated parameters from issueAccessToken()
+     * @return array             Authorise request parameters
+     */
+    private function _completeUserCredentialsGrant($authParams = array(), $params = array())
+    {
+        // Client ID
+        if ( ! isset($authParams['client_id']) && ! isset($_POST['client_id'])) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'client_id'), 0);
+            // @codeCoverageIgnoreEnd
+        }
+
+        $params['client_id'] = (isset($authParams['client_id'])) ?
+                                        $authParams['client_id'] :
+                                        $_POST['client_id'];
+
+        // Client secret
+        if ( ! isset($authParams['client_secret']) && ! isset($_POST['client_secret'])) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'client_secret'), 0);
+            // @codeCoverageIgnoreEnd
+        }
+
+        $params['client_secret'] = (isset($authParams['client_secret'])) ?
+                                            $authParams['client_secret'] :
+                                            $_POST['client_secret'];
+
+        // Validate client ID and client secret
+        $clientDetails = $this->_dbCall(
+            'validateClient',
+            $params['client_id'],
+            $params['client_secret'],
+            null
+        );
+
+        if ($clientDetails === false) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException($this->errors['invalid_client'], 8);
+            // @codeCoverageIgnoreEnd
+        }
+
+        // User's username
+        if ( ! isset($authParams['username']) && ! isset($_POST['username'])) {
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'username'), 0);
+        }
+
+        $params['username'] = (isset($authParams['username'])) ?
+                                            $authParams['username'] :
+                                            $_POST['username'];
+
+        // User's password
+        if ( ! isset($authParams['password']) && ! isset($_POST['password'])) {
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'password'), 0);
+        }
+
+        $params['password'] = (isset($authParams['password'])) ?
+                                            $authParams['password'] :
+                                            $_POST['password'];
+
+        // Check if user's username and password are correct
+        $userId = call_user_func($this->_grantTypeCallbacks['password'], $params['username'], $params['password']);
+
+        if ($userId === false) {
+            throw new \Oauth2\Authentication\ClientException($this->errors['invalid_credentials'], 0);
+        }
+
+        // Generate an access token
+        $accessToken = $this->_generateCode();
+        $refreshToken = ($this->_grantTypes['refresh_token']) ?
+                            $this->_generateCode() :
+                            null;
+
+        $accessTokenExpires = time() + $this->_config['access_token_ttl'];
+        $accessTokenExpiresIn = $this->_config['access_token_ttl'];
+
+        // Delete any existing sessions just to be sure
+        $this->_dbCall('deleteSession', $params['client_id'], 'user', $userId);
+
+        // Create a new session
+        $this->_dbCall('newSession', $params['client_id'], null, 'user', $userId, null, $accessToken, $refreshToken, $accessTokenExpires, 'granted');
+
+        $response = array(
+            'access_token'  =>  $accessToken,
+            'token_type'    =>  'bearer',
+            'expires'       =>  $accessTokenExpires,
+            'expires_in'    =>  $accessTokenExpiresIn
+        );
+
+        if ($this->_grantTypes['refresh_token']) {
+            $response['refresh_token'] = $refreshToken;
+        }
+
+        return $response;
+    }
+
+    /**
+     * Complete the refresh token grant
+     *
+     * @access private
+     * @param  array $authParams Array of parsed $_POST keys
+     * @param  array $params     Generated parameters from issueAccessToken()
+     * @return array             Authorise request parameters
+     */
+    private function _completeRefreshTokenGrant($authParams = array(), $params = array())
+    {
+        // Client ID
+        if ( ! isset($authParams['client_id']) && ! isset($_POST['client_id'])) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'client_id'), 0);
+            // @codeCoverageIgnoreEnd
+        }
+
+        $params['client_id'] = (isset($authParams['client_id'])) ?
+                                        $authParams['client_id'] :
+                                        $_POST['client_id'];
+
+        // Client secret
+        if ( ! isset($authParams['client_secret']) && ! isset($_POST['client_secret'])) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'client_secret'), 0);
+            // @codeCoverageIgnoreEnd
+        }
+
+        $params['client_secret'] = (isset($authParams['client_secret'])) ?
+                                            $authParams['client_secret'] :
+                                            $_POST['client_secret'];
+
+        // Validate client ID and client secret
+        $clientDetails = $this->_dbCall(
+            'validateClient',
+            $params['client_id'],
+            $params['client_secret'],
+            null
+        );
+
+        if ($clientDetails === false) {
+            // @codeCoverageIgnoreStart
+            throw new ClientException($this->errors['invalid_client'], 8);
+            // @codeCoverageIgnoreEnd
+        }
+
+        // Refresh token
+        if ( ! isset($authParams['refresh_token']) && ! isset($_POST['refresh_token'])) {
+            throw new ClientException(sprintf($this->errors['invalid_request'], 'refresh_token'), 0);
+        }
+
+        $params['refresh_token'] = (isset($authParams['refresh_token'])) ?
+                                        $authParams['refresh_token'] :
+                                        $_POST['refresh_token'];
+
+        // Validate refresh token
+        $sessionId = $this->_dbCall('validateRefreshToken', $params['refresh_token'], $params['client_id']);
+
+        if ($sessionId === false) {
+            throw new \Oauth2\Authentication\ClientException($this->errors['invalid_refresh'], 0);
+        }
+
+        // Generate new tokens
+        $accessToken = $this->_generateCode();
+        $refreshToken = $this->_generateCode();
+
+        $accessTokenExpires = time() + $this->_config['access_token_ttl'];
+        $accessTokenExpiresIn = $this->_config['access_token_ttl'];
+
+        // Update the tokens
+        $this->_dbCall('updateRefreshToken', $sessionId, $accessToken, $refreshToken, $accessTokenExpires);
+
+        return array(
+            'access_token'  =>  $accessToken,
+            'refresh_token' =>  $refreshToken,
+            'token_type'    =>  'bearer',
+            'expires'       =>  $accessTokenExpires,
+            'expires_in'    =>  $accessTokenExpiresIn
+        );
     }
 
     /**
      * Generates the redirect uri with appended params
-     * 
+     *
      * @param  string $redirectUri     The redirect URI
      * @param  array  $params          The parameters to be appended to the URL
      * @param  string $query_delimeter The query string delimiter (default: ?)
-     * 
+     *
      * @return string                  The updated redirect URI
      */
     public function redirectUri($redirectUri, $params = array(), $queryDelimeter = '?')
     {
-      
-        if (strstr($redirectUri, $queryDelimeter)) {
-
-            $redirectUri = $redirectUri . '&' . http_build_query($params);
-
-        } else {
-
-            $redirectUri = $redirectUri . $queryDelimeter . http_build_query($params);
-
-        }
-        
-        return $redirectUri;
-
+        return (strstr($redirectUri, $queryDelimeter)) ? $redirectUri . '&' . http_build_query($params) : $redirectUri . $queryDelimeter . http_build_query($params);
     }
 
     /**
      * Call database methods from the abstractor
-     * 
+     *
      * @return mixed The query result
      */
     private function _dbCall()

src/Oauth2/Client/Provider.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace OAuth2\Client;
+
+class Provider
+{
+	private function __constuct() {}
+
+	public static function factory($name, array $options = null)
+	{
+		if ( ! class_exists($name)) {
+
+			throw new OAuth2\Client\Exception('There is no identity provider called: '.$name);
+
+		}
+
+		return new $name($options);
+	}
+}

src/Oauth2/Resource/Database.php

@@ -6,17 +6,17 @@ interface Database
 {
     /**
      * Validate an access token and return the session details.
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
      * SELECT id, owner_type, owner_id FROM oauth_sessions WHERE access_token =
      *  $accessToken AND stage = 'granted' AND
      *  access_token_expires > UNIX_TIMESTAMP(now())
      * </code>
-     * 
+     *
      * Response:
-     * 
+     *
      * <code>
      * Array
      * (
@@ -25,7 +25,7 @@ interface Database
      *     [owner_id] => (string) The session owner's ID
      * )
      * </code>
-     * 
+     *
      * @param  string     $accessToken The access token
      * @return array|bool              Return an array on success or false on failure
      */
@@ -33,16 +33,16 @@ interface Database
 
     /**
      * Returns the scopes that the session is authorised with.
-     * 
+     *
      * Database query:
-     * 
+     *
      * <code>
-     * SELECT scope FROM oauth_session_scopes WHERE access_token =
-     *  '291dca1c74900f5f252de351e0105aa3fc91b90b'
+     * SELECT scope FROM oauth_session_scopes WHERE session_id =
+     *  $sessionId
      * </code>
-     * 
+     *
      * Response:
-     * 
+     *
      * <code>
      * Array
      * (
@@ -51,7 +51,7 @@ interface Database
      *      ...
      * )
      * </code>
-     * 
+     *
      * @param  int   $sessionId The session ID
      * @return array            A list of scopes
      */

src/Oauth2/Resource/Server.php

@@ -75,7 +75,7 @@ class Server
     public function __construct($options = null)
     {
         if ($options !== null) {
-            $this->config = array_merge($this->config, $options);
+            $this->_config = array_merge($this->_config, $options);
         }
     }
 

tests/Bootstrap.php

@@ -0,0 +1,6 @@
+<?php
+
+if ( ! @include_once __DIR__ . '/../vendor/autoload.php')
+{
+    exit("You must set up the project dependencies, run the following commands:\n> wget http://getcomposer.org/composer.phar\n> php composer.phar install\n");
+}

tests/authentication/database_mock.php

@@ -4,188 +4,165 @@ use Oauth2\Authentication\Database;
 
 class OAuthdb implements Database
 {
-	private $sessions = array();
-	private $sessions_client_type_id = array();
-	private $sessions_code = array();
-	private $session_scopes = array();
+    private $sessions = array();
+    private $sessions_client_type_id = array();
+    private $sessions_code = array();
+    private $session_scopes = array();
 
-	private $clients = array(0 => array(
-		'client_id'	=>	'test',
-		'client_secret'	=>	'test',
-		'redirect_uri'	=>	'http://example.com/test',
-		'name'	=>	'Test Client'
-	));
+    private $clients = array(0 => array(
+        'client_id' =>  'test',
+        'client_secret' =>  'test',
+        'redirect_uri'  =>  'http://example.com/test',
+        'name'  =>  'Test Client'
+    ));
 
-	private $scopes = array('test' => array(
-		'id'	=>	1,
-		'scope'	=>	'test',
-		'name'	=>	'test',
-		'description'	=>	'test'
-	));
+    private $scopes = array('test' => array(
+        'id'    =>  1,
+        'scope' =>  'test',
+        'name'  =>  'test',
+        'description'   =>  'test'
+    ));
 
-	public function validateClient(
-        $clientId,
-        $clientSecret = null,
-        $redirectUri = null
-    )
+    public function validateClient($clientId, $clientSecret = null, $redirectUri = null)
     {
-    	if ($clientId !== $this->clients[0]['client_id'])
-    	{
-    		return false;
-    	}
+        if ($clientId !== $this->clients[0]['client_id']) {
+            return false;
+        }
 
-    	if ($clientSecret !== null && $clientSecret !== $this->clients[0]['client_secret'])
-    	{
-    		return false;
-    	}
+        if ($clientSecret !== null && $clientSecret !== $this->clients[0]['client_secret']) {
+            return false;
+        }
 
-    	if ($redirectUri !== null && $redirectUri !== $this->clients[0]['redirect_uri'])
-    	{
-    		return false;
-    	}
+        if ($redirectUri !== null && $redirectUri !== $this->clients[0]['redirect_uri']) {
+            return false;
+        }
 
-    	return $this->clients[0];
+        return $this->clients[0];
     }
 
-    public function newSession(
-        $clientId,
-        $redirectUri,
-        $type = 'user',
-        $typeId = null,
-        $authCode = null,
-        $accessToken = null,
-        $accessTokenExpire = null,
-        $stage = 'requested'
-    )
+    public function newSession($clientId, $redirectUri, $type = 'user', $typeId = null, $authCode = null, $accessToken = null, $refreshToken = null, $accessTokenExpire = null, $stage = 'requested')
     {
-    	$id = count($this->sessions);
+        $id = count($this->sessions);
 
-    	$this->sessions[$id] = array(
-    		'id'	=>	$id,
-    		'client_id'	=>	$clientId,
-    		'redirect_uri'	=>	$redirectUri,
-    		'owner_type'	=>	$type,
-    		'owner_id'	=>	$typeId,
-    		'auth_code'	=>	$authCode,
-    		'access_token'	=>	$accessToken,
-    		'access_token_expire'	=>	$accessTokenExpire,
-    		'stage'	=>	$stage
-    	);
+        $this->sessions[$id] = array(
+            'id'    =>  $id,
+            'client_id' =>  $clientId,
+            'redirect_uri'  =>  $redirectUri,
+            'owner_type'    =>  $type,
+            'owner_id'  =>  $typeId,
+            'auth_code' =>  $authCode,
+            'access_token'  =>  $accessToken,
+            'refresh_token' =>  $refreshToken,
+            'access_token_expire'   =>  $accessTokenExpire,
+            'stage' =>  $stage
+        );
 
-    	$this->sessions_client_type_id[$clientId . ':' . $type . ':' . $typeId] = $id;
-    	$this->sessions_code[$clientId . ':' . $redirectUri . ':' . $authCode] = $id;
+        $this->sessions_client_type_id[$clientId . ':' . $type . ':' . $typeId] = $id;
+        $this->sessions_code[$clientId . ':' . $redirectUri . ':' . $authCode] = $id;
 
-    	return true;
+        return $id;
     }
 
-    public function updateSession(
-        $sessionId,
-        $authCode = null,
-        $accessToken = null,
-        $accessTokenExpire = null,
-        $stage = 'requested'
-    )
+    public function updateSession($sessionId, $authCode = null, $accessToken = null, $refreshToken = null, $accessTokenExpire = null, $stage = 'requested')
     {
-    	$this->sessions[$sessionId]['auth_code'] = $authCode;
-    	$this->sessions[$sessionId]['access_token'] = $accessToken;
-    	$this->sessions[$sessionId]['access_token_expire'] = $accessTokenExpire;
-    	$this->sessions[$sessionId]['stage'] = $stage;
+        $this->sessions[$sessionId]['auth_code'] = $authCode;
+        $this->sessions[$sessionId]['access_token'] = $accessToken;
+        $this->sessions[$sessionId]['refresh_token'] = $refreshToken;
+        $this->sessions[$sessionId]['access_token_expire'] = $accessTokenExpire;
+        $this->sessions[$sessionId]['stage'] = $stage;
 
-    	return true;
+        return true;
     }
 
-    public function deleteSession(
-        $clientId,
-        $type,
-        $typeId
-    )
+    public function deleteSession($clientId, $type, $typeId)
     {
-    	$key = $clientId . ':' . $type . ':' . $typeId;
-    	if (isset($this->sessions_client_type_id[$key]))
-    	{
-    		unset($this->sessions[$this->sessions_client_type_id[$key]]);
-    	}
-    	return true;
+        $key = $clientId . ':' . $type . ':' . $typeId;
+        if (isset($this->sessions_client_type_id[$key])) {
+            unset($this->sessions[$this->sessions_client_type_id[$key]]);
+        }
+        return true;
     }
 
-    public function validateAuthCode(
-        $clientId,
-        $redirectUri,
-        $authCode
-    )
+    public function refreshToken($currentRefreshToken, $newAccessToken, $newRefreshToken, $accessTokenExpires)
     {
-    	$key = $clientId . ':' . $redirectUri . ':' . $authCode;
-
-    	if (isset($this->sessions_code[$key]))
-    	{
-    		return $this->sessions[$this->sessions_code[$key]];
-    	}
-
-    	return false;
+        die('not implemented refreshToken');
     }
 
-    public function hasSession(
-        $type,
-        $typeId,
-        $clientId
-    )
+    public function validateAuthCode($clientId, $redirectUri, $authCode)
     {
-    	die('not implemented hasSession');
+        $key = $clientId . ':' . $redirectUri . ':' . $authCode;
+
+        if (isset($this->sessions_code[$key])) {
+            return $this->sessions[$this->sessions_code[$key]];
+        }
+
+        return false;
+    }
+
+    public function hasSession($type, $typeId, $clientId)
+    {
+        die('not implemented hasSession');
     }
 
     public function getAccessToken($sessionId)
     {
-    	die('not implemented getAccessToken');
+        die('not implemented getAccessToken');
     }
 
     public function removeAuthCode($sessionId)
     {
-    	die('not implemented removeAuthCode');
+        die('not implemented removeAuthCode');
     }
 
-    public function setAccessToken(
-        $sessionId,
-        $accessToken
-    )
+    public function setAccessToken($sessionId, $accessToken)
     {
-    	die('not implemented setAccessToken');
+        die('not implemented setAccessToken');
     }
 
-    public function addSessionScope(
-        $sessionId,
-        $scope
-    )
+    public function addSessionScope($sessionId, $scope)
     {
-    	if ( ! isset($this->session_scopes[$sessionId]))
-    	{
-    		$this->session_scopes[$sessionId] = array();
-    	}
+        if ( ! isset($this->session_scopes[$sessionId])) {
+            $this->session_scopes[$sessionId] = array();
+        }
 
-    	$this->session_scopes[$sessionId][] = $scope;
+        $this->session_scopes[$sessionId][] = $scope;
 
-    	return true;
+        return true;
     }
 
     public function getScope($scope)
     {
-    	if ( ! isset($this->scopes[$scope]))
-    	{
-    		return false;
-    	}
+        if ( ! isset($this->scopes[$scope])) {
+            return false;
+        }
 
-    	return $this->scopes[$scope];
+        return $this->scopes[$scope];
     }
 
-    public function updateSessionScopeAccessToken(
-        $sessionId,
-        $accessToken
-    )
+    public function updateSessionScopeAccessToken($sessionId, $accessToken)
     {
-    	return true;
+        return true;
     }
 
     public function accessTokenScopes($accessToken)
     {
-    	die('not implemented accessTokenScopes');
+        die('not implemented accessTokenScopes');
+    }
+
+    public function validateRefreshToken($refreshToken, $clientId)
+    {
+        if ($refreshToken !== $this->sessions[0]['refresh_token'])
+        {
+            return false;
+        }
+
+        return true;
+    }
+
+    public function updateRefreshToken($sessionId, $newAccessToken, $newRefreshToken, $accessTokenExpires)
+    {
+        $this->sessions[$sessionId]['access_token'] = $newAccessToken;
+        $this->sessions[$sessionId]['refresh_token'] = $newRefreshToken;
+        $this->sessions[$sessionId]['access_token_expire'] = $accessTokenExpires;
     }
 }

tests/resource/server_test.php

@@ -2,120 +2,120 @@
 
 class Resource_Server_test extends PHPUnit_Framework_TestCase {
 
-	function setUp()
-	{
-		require_once('database_mock.php');
-		$this->server = new Oauth2\Resource\Server();
-		$this->db = new ResourceDB();
+    function setUp()
+    {
+        require_once('database_mock.php');
+        $this->server = new Oauth2\Resource\Server();
+        $this->db = new ResourceDB();
 
-		$this->assertInstanceOf('Oauth2\Resource\Database', $this->db);
-		$this->server->registerDbAbstractor($this->db);
-	}
+        $this->assertInstanceOf('Oauth2\Resource\Database', $this->db);
+        $this->server->registerDbAbstractor($this->db);
+    }
 
-	function test_init_POST()
-	{
-		$_SERVER['REQUEST_METHOD'] = 'POST';
-		$_POST['oauth_token'] = 'test12345';
+    function test_init_POST()
+    {
+        $_SERVER['REQUEST_METHOD'] = 'POST';
+        $_POST['oauth_token'] = 'test12345';
 
-		$this->server->init();
+        $this->server->init();
 
-		$reflector = new ReflectionClass($this->server);
+        $reflector = new ReflectionClass($this->server);
 
-		$_accessToken = $reflector->getProperty('_accessToken');
-		$_accessToken->setAccessible(true);
+        $_accessToken = $reflector->getProperty('_accessToken');
+        $_accessToken->setAccessible(true);
 
-		$_type = $reflector->getProperty('_type');
-		$_type->setAccessible(true);
+        $_type = $reflector->getProperty('_type');
+        $_type->setAccessible(true);
 
-		$_typeId = $reflector->getProperty('_typeId');
-		$_typeId->setAccessible(true);
+        $_typeId = $reflector->getProperty('_typeId');
+        $_typeId->setAccessible(true);
 
-		$_scopes = $reflector->getProperty('_scopes');
-		$_scopes->setAccessible(true);
+        $_scopes = $reflector->getProperty('_scopes');
+        $_scopes->setAccessible(true);
 
-		$this->assertEquals($_accessToken->getValue($this->server), $_POST['oauth_token']);
-		$this->assertEquals($_type->getValue($this->server), 'user');
-		$this->assertEquals($_typeId->getValue($this->server), 123);
-		$this->assertEquals($_scopes->getValue($this->server), array('foo', 'bar'));
-	}
+        $this->assertEquals($_accessToken->getValue($this->server), $_POST['oauth_token']);
+        $this->assertEquals($_type->getValue($this->server), 'user');
+        $this->assertEquals($_typeId->getValue($this->server), 123);
+        $this->assertEquals($_scopes->getValue($this->server), array('foo', 'bar'));
+    }
 
-	function test_init_GET()
-	{
-		$_GET['oauth_token'] = 'test12345';
+    function test_init_GET()
+    {
+        $_GET['oauth_token'] = 'test12345';
 
-		$this->server->init();
+        $this->server->init();
 
-		$reflector = new ReflectionClass($this->server);
+        $reflector = new ReflectionClass($this->server);
 
-		$_accessToken = $reflector->getProperty('_accessToken');
-		$_accessToken->setAccessible(true);
+        $_accessToken = $reflector->getProperty('_accessToken');
+        $_accessToken->setAccessible(true);
 
-		$_type = $reflector->getProperty('_type');
-		$_type->setAccessible(true);
+        $_type = $reflector->getProperty('_type');
+        $_type->setAccessible(true);
 
-		$_typeId = $reflector->getProperty('_typeId');
-		$_typeId->setAccessible(true);
+        $_typeId = $reflector->getProperty('_typeId');
+        $_typeId->setAccessible(true);
 
-		$_scopes = $reflector->getProperty('_scopes');
-		$_scopes->setAccessible(true);
+        $_scopes = $reflector->getProperty('_scopes');
+        $_scopes->setAccessible(true);
 
-		$this->assertEquals($_accessToken->getValue($this->server), $_GET['oauth_token']);
-		$this->assertEquals($_type->getValue($this->server), 'user');
-		$this->assertEquals($_typeId->getValue($this->server), 123);
-		$this->assertEquals($_scopes->getValue($this->server), array('foo', 'bar'));
-	}
+        $this->assertEquals($_accessToken->getValue($this->server), $_GET['oauth_token']);
+        $this->assertEquals($_type->getValue($this->server), 'user');
+        $this->assertEquals($_typeId->getValue($this->server), 123);
+        $this->assertEquals($_scopes->getValue($this->server), array('foo', 'bar'));
+    }
 
-	function test_init_header()
-	{
-		// Test with authorisation header
-		$this->markTestIncomplete('Authorisation header test has not been implemented yet.');
-	}
+    function test_init_header()
+    {
+        // Test with authorisation header
+        $this->markTestIncomplete('Authorisation header test has not been implemented yet.');
+    }
 
-	/**
-	 * @expectedException        \Oauth2\Resource\ClientException
-	 * @expectedExceptionMessage An access token was not presented with the request
-	 */
-	function test_init_missingToken()
-	{
-		$this->server->init();
-	}
+    /**
+     * @expectedException        \Oauth2\Resource\ClientException
+     * @expectedExceptionMessage An access token was not presented with the request
+     */
+    function test_init_missingToken()
+    {
+        $this->server->init();
+    }
 
-	/**
-	 * @expectedException        \Oauth2\Resource\ClientException
-	 * @expectedExceptionMessage The access token is not registered with the resource server
-	 */
-	function test_init_wrongToken()
-	{
-		$_POST['oauth_token'] = 'blah';
-		$_SERVER['REQUEST_METHOD'] = 'POST';
+    /**
+     * @expectedException        \Oauth2\Resource\ClientException
+     * @expectedExceptionMessage The access token is not registered with the resource server
+     */
+    function test_init_wrongToken()
+    {
+        $_POST['oauth_token'] = 'blah';
+        $_SERVER['REQUEST_METHOD'] = 'POST';
 
-		$this->server->init();
-	}
+        $this->server->init();
+    }
 
-	function test_hasScope()
-	{
-		$_POST['oauth_token'] = 'test12345';
-		$_SERVER['REQUEST_METHOD'] = 'POST';
+    function test_hasScope()
+    {
+        $_POST['oauth_token'] = 'test12345';
+        $_SERVER['REQUEST_METHOD'] = 'POST';
 
-		$this->server->init();
+        $this->server->init();
 
-		$this->assertEquals(true, $this->server->hasScope('foo'));
-		$this->assertEquals(true, $this->server->hasScope('bar'));
-		$this->assertEquals(true, $this->server->hasScope(array('foo', 'bar')));
+        $this->assertEquals(true, $this->server->hasScope('foo'));
+        $this->assertEquals(true, $this->server->hasScope('bar'));
+        $this->assertEquals(true, $this->server->hasScope(array('foo', 'bar')));
 
-		$this->assertEquals(false, $this->server->hasScope('foobar'));
-		$this->assertEquals(false, $this->server->hasScope(array('foobar')));
-	}
+        $this->assertEquals(false, $this->server->hasScope('foobar'));
+        $this->assertEquals(false, $this->server->hasScope(array('foobar')));
+    }
 
-	function test___call()
-	{
-		$_POST['oauth_token'] = 'test12345';
-		$_SERVER['REQUEST_METHOD'] = 'POST';
+    function test___call()
+    {
+        $_POST['oauth_token'] = 'test12345';
+        $_SERVER['REQUEST_METHOD'] = 'POST';
 
-		$this->server->init();
+        $this->server->init();
 
-		$this->assertEquals(123, $this->server->isUser());
-		$this->assertEquals(false, $this->server->isMachine());
-	}
+        $this->assertEquals(123, $this->server->isUser());
+        $this->assertEquals(false, $this->server->isMachine());
+    }
 
 }