Merge branch 'release/3.0'

# Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.
Version bump
2025-05-31 14:12:07 +05:30 · 2013-12-02 18:44:48 +00:00 · 2013-12-02 18:44:08 +00:00 · 2013-12-02 18:43:42 +00:00 · 2013-12-02 18:42:54 +00:00 · 2013-11-29 12:35:29 +00:00
35 changed files with 844 additions and 671 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,5 @@
 tests/ export-ignore
 phpunit.xml export-ignore
 build.xml export-ignore
-test export-ignore
+test export-ignore
+.travis.yml export-ignore
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,5 @@
 /vendor
 /composer.lock
-/build/logs
-/build/coverage
+/tests/coverage
 /docs
 /testing
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,6 +3,7 @@ language: php
 php:
  - 5.3
  - 5.4
+  - 5.5

-before_script: composer install --dev
-script: phpunit
+before_script: composer install --prefer-source
+script: phpunit --configuration phpunit.xml.dist
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,42 @@
 # Changelog

+## 3.0 (released 2013-12-02)
+
+* Fixed spelling of Implicit grant class (Issue #84)
+* Travis CI now tests for PHP 5.5
+* Fixes for checking headers for resource server (Issues #79 and #)
+* The word "bearer" now has a capital "B" in JSON output to match OAuth 2.0 spec
+* All grants no longer remove old sessions by default
+* All grants now support custom access token TTL (Issue #92)
+* All methods which didn't before return a value now return `$this` to support method chaining
+* Removed the build in DB providers - these will be put in their own repos to remove baggage in the main repository
+* Removed support for PHP 5.3 because this library now uses traits and will use other modern PHP features going forward
+* Moved some grant related functions into a trait to reduce duplicate code
+
+## 2.1.1 (released 2013-06-02)
+
+* Added conditional `isValid()` flag to check for Authorization header only (thanks @alexmcroberts)
+* Fixed semantic meaning of `requireScopeParam()` and `requireStateParam()` by changing their default value to true
+* Updated some duff docblocks
+* Corrected array key call in Resource.php (Issue #63)
+
+## 2.1 (released 2013-05-10)
+
+* Moved zetacomponents/database to "suggest" in composer.json. If you rely on this feature you now need to include " zetacomponents/database" into "require" key in your own composer.json. (Issue #51)
+* New method in Refresh grant called `rotateRefreshTokens()`. Pass in `true` to issue a new refresh token each time an access token is refreshed. This parameter needs to be set to true in order to request reduced scopes with the new access token. (Issue #47)
+* Rename `key` column in oauth_scopes table to `scope` as `key` is a reserved SQL word. (Issue #45)
+* The `scope` parameter is no longer required by default as per the RFC. (Issue #43)
+* You can now set multiple default scopes by passing an array into `setDefaultScope()`. (Issue #42)
+* The password and client credentials grants now allow for multiple sessions per user. (Issue #32)
+* Scopes associated to authorization codes are not held in their own table (Issue #44)
+* Database schema updates.
+
+## 2.0.5 (released 2013-05-09)
+
+* Fixed `oauth_session_token_scopes` table primary key
+* Removed `DEFAULT ''` that has slipped into some tables
+* Fixed docblock for `SessionInterface::associateRefreshToken()`
+
 ## 2.0.4 (released 2013-05-09)

 * Renamed primary key in oauth_client_endpoints table
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
-# The League of Extraordinary Packages presents: PHP OAuth 2.0 Server
+# PHP OAuth 2.0 Server

-The goal of this project is to develop a standards compliant [OAuth 2.0](http://tools.ietf.org/wg/oauth/draft-ietf-oauth-v2/) authorization server and resource server.
+A standards compliant [OAuth 2.0](http://tools.ietf.org/wg/oauth/draft-ietf-oauth-v2/) authorization server and resource server written in PHP.

 ## Package Installation

@@ -14,6 +14,17 @@ The framework is provided as a Composer package which can be installed by adding
 }
 ```

+#### Master branch
+
+Latest stable version - [![Latest Stable Version](https://poser.pugx.org/league/oauth2-server/v/stable.png)](https://packagist.org/packages/league/oauth2-server)
+Code coverage - [![Coverage Status](https://coveralls.io/repos/php-loep/oauth2-server/badge.png?branch=master)](https://coveralls.io/r/php-loep/oauth2-server?branch=master)
+Downloads - [![Total Downloads](https://poser.pugx.org/league/oauth2-server/downloads.png)](https://packagist.org/packages/league/oauth2-server)
+
+#### Develop branch
+
+Latest unstable version - [![Latest Unstable Version](https://poser.pugx.org/league/oauth2-server/v/unstable.png)](https://packagist.org/packages/league/oauth2-server)
+Code coverage - [![Coverage Status](https://coveralls.io/repos/php-loep/oauth2-server/badge.png?branch=develop)](https://coveralls.io/r/php-loep/oauth2-server?branch=develop)
+
 ---

 The library features 100% unit test code coverage. To run the tests yourself run `phpunit` from the project root.
@@ -47,21 +58,36 @@ If you are using MySQL and want to very quickly implement the library then all o

 The wiki has lots of guides on how to use this library, check it out - [https://github.com/php-loep/oauth2-server/wiki](https://github.com/php-loep/oauth2-server/wiki).

-A tutorial on how to use the authorization server can be found on the wiki - (https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server)[https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server].
+A simple tutorial on how to use the authorization server can be found at [https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server](https://github.com/php-loep/oauth2-server/wiki/Developing-an-OAuth-2.0-authorization-server).

-A tutorial on how to use the resource server to secure an API server can be found at [https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0](https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0).
+A simple tutorial on how to use the resource server to secure an API server can be found at [https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0](https://github.com/php-loep/oauth2-server/wiki/Securing-your-API-with-OAuth-2.0).

-## Future Goals
+## Changelog

-### Authorization Server
+[See the project releases page](https://github.com/php-loep/oauth2-server/releases)

-* Support for [JSON web tokens](http://tools.ietf.org/wg/oauth/draft-ietf-oauth-json-web-token/).
-* Support for [SAML assertions](http://tools.ietf.org/wg/oauth/draft-ietf-oauth-saml2-bearer/).
+## Contributing

---
+Please see [CONTRIBUTING](https://github.com/php-loep/oauth2-server/blob/master/CONTRIBUTING.md) for details.

-The initial code was developed as part of the [Linkey](http://linkey.blogs.lincoln.ac.uk) project which was funded by [JISC](http://jisc.ac.uk) under the Access and Identity Management programme.
+## Support

-This code is principally developed and maintained by [@alexbilbie](https://twitter.com/alexbilbie).
+Bugs and feature request are tracked on [GitHub](https://github.com/php-loep/oauth2-server/issues)

-A list of contributors can be found at [https://github.com/php-loep/oauth2-server/contributors](https://github.com/php-loep/oauth2-server/contributors).
+## License
+
+This package is released under the MIT License. See the bundled [LICENSE](https://github.com/php-loep/oauth2-server/blob/master/LICENSE) file for details.
+
+## Credits
+
+This code is principally developed and maintained by [Alex Bilbie](https://twitter.com/alexbilbie).
+
+Special thanks to:
+
+* [Dan Horrigan](https://github.com/dandoescode)
+* [Nick Jackson](https://github.com/jacksonj04)
+* [Michael Gooden](https://github.com/MichaelGooden)
+* [Phil Sturgeon](https://github.com/philsturgeon)
+* [and all the other contributors](https://github.com/php-loep/oauth2-server/contributors)
+
+The initial code was developed as part of the [Linkey](http://linkey.blogs.lincoln.ac.uk) project which was funded by [JISC](http://jisc.ac.uk) under the Access and Identity Management programme.
--- a/build.xml
+++ b/build.xml
@@ -1,142 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project name="PHP OAuth 2.0 Server" default="build">
-
-	<target name="build" depends="prepare,lint,phploc,pdepend,phpmd-ci,phpcs-ci,phpcpd,composer,phpunit,phpdox,phpcb"/>
-	
-	<target name="build-parallel" depends="prepare,lint,tools-parallel,phpcb"/>
-	
-	<target name="minimal" depends="prepare,lint,phploc,pdepend,phpcpd,composer,phpunit,phpdox,phpcb" />
-	
-	<target name="tools-parallel" description="Run tools in parallel">
-		<parallel threadCount="2">
-			<sequential>
-				<antcall target="pdepend"/>
-				<antcall target="phpmd-ci"/>
-			</sequential>
-			<antcall target="phpcpd"/>
-			<antcall target="phpcs-ci"/>
-			<antcall target="phploc"/>
-			<antcall target="phpdox"/>
-		</parallel>
-	</target>
-	
-	<target name="clean" description="Cleanup build artifacts">
-		<delete dir="${basedir}/build/api"/>
-		<delete dir="${basedir}/build/code-browser"/>
-		<delete dir="${basedir}/build/coverage"/>
-		<delete dir="${basedir}/build/logs"/>
-		<delete dir="${basedir}/build/pdepend"/>
-	</target>
-	
-	<target name="prepare" depends="clean" description="Prepare for build">
-		<mkdir dir="${basedir}/build/api"/>
-		<mkdir dir="${basedir}/build/code-browser"/>
-		<mkdir dir="${basedir}/build/coverage"/>
-		<mkdir dir="${basedir}/build/logs"/>
-		<mkdir dir="${basedir}/build/pdepend"/>
-		<mkdir dir="${basedir}/build/phpdox"/>
-	</target>
-	
-	<target name="lint">
-		<apply executable="php" failonerror="true">
-			<arg value="-l" />
-			
-			<fileset dir="${basedir}/src">
-				<include name="**/*.php" />
-				<modified />
-			</fileset>
-		</apply>
-	</target>
-	
-	<target name="phploc" description="Measure project size using PHPLOC">
-		<exec executable="phploc">
-			<arg value="--log-csv" />
-			<arg value="${basedir}/build/logs/phploc.csv" />
-			<arg path="${basedir}/src" />
-		</exec>
-	</target>
-	
-	<target name="pdepend" description="Calculate software metrics using PHP_Depend">
-		<exec executable="pdepend">
-			<arg value="--jdepend-xml=${basedir}/build/logs/jdepend.xml" />
-			<arg value="--jdepend-chart=${basedir}/build/pdepend/dependencies.svg" />
-			<arg value="--overview-pyramid=${basedir}/build/pdepend/overview-pyramid.svg" />
-			<arg path="${basedir}/src" />
-		</exec>
-	</target>
-	
-	<target name="phpmd" description="Perform project mess detection using PHPMD and print human readable output. Intended for usage on the command line before committing.">
-		<exec executable="phpmd">
-			<arg path="${basedir}/src" />
-			<arg value="text" />
-			<arg value="${basedir}/build/phpmd.xml" />
-		</exec>
-	</target>
-	
-	<target name="phpmd-ci" description="Perform project mess detection using PHPMD creating a log file for the continuous integration server">
-		<exec executable="phpmd">
-			<arg path="${basedir}/src" />
-			<arg value="xml" />
-			<arg value="${basedir}/build/phpmd.xml" />
-			<arg value="--reportfile" />
-			<arg value="${basedir}/build/logs/pmd.xml" />
-		</exec>
-	</target>
-	
-	<target name="phpcs" description="Find coding standard violations using PHP_CodeSniffer and print human readable output. Intended for usage on the command line before committing.">
-		<exec executable="phpcs">
-			<arg value="--standard=${basedir}/build/phpcs.xml" />
-			<arg value="--extensions=php" />
-			<arg value="--ignore=third_party/CIUnit" />
-			<arg path="${basedir}/src" />
-		</exec>
-	</target>
-	
-	<target name="phpcs-ci" description="Find coding standard violations using PHP_CodeSniffer creating a log file for the continuous integration server">
-		<exec executable="phpcs" output="/dev/null">
-			<arg value="--report=checkstyle" />
-			<arg value="--report-file=${basedir}/build/logs/checkstyle.xml" />
-			<arg value="--standard=${basedir}/build/phpcs.xml" />
-			<arg value="--extensions=php" />
-			<arg value="--ignore=third_party/CIUnit" />
-			<arg path="${basedir}/src" />
-		</exec>
-	</target>
-	
-	<target name="phpcpd" description="Find duplicate code using PHPCPD">
-		<exec executable="phpcpd">
-			<arg value="--log-pmd" />
-			<arg value="${basedir}/build/logs/pmd-cpd.xml" />
-			<arg path="${basedir}/src" />
-		</exec>
-	</target>
-
-	<target name="composer" description="Install Composer requirements">
-		<exec executable="composer.phar" failonerror="true">
-			<arg value="install" />
-			<arg value="--dev" />
-		</exec>
-	</target>
-
-	<target name="phpunit" description="Run unit tests with PHPUnit">
-		<exec executable="${basedir}/vendor/bin/phpunit" failonerror="true">
-			<arg value="--configuration" />
-			<arg value="${basedir}/build/phpunit.xml" />
-		</exec>
-	</target>
-	
-	<target name="phpdox" description="Generate API documentation using phpDox">
-		<exec executable="phpdox"/>
-	</target>
-	
-	<target name="phpcb" description="Aggregate tool output with PHP_CodeBrowser">
-		<exec executable="phpcb">
-			<arg value="--log" />
-			<arg path="${basedir}/build/logs" />
-			<arg value="--source" />
-			<arg path="${basedir}/src" />
-			<arg value="--output" />
-			<arg path="${basedir}/build/code-browser" />
-		</exec>
-	</target>
-</project>
--- a/composer.json
+++ b/composer.json
@@ -1,15 +1,15 @@
 {
 	"name": "league/oauth2-server",
 	"description": "A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.",
-	"version": "2.0.4",
+	"version": "3.0",
 	"homepage": "https://github.com/php-loep/oauth2-server",
 	"license": "MIT",
 	"require": {
-		"php": ">=5.3.0",
-		"zetacomponents/database": "dev-master"
+		"php": ">=5.4.0"
 	},
 	"require-dev": {
-		"mockery/mockery": ">=0.7.2"
+		"mockery/mockery": ">=0.7.2",
+		"league/phpunit-coverage-listener": "~1.0"
 	},
 	"repositories": [
 		{
@@ -24,7 +24,10 @@
 		"authorization",
 		"authentication",
 		"resource",
-		"api"
+		"api",
+		"auth",
+		"protect",
+		"secure"
 	],
 	"authors": [
 		{
@@ -43,5 +46,7 @@
 			"League\\OAuth2\\Server": "src/"
 		}
 	},
-	"suggest": {}
-}
+	"suggest": {
+
+	}
+}
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -15,17 +15,13 @@
 		<blacklist>
 			<directory suffix=".php">PEAR_INSTALL_DIR</directory>
 			<directory suffix=".php">PHP_LIBDIR</directory>
-			<directory suffix=".php">vendor/composer</directory>
-			<directory suffix=".php">vendor/mockery</directory>
-			<directory suffix=".php">vendor/phpunit</directory>
+			<directory suffix=".php">vendor</directory>
 			<directory suffix=".php">tests</directory>
 			<directory suffix=".php">testing</directory>
 		</blacklist>
 	</filter>
 	<logging>
-		<log type="coverage-html" target="build/coverage" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="50" highLowerBound="90"/>
-		<log type="coverage-text" target="php://stdout" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="50" highLowerBound="90"/>
-		<log type="coverage-clover" target="build/logs/clover.xml"/>
-		<log type="junit" target="build/logs/junit.xml" logIncompleteSkipped="false"/>
+		<log type="coverage-text" target="php://stdout" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="60" highLowerBound="99"/>
+        <log type="coverage-html" target="tests/coverage" title="lncd/OAuth" charset="UTF-8" yui="true" highlight="true" lowUpperBound="60" highLowerBound="99"/>
 	</logging>
-</phpunit>
+</phpunit>
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit colors="true" convertNoticesToExceptions="true" convertWarningsToExceptions="true" stopOnError="false" stopOnFailure="false" stopOnIncomplete="false" stopOnSkipped="false" bootstrap="tests/Bootstrap.php">
+	<testsuites>
+		<testsuite name="Authorization Server">
+			<directory suffix="Test.php">tests/authorization</directory>
+		</testsuite>
+		<testsuite name="Resource Server">
+			<directory suffix="Test.php">tests/resource</directory>
+		</testsuite>
+		<testsuite name="Utility Methods">
+			<directory suffix="Test.php">tests/util</directory>
+		</testsuite>
+	</testsuites>
+	<filter>
+		<blacklist>
+			<directory suffix=".php">PEAR_INSTALL_DIR</directory>
+			<directory suffix=".php">PHP_LIBDIR</directory>
+			<directory suffix=".php">vendor</directory>
+			<directory suffix=".php">tests</directory>
+			<directory suffix=".php">testing</directory>
+		</blacklist>
+	</filter>
+	<logging>
+        <log type="coverage-clover" target="/tmp/coverage.xml"/>
+        <log type="coverage-text" target="php://stdout" showUncoveredFiles="false"/>
+    </logging>
+    <listeners>
+        <listener class="League\PHPUnitCoverageListener\Listener">
+            <arguments>
+                <array>
+                    <element key="printer">
+                      <object class="League\PHPUnitCoverageListener\Printer\StdOut"/>
+                    </element>
+                    <element key="hook">
+                      <object class="League\PHPUnitCoverageListener\Hook\Travis"/>
+                    </element>
+                    <element key="namespace">
+                        <string>League\OAuth2\Server</string>
+                    </element>
+                    <element key="repo_token">
+                        <string>DtNuuOrBh1QBXVyRqmVldC2Au11DVti9n</string>
+                    </element>
+                    <element key="target_url">
+                        <string>https://coveralls.io/api/v1/jobs</string>
+                    </element>
+                    <element key="coverage_dir">
+                        <string>/tmp</string>
+                    </element>
+                </array>
+            </arguments>
+        </listener>
+    </listeners>
+</phpunit>
--- a/sql/mysql.sql
+++ b/sql/mysql.sql
@@ -29,7 +29,7 @@ CREATE TABLE `oauth_sessions` (
 CREATE TABLE `oauth_session_access_tokens` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `session_id` int(10) unsigned NOT NULL,
-  `access_token` char(40) NOT NULL DEFAULT '',
+  `access_token` char(40) NOT NULL,
  `access_token_expires` int(10) unsigned NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `u_oaseacto_acto_seid` (`access_token`,`session_id`),
@@ -38,26 +38,27 @@ CREATE TABLE `oauth_session_access_tokens` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 CREATE TABLE `oauth_session_authcodes` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `session_id` int(10) unsigned NOT NULL,
-  `auth_code` char(40) NOT NULL DEFAULT '',
+  `auth_code` char(40) NOT NULL,
  `auth_code_expires` int(10) unsigned NOT NULL,
-  `scope_ids` char(255) DEFAULT NULL,
-  PRIMARY KEY (`session_id`),
-  CONSTRAINT `f_oaseau_seid` FOREIGN KEY (`session_id`) REFERENCES `oauth_sessions` (`id`) ON DELETE CASCADE ON UPDATE NO ACTION
+  PRIMARY KEY (`id`),
+  KEY `session_id` (`session_id`),
+  CONSTRAINT `oauth_session_authcodes_ibfk_1` FOREIGN KEY (`session_id`) REFERENCES `oauth_sessions` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 CREATE TABLE `oauth_session_redirects` (
  `session_id` int(10) unsigned NOT NULL,
-  `redirect_uri` varchar(255) NOT NULL DEFAULT '',
+  `redirect_uri` varchar(255) NOT NULL,
  PRIMARY KEY (`session_id`),
  CONSTRAINT `f_oasere_seid` FOREIGN KEY (`session_id`) REFERENCES `oauth_sessions` (`id`) ON DELETE CASCADE ON UPDATE NO ACTION
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 CREATE TABLE `oauth_session_refresh_tokens` (
  `session_access_token_id` int(10) unsigned NOT NULL,
-  `refresh_token` char(40) NOT NULL DEFAULT '',
+  `refresh_token` char(40) NOT NULL,
  `refresh_token_expires` int(10) unsigned NOT NULL,
-  `client_id` char(40) NOT NULL DEFAULT '',
+  `client_id` char(40) NOT NULL,
  PRIMARY KEY (`session_access_token_id`),
  KEY `client_id` (`client_id`),
  CONSTRAINT `oauth_session_refresh_tokens_ibfk_1` FOREIGN KEY (`client_id`) REFERENCES `oauth_clients` (`id`) ON DELETE CASCADE,
@@ -65,21 +66,30 @@ CREATE TABLE `oauth_session_refresh_tokens` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 CREATE TABLE `oauth_scopes` (
-  `id` SMALLINT(5) UNSIGNED NOT NULL AUTO_INCREMENT,
-  `key` VARCHAR(255) NOT NULL,
-  `name` VARCHAR(255) NOT NULL,
-  `description` VARCHAR(255) DEFAULT NULL,
+  `id` smallint(5) unsigned NOT NULL AUTO_INCREMENT,
+  `scope` varchar(255) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `description` varchar(255) DEFAULT NULL,
  PRIMARY KEY (`id`),
-  UNIQUE KEY `u_oasc_sc` (`key`)
-) ENGINE=INNODB DEFAULT CHARSET=utf8;
+  UNIQUE KEY `u_oasc_sc` (`scope`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 CREATE TABLE `oauth_session_token_scopes` (
-  `session_token_scope_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
  `session_access_token_id` int(10) unsigned DEFAULT NULL,
  `scope_id` smallint(5) unsigned NOT NULL,
-  PRIMARY KEY (`session_token_scope_id`),
+  PRIMARY KEY (`id`),
  UNIQUE KEY `u_setosc_setoid_scid` (`session_access_token_id`,`scope_id`),
  KEY `f_oasetosc_scid` (`scope_id`),
  CONSTRAINT `f_oasetosc_scid` FOREIGN KEY (`scope_id`) REFERENCES `oauth_scopes` (`id`) ON DELETE CASCADE ON UPDATE NO ACTION,
  CONSTRAINT `f_oasetosc_setoid` FOREIGN KEY (`session_access_token_id`) REFERENCES `oauth_session_access_tokens` (`id`) ON DELETE CASCADE ON UPDATE NO ACTION
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE `oauth_session_authcode_scopes` (
+  `oauth_session_authcode_id` int(10) unsigned NOT NULL,
+  `scope_id` smallint(5) unsigned NOT NULL,
+  KEY `oauth_session_authcode_id` (`oauth_session_authcode_id`),
+  KEY `scope_id` (`scope_id`),
+  CONSTRAINT `oauth_session_authcode_scopes_ibfk_2` FOREIGN KEY (`scope_id`) REFERENCES `oauth_scopes` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `oauth_session_authcode_scopes_ibfk_1` FOREIGN KEY (`oauth_session_authcode_id`) REFERENCES `oauth_session_authcodes` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
--- a/src/League/OAuth2/Server/Authorization.php
+++ b/src/League/OAuth2/Server/Authorization.php
@@ -59,11 +59,11 @@ class Authorization
     * Require the "scope" parameter to be in checkAuthoriseParams()
     * @var boolean
     */
-    protected $requireScopeParam = true;
+    protected $requireScopeParam = false;

    /**
-     * Default scope to be used if none is provided and requireScopeParam is false
-     * @var string
+     * Default scope(s) to be used if none is provided
+     * @var string|array
     */
    protected $defaultScope = null;

@@ -261,6 +261,11 @@ class Authorization
        return (array_key_exists($identifier, $this->grantTypes));
    }

+    /**
+     * Returns response types
+     *
+     * @return array
+     */
    public function getResponseTypes()
    {
        return $this->responseTypes;
@@ -287,11 +292,12 @@ class Authorization

    /**
     * Default scope to be used if none is provided and requireScopeParam is false
-     * @var string
+     * @param string|array $default
     */
    public function setDefaultScope($default = null)
    {
        $this->defaultScope = $default;
+        return $this;
    }

    /**
@@ -318,9 +324,10 @@ class Authorization
     * @param  boolean $require
     * @return void
     */
-    public function requireStateParam($require = false)
+    public function requireStateParam($require = true)
    {
        $this->requireStateParam = $require;
+        return $this;
    }

    /**
@@ -341,6 +348,7 @@ class Authorization
    public function setScopeDelimeter($scopeDelimeter = ' ')
    {
        $this->scopeDelimeter = $scopeDelimeter;
+        return $this;
    }

    /**
@@ -359,6 +367,7 @@ class Authorization
    public function setAccessTokenTTL($accessTokenTTL = 3600)
    {
        $this->accessTokenTTL = $accessTokenTTL;
+        return $this;
    }

    /**
@@ -369,6 +378,7 @@ class Authorization
    public function setRequest(Util\RequestInterface $request)
    {
        $this->request = $request;
+        return $this;
    }

    /**
@@ -381,7 +391,6 @@ class Authorization
        if ($this->request === null) {
            // @codeCoverageIgnoreStart
            $this->request = Request::buildFromGlobals();
-
        }
        // @codeCoverageIgnoreEnd

--- a/src/League/OAuth2/Server/Grant/AuthCode.php
+++ b/src/League/OAuth2/Server/Grant/AuthCode.php
@@ -24,6 +24,8 @@ use League\OAuth2\Server\Storage\ScopeInterface;
 */
 class AuthCode implements GrantTypeInterface {

+    use GrantTrait;
+
    /**
     * Grant identifier
     * @var string
@@ -64,34 +66,6 @@ class AuthCode implements GrantTypeInterface {
        $this->authServer = $authServer;
    }

-    /**
-     * Return the identifier
-     * @return string
-     */
-    public function getIdentifier()
-    {
-        return $this->identifier;
-    }
-
-    /**
-     * Return the response type
-     * @return string
-     */
-    public function getResponseType()
-    {
-        return $this->responseType;
-    }
-
-    /**
-     * Override the default access token expire time
-     * @param int $accessTokenTTL
-     * @return void
-     */
-    public function setAccessTokenTTL($accessTokenTTL)
-    {
-        $this->accessTokenTTL = $accessTokenTTL;
-    }
-
    /**
     * Override the default access token expire time
     * @param int $authTokenTTL
@@ -152,10 +126,14 @@ class AuthCode implements GrantTypeInterface {
            if ($scopes[$i] === '') unset($scopes[$i]); // Remove any junk scopes
        }

-        if ($this->authServer->scopeParamRequired() === true && count($scopes) === 0) {
+        if ($this->authServer->scopeParamRequired() === true && $this->authServer->getDefaultScope() === null && count($scopes) === 0) {
            throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0);
-        } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope()) {
-            $scopes = array($this->authServer->getDefaultScope());
+        } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope() !== null) {
+            if (is_array($this->authServer->getDefaultScope())) {
+                $scopes = $this->authServer->getDefaultScope();
+            } else {
+                $scopes = array($this->authServer->getDefaultScope());
+            }
        }

        $authParams['scopes'] = array();
@@ -189,13 +167,6 @@ class AuthCode implements GrantTypeInterface {
        // Remove any old sessions the user might have
        $this->authServer->getStorage('session')->deleteSession($authParams['client_id'], $type, $typeId);

-        // List of scopes IDs
-        $scopeIds = array();
-        foreach ($authParams['scopes'] as $scope)
-        {
-            $scopeIds[] = $scope['id'];
-        }
-
        // Create a new session
        $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], $type, $typeId);

@@ -203,7 +174,12 @@ class AuthCode implements GrantTypeInterface {
        $this->authServer->getStorage('session')->associateRedirectUri($sessionId, $authParams['redirect_uri']);

        // Associate the auth code
-        $this->authServer->getStorage('session')->associateAuthCode($sessionId, $authCode, time() + $this->authTokenTTL, implode(',', $scopeIds));
+        $authCodeId = $this->authServer->getStorage('session')->associateAuthCode($sessionId, $authCode, time() + $this->authTokenTTL);
+
+        // Associate the scopes to the auth code
+        foreach ($authParams['scopes'] as $scope) {
+            $this->authServer->getStorage('session')->associateAuthCodeScope($authCodeId, $scope['id']);
+        }

        return $authCode;
    }
@@ -245,36 +221,36 @@ class AuthCode implements GrantTypeInterface {
        }

        // Verify the authorization code matches the client_id and the request_uri
-        $session = $this->authServer->getStorage('session')->validateAuthCode($authParams['client_id'], $authParams['redirect_uri'], $authParams['code']);
+        $authCodeDetails = $this->authServer->getStorage('session')->validateAuthCode($authParams['client_id'], $authParams['redirect_uri'], $authParams['code']);

-        if ( ! $session) {
+        if ( ! $authCodeDetails) {
            throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_grant'), 'code'), 9);
        }

-        // A session ID was returned so update it with an access token and remove the authorisation code
+        // Get any associated scopes
+        $scopes = $this->authServer->getStorage('session')->getAuthCodeScopes($authCodeDetails['authcode_id']);

+        // A session ID was returned so update it with an access token and remove the authorisation code
        $accessToken = SecureKey::make();
        $accessTokenExpiresIn = ($this->accessTokenTTL !== null) ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL();
        $accessTokenExpires = time() + $accessTokenExpiresIn;

        // Remove the auth code
-        $this->authServer->getStorage('session')->removeAuthCode($session['id']);
+        $this->authServer->getStorage('session')->removeAuthCode($authCodeDetails['session_id']);

        // Create an access token
-        $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($session['id'], $accessToken, $accessTokenExpires);
+        $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($authCodeDetails['session_id'], $accessToken, $accessTokenExpires);

        // Associate scopes with the access token
-        if ( ! is_null($session['scope_ids'])) {
-            $scopeIds = explode(',', $session['scope_ids']);
-
-            foreach ($scopeIds as $scopeId) {
-                $this->authServer->getStorage('session')->associateScope($accessTokenId, $scopeId);
+        if (count($scopes) > 0) {
+            foreach ($scopes as $scope) {
+                $this->authServer->getStorage('session')->associateScope($accessTokenId, $scope['scope_id']);
            }
        }

        $response = array(
            'access_token'  =>  $accessToken,
-            'token_type'    =>  'bearer',
+            'token_type'    =>  'Bearer',
            'expires'       =>  $accessTokenExpires,
            'expires_in'    =>  $accessTokenExpiresIn
        );
@@ -290,4 +266,4 @@ class AuthCode implements GrantTypeInterface {
        return $response;
    }

-}
+}
--- a/src/League/OAuth2/Server/Grant/ClientCredentials.php
+++ b/src/League/OAuth2/Server/Grant/ClientCredentials.php
@@ -24,6 +24,8 @@ use League\OAuth2\Server\Storage\ScopeInterface;
 */
 class ClientCredentials implements GrantTypeInterface {

+    use GrantTrait;
+
    /**
     * Grant identifier
     * @var string
@@ -122,10 +124,14 @@ class ClientCredentials implements GrantTypeInterface {
            if ($scopes[$i] === '') unset($scopes[$i]); // Remove any junk scopes
        }

-        if ($this->authServer->scopeParamRequired() === true && count($scopes) === 0) {
+        if ($this->authServer->scopeParamRequired() === true && $this->authServer->getDefaultScope() === null && count($scopes) === 0) {
            throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0);
-        } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope()) {
-            $scopes = array($this->authServer->getDefaultScope());
+        } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope() !== null) {
+            if (is_array($this->authServer->getDefaultScope())) {
+                $scopes = $this->authServer->getDefaultScope();
+            } else {
+                $scopes = array($this->authServer->getDefaultScope());
+            }
        }

        $authParams['scopes'] = array();
@@ -145,9 +151,6 @@ class ClientCredentials implements GrantTypeInterface {
        $accessTokenExpiresIn = ($this->accessTokenTTL !== null) ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL();
        $accessTokenExpires = time() + $accessTokenExpiresIn;

-        // Delete any existing sessions just to be sure
-        $this->authServer->getStorage('session')->deleteSession($authParams['client_id'], 'client', $authParams['client_id']);
-
        // Create a new session
        $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], 'client', $authParams['client_id']);

@@ -162,7 +165,7 @@ class ClientCredentials implements GrantTypeInterface {

        $response = array(
            'access_token'  =>  $accessToken,
-            'token_type'    =>  'bearer',
+            'token_type'    =>  'Bearer',
            'expires'       =>  $accessTokenExpires,
            'expires_in'    =>  $accessTokenExpiresIn
        );
--- a/src/League/OAuth2/Server/Grant/GrantTrait.php
+++ b/src/League/OAuth2/Server/Grant/GrantTrait.php
@@ -0,0 +1,45 @@
+<?php
+/**
+ * OAuth 2.0 Client credentials grant
+ *
+ * @package     php-loep/oauth2-server
+ * @author      Alex Bilbie <hello@alexbilbie.com>
+ * @copyright   Copyright (c) 2013 PHP League of Extraordinary Packages
+ * @license     http://mit-license.org/
+ * @link        http://github.com/php-loep/oauth2-server
+ */
+
+namespace League\OAuth2\Server\Grant;
+
+trait GrantTrait {
+
+    /**
+     * Return the identifier
+     * @return string
+     */
+    public function getIdentifier()
+    {
+        return $this->identifier;
+    }
+
+    /**
+     * Return the response type
+     * @return string
+     */
+    public function getResponseType()
+    {
+        return $this->responseType;
+    }
+
+    /**
+     * Override the default access token expire time
+     * @param int $accessTokenTTL
+     * @return self
+     */
+    public function setAccessTokenTTL($accessTokenTTL)
+    {
+        $this->accessTokenTTL = $accessTokenTTL;
+        return $this;
+    }
+
+}
--- a/src/League/OAuth2/Server/Grant/GrantTypeInterface.php
+++ b/src/League/OAuth2/Server/Grant/GrantTypeInterface.php
@@ -28,18 +28,6 @@ interface GrantTypeInterface
     */
    public function __construct(Authorization $authServer);

-    /**
-     * Returns the grant identifier (used to validate grant_type in League\OAuth2\Server\Authorization::issueAccessToken())
-     * @return string
-     */
-    public function getIdentifier();
-
-    /**
-     * Returns the response type (used to validate response_type in League\OAuth2\Server\Grant\AuthCode::checkAuthoriseParams())
-     * @return null|string
-     */
-    public function getResponseType();
-
    /**
     * Complete the grant flow
     *
--- a/src/League/OAuth2/Server/Grant/Implicit.php
+++ b/src/League/OAuth2/Server/Grant/Implicit.php
@@ -22,7 +22,9 @@ use League\OAuth2\Server\Storage\ScopeInterface;
 /**
 * Client credentials grant class
 */
-class Implict implements GrantTypeInterface {
+class Implicit implements GrantTypeInterface {
+
+    use GrantTrait;

    /**
     * Grant identifier
@@ -42,6 +44,12 @@ class Implict implements GrantTypeInterface {
     */
    protected $authServer = null;

+    /**
+     * Access token expires in override
+     * @var int
+     */
+    protected $accessTokenTTL = null;
+
    /**
     * Constructor
     * @param Authorization $authServer Authorization server instance
@@ -52,24 +60,6 @@ class Implict implements GrantTypeInterface {
        $this->authServer = $authServer;
    }

-    /**
-     * Return the identifier
-     * @return string
-     */
-    public function getIdentifier()
-    {
-        return $this->identifier;
-    }
-
-    /**
-     * Return the response type
-     * @return string
-     */
-    public function getResponseType()
-    {
-        return $this->responseType;
-    }
-
    /**
     * Complete the client credentials grant
     * @param  null|array $inputParams
@@ -84,7 +74,8 @@ class Implict implements GrantTypeInterface {
        $accessToken = SecureKey::make();

        // Compute expiry time
-        $accessTokenExpires = time() + $this->authServer->getAccessTokenTTL();
+        $accessTokenExpiresIn = ($this->accessTokenTTL !== null) ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL();
+        $accessTokenExpires = time() + $accessTokenExpiresIn;

        // Create a new session
        $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], 'user', $authParams['user_id']);
@@ -98,10 +89,13 @@ class Implict implements GrantTypeInterface {
        }

        $response = array(
-            'access_token'  =>  $accessToken
+            'access_token'  =>  $accessToken,
+            'token_type'    =>  'Bearer',
+            'expires'       =>  $accessTokenExpires,
+            'expires_in'    =>  $accessTokenExpiresIn,
        );

        return $response;
    }

-}
+}
--- a/src/League/OAuth2/Server/Grant/Password.php
+++ b/src/League/OAuth2/Server/Grant/Password.php
@@ -24,6 +24,8 @@ use League\OAuth2\Server\Storage\ScopeInterface;
 */
 class Password implements GrantTypeInterface {

+    use GrantTrait;
+
    /**
     * Grant identifier
     * @var string
@@ -64,34 +66,6 @@ class Password implements GrantTypeInterface {
        $this->authServer = $authServer;
    }

-    /**
-     * Return the identifier
-     * @return string
-     */
-    public function getIdentifier()
-    {
-        return $this->identifier;
-    }
-
-    /**
-     * Return the response type
-     * @return string
-     */
-    public function getResponseType()
-    {
-        return $this->responseType;
-    }
-
-    /**
-     * Override the default access token expire time
-     * @param int $accessTokenTTL
-     * @return void
-     */
-    public function setAccessTokenTTL($accessTokenTTL)
-    {
-        $this->accessTokenTTL = $accessTokenTTL;
-    }
-
    /**
     * Set the callback to verify a user's username and password
     * @param callable $callback The callback function
@@ -166,10 +140,14 @@ class Password implements GrantTypeInterface {
            if ($scopes[$i] === '') unset($scopes[$i]); // Remove any junk scopes
        }

-        if ($this->authServer->scopeParamRequired() === true && count($scopes) === 0) {
+        if ($this->authServer->scopeParamRequired() === true && $this->authServer->getDefaultScope() === null && count($scopes) === 0) {
            throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0);
-        } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope()) {
-            $scopes = array($this->authServer->getDefaultScope());
+        } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope() !== null) {
+            if (is_array($this->authServer->getDefaultScope())) {
+                $scopes = $this->authServer->getDefaultScope();
+            } else {
+                $scopes = array($this->authServer->getDefaultScope());
+            }
        }

        $authParams['scopes'] = array();
@@ -189,9 +167,6 @@ class Password implements GrantTypeInterface {
        $accessTokenExpiresIn = ($this->accessTokenTTL !== null) ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL();
        $accessTokenExpires = time() + $accessTokenExpiresIn;

-        // Delete any existing sessions just to be sure
-        $this->authServer->getStorage('session')->deleteSession($authParams['client_id'], 'user', $userId);
-
        // Create a new session
        $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], 'user', $userId);

@@ -205,7 +180,7 @@ class Password implements GrantTypeInterface {

        $response = array(
            'access_token'  =>  $accessToken,
-            'token_type'    =>  'bearer',
+            'token_type'    =>  'Bearer',
            'expires'       =>  $accessTokenExpires,
            'expires_in'    =>  $accessTokenExpiresIn
        );
@@ -221,4 +196,4 @@ class Password implements GrantTypeInterface {
        return $response;
    }

-}
+}
--- a/src/League/OAuth2/Server/Grant/RefreshToken.php
+++ b/src/League/OAuth2/Server/Grant/RefreshToken.php
@@ -24,6 +24,8 @@ use League\OAuth2\Server\Storage\ScopeInterface;
 */
 class RefreshToken implements GrantTypeInterface {

+    use GrantTrait;
+
    /**
     * Grant identifier
     * @var string
@@ -54,6 +56,12 @@ class RefreshToken implements GrantTypeInterface {
     */
    protected $refreshTokenTTL = 604800;

+    /**
+     * Rotate refresh tokens
+     * @var boolean
+     */
+    protected $rotateRefreshTokens = false;
+
    /**
     * Constructor
     * @param Authorization $authServer Authorization server instance
@@ -64,34 +72,6 @@ class RefreshToken implements GrantTypeInterface {
        $this->authServer = $authServer;
    }

-    /**
-     * Return the identifier
-     * @return string
-     */
-    public function getIdentifier()
-    {
-        return $this->identifier;
-    }
-
-    /**
-     * Return the response type
-     * @return string
-     */
-    public function getResponseType()
-    {
-        return $this->responseType;
-    }
-
-    /**
-     * Override the default access token expire time
-     * @param int $accessTokenTTL
-     * @return void
-     */
-    public function setAccessTokenTTL($accessTokenTTL)
-    {
-        $this->accessTokenTTL = $accessTokenTTL;
-    }
-
    /**
     * Set the TTL of the refresh token
     * @param int $refreshTokenTTL
@@ -111,6 +91,16 @@ class RefreshToken implements GrantTypeInterface {
        return $this->refreshTokenTTL;
    }

+    /**
+     * When a new access is token, expire the refresh token used and issue a new one.
+     * @param  boolean $rotateRefreshTokens Set to true to enable (default = false)
+     * @return void
+     */
+    public function rotateRefreshTokens($rotateRefreshTokens = false)
+    {
+        $this->rotateRefreshTokens = $rotateRefreshTokens;
+    }
+
    /**
     * Complete the refresh token grant
     * @param  null|array $inputParams
@@ -119,7 +109,7 @@ class RefreshToken implements GrantTypeInterface {
    public function completeFlow($inputParams = null)
    {
        // Get the required params
-        $authParams = $this->authServer->getParam(array('client_id', 'client_secret', 'refresh_token'), 'post', $inputParams);
+        $authParams = $this->authServer->getParam(array('client_id', 'client_secret', 'refresh_token', 'scope'), 'post', $inputParams);

        if (is_null($authParams['client_id'])) {
            throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_id'), 0);
@@ -159,24 +149,69 @@ class RefreshToken implements GrantTypeInterface {
        $accessToken = SecureKey::make();
        $accessTokenExpiresIn = ($this->accessTokenTTL !== null) ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL();
        $accessTokenExpires = time() + $accessTokenExpiresIn;
-        $refreshToken = SecureKey::make();
-        $refreshTokenExpires = time() + $this->getRefreshTokenTTL();

+        // Associate the new access token with the session
        $newAccessTokenId = $this->authServer->getStorage('session')->associateAccessToken($accessTokenDetails['session_id'], $accessToken, $accessTokenExpires);

-        foreach ($scopes as $scope) {
-            $this->authServer->getStorage('session')->associateScope($newAccessTokenId, $scope['id']);
+        if ($this->rotateRefreshTokens === true) {
+
+            // Generate a new refresh token
+            $refreshToken = SecureKey::make();
+            $refreshTokenExpires = time() + $this->getRefreshTokenTTL();
+
+            // Revoke the old refresh token
+            $this->authServer->getStorage('session')->removeRefreshToken($authParams['refresh_token']);
+
+            // Associate the new refresh token with the new access token
+            $this->authServer->getStorage('session')->associateRefreshToken($newAccessTokenId, $refreshToken, $refreshTokenExpires, $authParams['client_id']);
        }

-        $this->authServer->getStorage('session')->associateRefreshToken($newAccessTokenId, $refreshToken, $refreshTokenExpires, $authParams['client_id']);
+        // There isn't a request for reduced scopes so assign the original ones (or we're not rotating scopes)
+        if ( ! isset($authParams['scope'])) {

-        return array(
+            foreach ($scopes as $scope) {
+                $this->authServer->getStorage('session')->associateScope($newAccessTokenId, $scope['id']);
+            }
+
+        } elseif ( isset($authParams['scope']) && $this->rotateRefreshTokens === true) {
+
+            // The request is asking for reduced scopes and rotate tokens is enabled
+            $reqestedScopes = explode($this->authServer->getScopeDelimeter(), $authParams['scope']);
+
+            for ($i = 0; $i < count($reqestedScopes); $i++) {
+                $reqestedScopes[$i] = trim($reqestedScopes[$i]);
+                if ($reqestedScopes[$i] === '') unset($reqestedScopes[$i]); // Remove any junk scopes
+            }
+
+            // Check that there aren't any new scopes being included
+            $existingScopes = array();
+            foreach ($scopes as $s) {
+                $existingScopes[] = $s['scope'];
+            }
+
+            foreach ($reqestedScopes as $reqScope) {
+                if ( ! in_array($reqScope, $existingScopes)) {
+                    throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0);
+                }
+
+                // Associate with the new access token
+                $scopeDetails = $this->authServer->getStorage('scope')->getScope($reqScope, $authParams['client_id'], $this->identifier);
+                $this->authServer->getStorage('session')->associateScope($newAccessTokenId, $scopeDetails['id']);
+            }
+        }
+
+        $response = array(
            'access_token'  =>  $accessToken,
-            'refresh_token' =>  $refreshToken,
            'token_type'    =>  'bearer',
            'expires'       =>  $accessTokenExpires,
            'expires_in'    =>  $accessTokenExpiresIn
        );
+
+        if ($this->rotateRefreshTokens === true) {
+            $response['refresh_token'] = $refreshToken;
+        }
+
+        return $response;
    }

 }
--- a/src/League/OAuth2/Server/Resource.php
+++ b/src/League/OAuth2/Server/Resource.php
@@ -93,6 +93,7 @@ class Resource
    public function setRequest(RequestInterface $request)
    {
        $this->request = $request;
+        return $this;
    }

    /**
@@ -129,6 +130,7 @@ class Resource
    public function setTokenKey($key)
    {
        $this->tokenKey = $key;
+        return $this;
    }

    /**
@@ -173,12 +175,13 @@ class Resource
    /**
     * Checks if the access token is valid or not.
     *
+     * @param $headersOnly Limit Access Token to Authorization header only
     * @throws Exception\InvalidAccessTokenException Thrown if the presented access token is not valid
     * @return bool
     */
-    public function isValid()
+    public function isValid($headersOnly = false)
    {
-        $accessToken = $this->determineAccessToken();
+        $accessToken = $this->determineAccessToken($headersOnly);

        $result = $this->storages['session']->validateAccessToken($accessToken);

@@ -194,7 +197,7 @@ class Resource

        $sessionScopes = $this->storages['session']->getScopes($this->accessToken);
        foreach ($sessionScopes as $scope) {
-            $this->sessionScopes[] = $scope['key'];
+            $this->sessionScopes[] = $scope['scope'];
        }

        return true;
@@ -237,14 +240,27 @@ class Resource
    /**
     * Reads in the access token from the headers.
     *
+     * @param $headersOnly Limit Access Token to Authorization header only
     * @throws Exception\MissingAccessTokenException  Thrown if there is no access token presented
     * @return string
     */
-    protected function determineAccessToken()
+    public function determineAccessToken($headersOnly = false)
    {
        if ($header = $this->getRequest()->header('Authorization')) {
-            $accessToken = trim(str_replace('Bearer', '', $header));
-        } else {
+            // Check for special case, because cURL sometimes does an
+            // internal second request and doubles the authorization header,
+            // which always resulted in an error.
+            //
+            // 1st request: Authorization: Bearer XXX
+            // 2nd request: Authorization: Bearer XXX, Bearer XXX
+            if (strpos($header, ',') !== false) {
+                $headerPart = explode(',', $header);
+                $accessToken = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $headerPart[0]));
+            } else {
+                $accessToken = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $header));
+            }
+            $accessToken = ($accessToken === 'Bearer') ? '' : $accessToken;
+        } elseif ($headersOnly === false) {
            $method = $this->getRequest()->server('REQUEST_METHOD');
            $accessToken = $this->getRequest()->{$method}($this->tokenKey);
        }
--- a/src/League/OAuth2/Server/Storage/ClientInterface.php
+++ b/src/League/OAuth2/Server/Storage/ClientInterface.php
@@ -20,19 +20,21 @@ interface ClientInterface
     *
     * <code>
     * # Client ID + redirect URI
-     * SELECT oauth_clients.id, oauth_clients.secret, oauth_client_endpoints.redirect_uri, oauth_clients.name
+     * SELECT oauth_clients.id, oauth_clients.secret, oauth_client_endpoints.redirect_uri, oauth_clients.name,
+     * oauth_clients.auto_approve
     *  FROM oauth_clients LEFT JOIN oauth_client_endpoints ON oauth_client_endpoints.client_id = oauth_clients.id
     *  WHERE oauth_clients.id = :clientId AND oauth_client_endpoints.redirect_uri = :redirectUri
     *
     * # Client ID + client secret
-     * SELECT oauth_clients.id, oauth_clients.secret, oauth_clients.name FROM oauth_clients WHERE
-     *  oauth_clients.id = :clientId AND oauth_clients.secret = :clientSecret
+     * SELECT oauth_clients.id, oauth_clients.secret, oauth_clients.name, oauth_clients.auto_approve FROM oauth_clients 
+     * WHERE oauth_clients.id = :clientId AND oauth_clients.secret = :clientSecret
     *
     * # Client ID + client secret + redirect URI
-     * SELECT oauth_clients.id, oauth_clients.secret, oauth_client_endpoints.redirect_uri, oauth_clients.name FROM
-     *  oauth_clients LEFT JOIN oauth_client_endpoints ON oauth_client_endpoints.client_id = oauth_clients.id
-     *  WHERE oauth_clients.id = :clientId AND oauth_clients.secret = :clientSecret AND
-     *  oauth_client_endpoints.redirect_uri = :redirectUri
+     * SELECT oauth_clients.id, oauth_clients.secret, oauth_client_endpoints.redirect_uri, oauth_clients.name,
+     * oauth_clients.auto_approve FROM oauth_clients LEFT JOIN oauth_client_endpoints 
+     * ON oauth_client_endpoints.client_id = oauth_clients.id
+     * WHERE oauth_clients.id = :clientId AND oauth_clients.secret = :clientSecret AND
+     * oauth_client_endpoints.redirect_uri = :redirectUri
     * </code>
     *
     * Response:
@@ -44,14 +46,15 @@ interface ClientInterface
     *     [client secret] => (string) The client secret
     *     [redirect_uri] => (string) The redirect URI used in this request
     *     [name] => (string) The name of the client
+     *     [auto_approve] => (bool) Whether the client should auto approve
     * )
     * </code>
     *
     * @param  string     $clientId     The client's ID
     * @param  string     $clientSecret The client's secret (default = "null")
     * @param  string     $redirectUri  The client's redirect URI (default = "null")
-     * @param  string     $grantType    The grant type used in the request
+     * @param  string     $grantType    The grant type used in the request (default = "null")
     * @return bool|array               Returns false if the validation fails, array on success
     */
-    public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType);
-}
+    public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType = null);
+}
--- a/src/League/OAuth2/Server/Storage/PDO/Client.php
+++ b/src/League/OAuth2/Server/Storage/PDO/Client.php
@@ -1,45 +0,0 @@
-<?php
-
-namespace League\OAuth2\Server\Storage\PDO;
-
-use League\OAuth2\Server\Storage\ClientInterface;
-
-class Client implements ClientInterface
-{
-    public function getClient($clientId, $clientSecret = null, $redirectUri = null, $grantType)
-    {
-        $db = \ezcDbInstance::get();
-
-        if ( ! is_null($redirectUri) && is_null($clientSecret)) {
-            $stmt = $db->prepare('SELECT oauth_clients.id, oauth_clients.secret, oauth_client_endpoints.redirect_uri, oauth_clients.name FROM oauth_clients LEFT JOIN oauth_client_endpoints ON oauth_client_endpoints.client_id = oauth_clients.id WHERE oauth_clients.id = :clientId AND oauth_client_endpoints.redirect_uri = :redirectUri');
-            $stmt->bindValue(':redirectUri', $redirectUri);
-        }
-
-        elseif ( ! is_null($clientSecret) && is_null($redirectUri)) {
-            $stmt = $db->prepare('SELECT oauth_clients.id, oauth_clients.secret, oauth_clients.name FROM oauth_clients  WHERE oauth_clients.id = :clientId AND oauth_clients.secret = :clientSecret');
-            $stmt->bindValue(':clientSecret', $clientSecret);
-        }
-
-        elseif ( ! is_null($clientSecret) && ! is_null($redirectUri)) {
-            $stmt = $db->prepare('SELECT oauth_clients.id, oauth_clients.secret, oauth_client_endpoints.redirect_uri, oauth_clients.name FROM oauth_clients LEFT JOIN oauth_client_endpoints ON oauth_client_endpoints.client_id = oauth_clients.id WHERE oauth_clients.id = :clientId AND oauth_clients.secret = :clientSecret AND oauth_client_endpoints.redirect_uri = :redirectUri');
-            $stmt->bindValue(':redirectUri', $redirectUri);
-            $stmt->bindValue(':clientSecret', $clientSecret);
-        }
-
-        $stmt->bindValue(':clientId', $clientId);
-        $stmt->execute();
-
-        $row = $stmt->fetchObject();
-
-        if ($row === false) {
-            return false;
-        }
-
-        return array(
-            'client_id' =>  $row->id,
-            'client_secret' =>  $row->secret,
-            'redirect_uri'  =>  (isset($row->redirect_uri)) ? $row->redirect_uri : null,
-            'name'  =>  $row->name
-        );
-    }
-}
--- a/src/League/OAuth2/Server/Storage/PDO/Db.php
+++ b/src/League/OAuth2/Server/Storage/PDO/Db.php
@@ -1,17 +0,0 @@
-<?php
-
-namespace League\OAuth2\Server\Storage\PDO;
-
-class Db
-{
-	/**
-	 * Db constructor
-	 * @param array|string $dsn Connection DSN string or array of parameters
-	 * @return void
-	 */
-    public function __construct($dsn = '')
-    {
-        $db = \ezcDbFactory::create($dsn);
-        \ezcDbInstance::set($db);
-    }
-}
--- a/src/League/OAuth2/Server/Storage/PDO/Scope.php
+++ b/src/League/OAuth2/Server/Storage/PDO/Scope.php
@@ -1,31 +0,0 @@
-<?php
-
-namespace League\OAuth2\Server\Storage\PDO;
-
-use League\OAuth2\Server\Storage\ScopeInterface;
-
-class Scope implements ScopeInterface
-{
-    public function getScope($scope, $clientId = null, $grantType = null)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('SELECT * FROM oauth_scopes WHERE oauth_scopes.key = :scope');
-        $stmt->bindValue(':scope', $scope);
-        $stmt->execute();
-
-        $row = $stmt->fetchObject();
-
-        if ($row === false) {
-            return false;
-        }
-
-        return array(
-            'id' =>  $row->id,
-            'scope' =>  $row->key,
-            'name'  =>  $row->name,
-            'description'  =>  $row->description
-        );
-
-    }
-}
--- a/src/League/OAuth2/Server/Storage/PDO/Session.php
+++ b/src/League/OAuth2/Server/Storage/PDO/Session.php
@@ -1,175 +0,0 @@
-<?php
-
-namespace League\OAuth2\Server\Storage\PDO;
-
-use League\OAuth2\Server\Storage\SessionInterface;
-
-class Session implements SessionInterface
-{
-    public function createSession($clientId, $ownerType, $ownerId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('INSERT INTO oauth_sessions (client_id, owner_type,  owner_id) VALUE
-         (:clientId, :ownerType, :ownerId)');
-        $stmt->bindValue(':clientId', $clientId);
-        $stmt->bindValue(':ownerType', $ownerType);
-        $stmt->bindValue(':ownerId', $ownerId);
-        $stmt->execute();
-
-        return $db->lastInsertId();
-    }
-
-    public function deleteSession($clientId, $ownerType, $ownerId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('DELETE FROM oauth_sessions WHERE client_id = :clientId AND
-         owner_type = :type AND owner_id = :typeId');
-        $stmt->bindValue(':clientId', $clientId);
-        $stmt->bindValue(':type', $ownerType);
-        $stmt->bindValue(':typeId', $ownerId);
-        $stmt->execute();
-    }
-
-    public function associateRedirectUri($sessionId, $redirectUri)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('INSERT INTO oauth_session_redirects (session_id, redirect_uri)
-         VALUE (:sessionId, :redirectUri)');
-        $stmt->bindValue(':sessionId', $sessionId);
-        $stmt->bindValue(':redirectUri', $redirectUri);
-        $stmt->execute();
-    }
-
-    public function associateAccessToken($sessionId, $accessToken, $expireTime)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('INSERT INTO oauth_session_access_tokens (session_id, access_token, access_token_expires)
-         VALUE (:sessionId, :accessToken, :accessTokenExpire)');
-        $stmt->bindValue(':sessionId', $sessionId);
-        $stmt->bindValue(':accessToken', $accessToken);
-        $stmt->bindValue(':accessTokenExpire', $expireTime);
-        $stmt->execute();
-
-        return $db->lastInsertId();
-    }
-
-    public function associateRefreshToken($accessTokenId, $refreshToken, $expireTime, $clientId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('INSERT INTO oauth_session_refresh_tokens (session_access_token_id, refresh_token, refresh_token_expires, client_id) VALUE
-         (:accessTokenId, :refreshToken, :expireTime, :clientId)');
-        $stmt->bindValue(':accessTokenId', $accessTokenId);
-        $stmt->bindValue(':refreshToken', $refreshToken);
-        $stmt->bindValue(':expireTime', $expireTime);
-        $stmt->bindValue(':clientId', $clientId);
-        $stmt->execute();
-    }
-
-    public function associateAuthCode($sessionId, $authCode, $expireTime, $scopeIds = null)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('INSERT INTO oauth_session_authcodes (session_id, auth_code, auth_code_expires, scope_ids)
-         VALUE (:sessionId, :authCode, :authCodeExpires, :scopeIds)');
-        $stmt->bindValue(':sessionId', $sessionId);
-        $stmt->bindValue(':authCode', $authCode);
-        $stmt->bindValue(':authCodeExpires', $expireTime);
-        $stmt->bindValue(':scopeIds', $scopeIds);
-        $stmt->execute();
-    }
-
-    public function removeAuthCode($sessionId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('DELETE FROM oauth_session_authcodes WHERE session_id = :sessionId');
-        $stmt->bindValue(':sessionId', $sessionId);
-        $stmt->execute();
-    }
-
-    public function validateAuthCode($clientId, $redirectUri, $authCode)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('SELECT oauth_sessions.id, oauth_session_authcodes.scope_ids FROM oauth_sessions JOIN
-         oauth_session_authcodes ON oauth_session_authcodes.`session_id` = oauth_sessions.id JOIN
-          oauth_session_redirects ON oauth_session_redirects.`session_id` = oauth_sessions.id WHERE
-           oauth_sessions.client_id = :clientId AND oauth_session_authcodes.`auth_code` = :authCode AND
-            `oauth_session_authcodes`.`auth_code_expires` >= :time AND `oauth_session_redirects`.`redirect_uri`
-             = :redirectUri');
-        $stmt->bindValue(':clientId', $clientId);
-        $stmt->bindValue(':redirectUri', $redirectUri);
-        $stmt->bindValue(':authCode', $authCode);
-        $stmt->bindValue(':time', time());
-        $stmt->execute();
-
-        $result = $stmt->fetchObject();
-
-        return ($result === false) ? false : (array) $result;
-    }
-
-    public function validateAccessToken($accessToken)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('SELECT session_id, oauth_sessions.`client_id`, oauth_sessions.`owner_id`, oauth_sessions.`owner_type` FROM `oauth_session_access_tokens` JOIN oauth_sessions ON oauth_sessions.`id` = session_id WHERE  access_token = :accessToken AND access_token_expires >= ' . time());
-        $stmt->bindValue(':accessToken', $accessToken);
-        $stmt->execute();
-
-        $result = $stmt->fetchObject();
-        return ($result === false) ? false : (array) $result;
-    }
-
-    public function validateRefreshToken($refreshToken, $clientId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('SELECT session_access_token_id FROM `oauth_session_refresh_tokens` WHERE
-         refresh_token = :refreshToken AND client_id = :clientId AND refresh_token_expires >= ' . time());
-        $stmt->bindValue(':refreshToken', $refreshToken);
-        $stmt->bindValue(':clientId', $clientId);
-        $stmt->execute();
-
-        $result = $stmt->fetchObject();
-        return ($result === false) ? false : $result->session_access_token_id;
-    }
-
-    public function getAccessToken($accessTokenId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('SELECT * FROM `oauth_session_access_tokens` WHERE `id` = :accessTokenId');
-        $stmt->bindValue(':accessTokenId', $accessTokenId);
-        $stmt->execute();
-
-        $result = $stmt->fetchObject();
-        return ($result === false) ? false : (array) $result;
-    }
-
-    public function associateScope($accessTokenId, $scopeId)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('INSERT INTO `oauth_session_token_scopes` (`session_access_token_id`, `scope_id`)
-         VALUE (:accessTokenId, :scopeId)');
-        $stmt->bindValue(':accessTokenId', $accessTokenId);
-        $stmt->bindValue(':scopeId', $scopeId);
-        $stmt->execute();
-    }
-
-    public function getScopes($accessToken)
-    {
-        $db = \ezcDbInstance::get();
-
-        $stmt = $db->prepare('SELECT oauth_scopes.* FROM oauth_session_token_scopes JOIN oauth_session_access_tokens ON oauth_session_access_tokens.`id` = `oauth_session_token_scopes`.`session_access_token_id` JOIN oauth_scopes ON oauth_scopes.id = `oauth_session_token_scopes`.`scope_id` WHERE access_token = :accessToken');
-        $stmt->bindValue(':accessToken', $accessToken);
-        $stmt->execute();
-
-        return $stmt->fetchAll();
-    }
-}
--- a/src/League/OAuth2/Server/Storage/ScopeInterface.php
+++ b/src/League/OAuth2/Server/Storage/ScopeInterface.php
@@ -19,7 +19,7 @@ interface ScopeInterface
     * Example SQL query:
     *
     * <code>
-     * SELECT * FROM oauth_scopes WHERE oauth_scopes.key = :scope
+     * SELECT * FROM oauth_scopes WHERE scope = :scope
     * </code>
     *
     * Response:
@@ -28,15 +28,15 @@ interface ScopeInterface
     * Array
     * (
     *     [id] => (int) The scope's ID
-     *     [key] => (string) The scope itself
+     *     [scope] => (string) The scope itself
     *     [name] => (string) The scope's name
     *     [description] => (string) The scope's description
     * )
     * </code>
     *
     * @param  string     $scope     The scope
-     * @param  string     $clientId  The client ID
-     * @param  string     $grantType The grant type used in the request
+     * @param  string     $clientId  The client ID (default = "null")
+     * @param  string     $grantType The grant type used in the request (default = "null")
     * @return bool|array If the scope doesn't exist return false
     */
    public function getScope($scope, $clientId = null, $grantType = null);
--- a/src/League/OAuth2/Server/Storage/SessionInterface.php
+++ b/src/League/OAuth2/Server/Storage/SessionInterface.php
@@ -74,7 +74,7 @@ interface SessionInterface
     * @param  int    $sessionId   The session ID
     * @param  string $accessToken The access token
     * @param  int    $expireTime  Unix timestamp of the access token expiry time
-     * @return void
+     * @return int                 The access token ID
     */
    public function associateAccessToken($sessionId, $accessToken, $expireTime);

@@ -84,8 +84,8 @@ interface SessionInterface
     * Example SQL query:
     *
     * <code>
-     * oauth_session_refresh_tokens (session_access_token_id, refresh_token, refresh_token_expires)
-     *  VALUE (:accessTokenId, :refreshToken, :expireTime)
+     * INSERT INTO oauth_session_refresh_tokens (session_access_token_id, refresh_token, refresh_token_expires,
+     *  client_id) VALUE (:accessTokenId, :refreshToken, :expireTime, :clientId)
     * </code>
     *
     * @param  int    $accessTokenId The access token ID
@@ -102,17 +102,16 @@ interface SessionInterface
     * Example SQL query:
     *
     * <code>
-     * INSERT INTO oauth_session_authcodes (session_id, auth_code, auth_code_expires, scope_ids)
-     *  VALUE (:sessionId, :authCode, :authCodeExpires, :scopeIds)
+     * INSERT INTO oauth_session_authcodes (session_id, auth_code, auth_code_expires)
+     *  VALUE (:sessionId, :authCode, :authCodeExpires)
     * </code>
     *
     * @param  int    $sessionId  The session ID
     * @param  string $authCode   The authorization code
     * @param  int    $expireTime Unix timestamp of the access token expiry time
-     * @param  string $scopeIds   Comma seperated list of scope IDs to be later associated (default = null)
-     * @return void
+     * @return int                The auth code ID
     */
-    public function associateAuthCode($sessionId, $authCode, $expireTime, $scopeIds = null);
+    public function associateAuthCode($sessionId, $authCode, $expireTime);

    /**
     * Remove an associated authorization token from a session
@@ -134,7 +133,7 @@ interface SessionInterface
     * Example SQL query:
     *
     * <code>
-     * SELECT oauth_sessions.id, oauth_session_authcodes.scope_ids FROM oauth_sessions
+     * SELECT oauth_sessions.id AS session_id, oauth_session_authcodes.id AS authcode_id FROM oauth_sessions
     *  JOIN oauth_session_authcodes ON oauth_session_authcodes.`session_id` = oauth_sessions.id
     *  JOIN oauth_session_redirects ON oauth_session_redirects.`session_id` = oauth_sessions.id WHERE
     * oauth_sessions.client_id = :clientId AND oauth_session_authcodes.`auth_code` = :authCode
@@ -146,8 +145,8 @@ interface SessionInterface
     *
     * <code>
     * array(
-     *     'id' =>  (int), // the session ID
-     *     'scope_ids'  =>  (string)
+     *     'session_id' =>  (int)
+     *     'authcode_id'  =>  (int)
     * )
     * </code>
     *
@@ -185,6 +184,20 @@ interface SessionInterface
     */
    public function validateAccessToken($accessToken);

+    /**
+     * Removes a refresh token
+     *
+     * Example SQL query:
+     *
+     * <code>
+     * DELETE FROM `oauth_session_refresh_tokens` WHERE refresh_token = :refreshToken
+     * </code>
+     *
+     * @param  string $refreshToken The refresh token to be removed
+     * @return void
+     */
+    public function removeRefreshToken($refreshToken);
+
    /**
     * Validate a refresh token
     *
@@ -226,6 +239,50 @@ interface SessionInterface
     */
    public function getAccessToken($accessTokenId);

+    /**
+     * Associate scopes with an auth code (bound to the session)
+     *
+     * Example SQL query:
+     *
+     * <code>
+     * INSERT INTO `oauth_session_authcode_scopes` (`oauth_session_authcode_id`, `scope_id`) VALUES
+     *  (:authCodeId, :scopeId)
+     * </code>
+     *
+     * @param  int $authCodeId The auth code ID
+     * @param  int $scopeId    The scope ID
+     * @return void
+     */
+    public function associateAuthCodeScope($authCodeId, $scopeId);
+
+    /**
+     * Get the scopes associated with an auth code
+     *
+     * Example SQL query:
+     *
+     * <code>
+     * SELECT scope_id FROM `oauth_session_authcode_scopes` WHERE oauth_session_authcode_id = :authCodeId
+     * </code>
+     *
+     * Expected response:
+     *
+     * <code>
+     * array(
+     *     array(
+     *         'scope_id' => (int)
+     *     ),
+     *     array(
+     *         'scope_id' => (int)
+     *     ),
+     *     ...
+     * )
+     * </code>
+     *
+     * @param  int   $oauthSessionAuthCodeId The session ID
+     * @return array
+     */
+    public function getAuthCodeScopes($oauthSessionAuthCodeId);
+
    /**
     * Associate a scope with an access token
     *
@@ -258,7 +315,8 @@ interface SessionInterface
     * <code>
     * array (
     *     array(
-     *         'key'    =>  (string),
+     *         'id'     =>  (int),
+     *         'scope'  =>  (string),
     *         'name'   =>  (string),
     *         'description'    =>  (string)
     *     ),
--- a/src/League/OAuth2/Server/Util/Request.php
+++ b/src/League/OAuth2/Server/Util/Request.php
@@ -39,6 +39,8 @@ class Request implements RequestInterface

        if (empty($headers)) {
            $this->headers = $this->readHeaders();
+        } else {
+            $this->headers = $this->normalizeHeaders($headers);
        }
    }

@@ -88,7 +90,7 @@ class Request implements RequestInterface
            }
        }

-        return $headers;
+        return $this->normalizeHeaders($headers);
   }

    protected function getPropertyValue($property, $index = null, $default = null)
@@ -106,4 +108,39 @@ class Request implements RequestInterface

        return $this->{$property}[$index];
    }
+
+    /**
+     * Takes all of the headers and normalizes them in a canonical form.
+     *
+     * @param  array  $headers The request headers.
+     * @return array           An arry of headers with the header name normalized
+     */
+    protected function normalizeHeaders(array $headers)
+    {
+        $normalized = array();
+        foreach ($headers as $key => $value) {
+            $normalized[$this->normalizeKey($key)] = $value;
+        }
+
+        return $normalized;
+    }
+
+    /**
+     * Transform header name into canonical form
+     *
+     * Taken from the Slim codebase...
+     *
+     * @param  string $key
+     * @return string
+     */
+    protected function normalizeKey($key)
+    {
+        $key = strtolower($key);
+        $key = str_replace(array('-', '_'), ' ', $key);
+        $key = preg_replace('#^http #', '', $key);
+        $key = ucwords($key);
+        $key = str_replace(' ', '-', $key);
+
+        return $key;
+    }
 }
--- a/src/League/OAuth2/Server/Util/RequestInterface.php
+++ b/src/League/OAuth2/Server/Util/RequestInterface.php
@@ -14,10 +14,6 @@ namespace League\OAuth2\Server\Util;
 interface RequestInterface
 {

-    public static function buildFromGlobals();
-
-    public function __construct(array $get = array(), array $post = array(), array $cookies = array(), array $files = array(), array $server = array(), $headers = array());
-
    public function get($index = null);

    public function post($index = null);
--- a/tests/authorization/AuthCodeGrantTest.php
+++ b/tests/authorization/AuthCodeGrantTest.php
@@ -156,6 +156,7 @@ class Auth_Code_Grant_Test extends PHPUnit_Framework_TestCase
        $g = new League\OAuth2\Server\Grant\AuthCode($a);
        $a->addGrantType($g);
        $a->addGrantType(new League\OAuth2\Server\Grant\AuthCode($a));
+        $a->requireScopeParam(true);

        $g->checkAuthoriseParams(array(
            'client_id' =>  1234,
@@ -196,6 +197,41 @@ class Auth_Code_Grant_Test extends PHPUnit_Framework_TestCase
        ));

        $this->assertArrayHasKey('scopes', $params);
+        $this->assertEquals(1, count($params['scopes']));
+    }
+
+    public function test_checkAuthoriseParams_defaultScopeArray()
+    {
+        $this->client->shouldReceive('getClient')->andReturn(array(
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'name'  =>  'Example Client'
+        ));
+
+        $this->scope->shouldReceive('getScope')->andReturn(array(
+            'id'    =>  1,
+            'scope' =>  'foo',
+            'name'  =>  'Foo Name',
+            'description'   =>  'Foo Name Description'
+        ));
+
+        $a = $this->returnDefault();
+        $g = new League\OAuth2\Server\Grant\AuthCode($a);
+        $a->addGrantType($g);
+        $a->addGrantType(new League\OAuth2\Server\Grant\AuthCode($a));
+        $a->setDefaultScope(array('test.scope', 'test.scope2'));
+        $a->requireScopeParam(false);
+
+        $params = $g->checkAuthoriseParams(array(
+            'client_id' =>  1234,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'response_type' =>  'code',
+            'scope'    =>  ''
+        ));
+
+        $this->assertArrayHasKey('scopes', $params);
+        $this->assertEquals(2, count($params['scopes']));
    }

    /**
@@ -340,7 +376,8 @@ class Auth_Code_Grant_Test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('createSession')->andReturn(1);
        $this->session->shouldReceive('associateScope')->andReturn(null);
        $this->session->shouldReceive('associateRedirectUri')->andReturn(null);
-        $this->session->shouldReceive('associateAuthCode')->andReturn(null);
+        $this->session->shouldReceive('associateAuthCode')->andReturn(1);
+        $this->session->shouldReceive('associateAuthCodeScope')->andReturn(null);

        $a = $this->returnDefault();
        $g = new League\OAuth2\Server\Grant\AuthCode($a);
--- a/tests/authorization/AuthServerTest.php
+++ b/tests/authorization/AuthServerTest.php
@@ -358,13 +358,14 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
        ));

        $this->session->shouldReceive('validateAuthCode')->andReturn(array(
-            'id'    =>  1,
-            'scope_ids' =>  '1'
+            'session_id'    =>  1,
+            'authcode_id' =>  1
        ));
        $this->session->shouldReceive('updateSession')->andReturn(null);
        $this->session->shouldReceive('removeAuthCode')->andReturn(null);
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
        $this->session->shouldReceive('associateScope')->andReturn(null);
+        $this->session->shouldReceive('getAuthCodeScopes')->andReturn(array('scope_id' => 1));

        $a = $this->returnDefault();
        $a->addGrantType(new League\OAuth2\Server\Grant\AuthCode($a));
@@ -399,6 +400,8 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('updateSession')->andReturn(null);
        $this->session->shouldReceive('removeAuthCode')->andReturn(null);
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+        $this->session->shouldReceive('getAuthCodeScopes')->andReturn(array('scope_id' => 1));
+        $this->session->shouldReceive('associateScope')->andReturn(null);

        $a = $this->returnDefault();
        $a->addGrantType(new League\OAuth2\Server\Grant\AuthCode($a));
@@ -436,6 +439,8 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('updateSession')->andReturn(null);
        $this->session->shouldReceive('removeAuthCode')->andReturn(null);
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+        $this->session->shouldReceive('getAuthCodeScopes')->andReturn(array('scope_id' => 1));
+        $this->session->shouldReceive('associateScope')->andReturn(null);

        $a = $this->returnDefault();
        $grant = new League\OAuth2\Server\Grant\AuthCode($a);
@@ -477,6 +482,8 @@ class Authorization_Server_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('updateSession')->andReturn(null);
        $this->session->shouldReceive('removeAuthCode')->andReturn(null);
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+        $this->session->shouldReceive('getAuthCodeScopes')->andReturn(array('scope_id' => 1));
+        $this->session->shouldReceive('associateScope')->andReturn(null);

        $a = $this->returnDefault();
        $a->addGrantType(new League\OAuth2\Server\Grant\AuthCode($a));
--- a/tests/authorization/ClientCredentialsGrantTest.php
+++ b/tests/authorization/ClientCredentialsGrantTest.php
@@ -146,6 +146,47 @@ class Client_Credentials_Grant_Test extends PHPUnit_Framework_TestCase
        $this->assertArrayHasKey('expires_in', $v);
    }

+    public function test_issueAccessToken_clientCredentialsGrant_defaultScopeArray()
+    {
+        $this->scope->shouldReceive('getScope')->andReturn(array(
+            'id'    =>  1,
+            'key' =>  'foo',
+            'name'  =>  'Foo Name',
+            'description'   =>  'Foo Name Description'
+        ));
+
+        $this->client->shouldReceive('getClient')->andReturn(array(
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'name'  =>  'Example Client'
+        ));
+
+        $this->client->shouldReceive('validateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('validateAuthCode')->andReturn(1);
+        $this->session->shouldReceive('createSession')->andReturn(1);
+        $this->session->shouldReceive('deleteSession')->andReturn(null);
+        $this->session->shouldReceive('associateScope')->andReturn(null);
+        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+
+        $a = $this->returnDefault();
+        $a->addGrantType(new League\OAuth2\Server\Grant\ClientCredentials($a));
+        $a->requireScopeParam(false);
+        $a->setDefaultScope(array('foobar', 'barfoo'));
+
+        $v = $a->issueAccessToken(array(
+            'grant_type'    =>  'client_credentials',
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'scope' =>  ''
+        ));
+
+        $this->assertArrayHasKey('access_token', $v);
+        $this->assertArrayHasKey('token_type', $v);
+        $this->assertArrayHasKey('expires', $v);
+        $this->assertArrayHasKey('expires_in', $v);
+    }
+
    /**
     * @expectedException        League\OAuth2\Server\Exception\ClientException
     * @expectedExceptionCode    4
--- a/tests/authorization/PasswordGrantTest.php
+++ b/tests/authorization/PasswordGrantTest.php
@@ -338,6 +338,54 @@ class Password_Grant_Test extends PHPUnit_Framework_TestCase
        $this->assertArrayHasKey('expires_in', $v);
    }

+    public function test_issueAccessToken_passwordGrant_defaultScopeArray()
+    {
+        $this->scope->shouldReceive('getScope')->andReturn(array(
+            'id'    =>  1,
+            'scope' =>  'foo',
+            'name'  =>  'Foo Name',
+            'description'   =>  'Foo Name Description'
+        ));
+
+        $this->client->shouldReceive('getClient')->andReturn(array(
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'name'  =>  'Example Client'
+        ));
+
+        $this->client->shouldReceive('validateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('validateAuthCode')->andReturn(1);
+        $this->session->shouldReceive('createSession')->andReturn(1);
+        $this->session->shouldReceive('deleteSession')->andReturn(null);
+        $this->session->shouldReceive('updateRefreshToken')->andReturn(null);
+        $this->session->shouldReceive('associateScope')->andReturn(null);
+        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+
+        $testCredentials = function() { return 1; };
+
+        $a = $this->returnDefault();
+        $pgrant = new League\OAuth2\Server\Grant\Password($a);
+        $pgrant->setVerifyCredentialsCallback($testCredentials);
+        $a->addGrantType($pgrant);
+        $a->requireScopeParam(false);
+        $a->setDefaultScope(array('foobar', 'barfoo'));
+
+        $v = $a->issueAccessToken(array(
+            'grant_type'    =>  'password',
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'username'  =>  'foo',
+            'password'  =>  'bar',
+            'scope' =>  ''
+        ));
+
+        $this->assertArrayHasKey('access_token', $v);
+        $this->assertArrayHasKey('token_type', $v);
+        $this->assertArrayHasKey('expires', $v);
+        $this->assertArrayHasKey('expires_in', $v);
+    }
+
    public function test_issueAccessToken_passwordGrant_goodScope()
    {
        $this->scope->shouldReceive('getScope')->andReturn(array(
--- a/tests/authorization/RefreshTokenTest.php
+++ b/tests/authorization/RefreshTokenTest.php
@@ -42,6 +42,8 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('removeAuthCode')->andReturn(null);
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('associateScope')->andReturn(null);
+        $this->session->shouldReceive('getAuthCodeScopes')->andReturn(array('scope_id' => 1));

        $a = $this->returnDefault();
        $a->addGrantType(new League\OAuth2\Server\Grant\AuthCode($a));
@@ -183,6 +185,7 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('updateRefreshToken')->andReturn(null);
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('removeRefreshToken')->andReturn(1);
        $this->session->shouldReceive('getAccessToken')->andReturn(null);
        $this->session->shouldReceive('getScopes')->andReturn(array());

@@ -203,7 +206,6 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
        $this->assertArrayHasKey('token_type', $v);
        $this->assertArrayHasKey('expires', $v);
        $this->assertArrayHasKey('expires_in', $v);
-        $this->assertArrayHasKey('refresh_token', $v);

        $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
@@ -226,6 +228,7 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('getScopes')->andReturn(array('id'    =>  1));
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('removeRefreshToken')->andReturn(1);
        $this->session->shouldReceive('associateScope')->andReturn(null);

        $a = $this->returnDefault();
@@ -238,6 +241,48 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
            'refresh_token'  =>  'abcdef',
        ));

+        $this->assertArrayHasKey('access_token', $v);
+        $this->assertArrayHasKey('token_type', $v);
+        $this->assertArrayHasKey('expires', $v);
+        $this->assertArrayHasKey('expires_in', $v);
+
+        $this->assertEquals($a->getAccessTokenTTL(), $v['expires_in']);
+        $this->assertEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
+    }
+
+    public function test_issueAccessToken_refreshTokenGrant_rotateTokens()
+    {
+        $this->client->shouldReceive('getClient')->andReturn(array(
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'name'  =>  'Example Client'
+        ));
+
+        $this->session->shouldReceive('validateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('validateAuthCode')->andReturn(1);
+        $this->session->shouldReceive('updateSession')->andReturn(null);
+        $this->session->shouldReceive('updateRefreshToken')->andReturn(null);
+        $this->session->shouldReceive('getAccessToken')->andReturn(null);
+        $this->session->shouldReceive('getScopes')->andReturn(array('id'    =>  1));
+        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('removeRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('associateScope')->andReturn(null);
+
+        $a = $this->returnDefault();
+
+        $rt = new League\OAuth2\Server\Grant\RefreshToken($a);
+        $rt->rotateRefreshTokens(true);
+        $a->addGrantType($rt);
+
+        $v = $a->issueAccessToken(array(
+            'grant_type'    =>  'refresh_token',
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'refresh_token'  =>  'abcdef',
+        ));
+
        $this->assertArrayHasKey('access_token', $v);
        $this->assertArrayHasKey('token_type', $v);
        $this->assertArrayHasKey('expires', $v);
@@ -265,6 +310,7 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
        $this->session->shouldReceive('getScopes')->andReturn(array('id'    =>  1));
        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('removeRefreshToken')->andReturn(1);
        $this->session->shouldReceive('associateScope')->andReturn(null);

        $a = $this->returnDefault();
@@ -279,6 +325,52 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
            'refresh_token'  =>  'abcdef',
        ));

+        $this->assertArrayHasKey('access_token', $v);
+        $this->assertArrayHasKey('token_type', $v);
+        $this->assertArrayHasKey('expires', $v);
+        $this->assertArrayHasKey('expires_in', $v);
+
+        $this->assertNotEquals($a->getAccessTokenTTL(), $v['expires_in']);
+        $this->assertNotEquals(time()+$a->getAccessTokenTTL(), $v['expires']);
+        $this->assertEquals(30, $v['expires_in']);
+        $this->assertEquals(time()+30, $v['expires']);
+    }
+
+    public function test_issueAccessToken_refreshTokenGrant_newScopes()
+    {
+        $this->client->shouldReceive('getClient')->andReturn(array(
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'name'  =>  'Example Client'
+        ));
+
+        $this->session->shouldReceive('validateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('validateAuthCode')->andReturn(1);
+        $this->session->shouldReceive('updateSession')->andReturn(null);
+        $this->session->shouldReceive('updateRefreshToken')->andReturn(null);
+        $this->session->shouldReceive('getAccessToken')->andReturn(null);
+        $this->session->shouldReceive('getScopes')->andReturn(array(array('id' => 1, 'scope' => 'foo'), array('id' => 2, 'scope' => 'bar')));
+        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('removeRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('associateScope')->andReturn(null);
+        $this->scope->shouldReceive('getScope')->andReturn(array('id' => 1, 'scope' => 'foo'));
+
+        $a = $this->returnDefault();
+        $grant = new League\OAuth2\Server\Grant\RefreshToken($a);
+        $grant->setAccessTokenTTL(30);
+        $grant->rotateRefreshTokens(true);
+        $a->addGrantType($grant);
+
+        $v = $a->issueAccessToken(array(
+            'grant_type'    =>  'refresh_token',
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'refresh_token'  =>  'abcdef',
+            'scope' =>  'foo'
+        ));
+
        $this->assertArrayHasKey('access_token', $v);
        $this->assertArrayHasKey('token_type', $v);
        $this->assertArrayHasKey('expires', $v);
@@ -290,4 +382,44 @@ class Refresh_Token_test extends PHPUnit_Framework_TestCase
        $this->assertEquals(30, $v['expires_in']);
        $this->assertEquals(time()+30, $v['expires']);
    }
+
+    /**
+     * @expectedException        League\OAuth2\Server\Exception\ClientException
+     * @expectedExceptionCode    0
+     */
+    public function test_issueAccessToken_refreshTokenGrant_badNewScopes()
+    {
+        $this->client->shouldReceive('getClient')->andReturn(array(
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'redirect_uri'  =>  'http://foo/redirect',
+            'name'  =>  'Example Client'
+        ));
+
+        $this->session->shouldReceive('validateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('validateAuthCode')->andReturn(1);
+        $this->session->shouldReceive('updateSession')->andReturn(null);
+        $this->session->shouldReceive('updateRefreshToken')->andReturn(null);
+        $this->session->shouldReceive('getAccessToken')->andReturn(null);
+        $this->session->shouldReceive('getScopes')->andReturn(array(array('id' => 1, 'scope' => 'foo'), array('id' => 2, 'scope' => 'bar')));
+        $this->session->shouldReceive('associateAccessToken')->andReturn(1);
+        $this->session->shouldReceive('associateRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('removeRefreshToken')->andReturn(1);
+        $this->session->shouldReceive('associateScope')->andReturn(null);
+        $this->scope->shouldReceive('getScope')->andReturn(array('id' => 1, 'scope' => 'foo'));
+
+        $a = $this->returnDefault();
+        $grant = new League\OAuth2\Server\Grant\RefreshToken($a);
+        $grant->setAccessTokenTTL(30);
+        $grant->rotateRefreshTokens(true);
+        $a->addGrantType($grant);
+
+        $a->issueAccessToken(array(
+            'grant_type'    =>  'refresh_token',
+            'client_id' =>  1234,
+            'client_secret' =>  5678,
+            'refresh_token'  =>  'abcdef',
+            'scope' =>  'foobar'
+        ));
+    }
 }
--- a/tests/resource/ResourceServerTest.php
+++ b/tests/resource/ResourceServerTest.php
@@ -83,6 +83,24 @@ class Resource_Server_test extends PHPUnit_Framework_TestCase
 	    $method->invoke($s);
    }

+    /**
+     * @expectedException League\OAuth2\Server\Exception\InvalidAccessTokenException
+     */
+    public function test_determineAccessToken_brokenCurlRequest()
+    {
+        $_SERVER['HTTP_AUTHORIZATION'] = 'Bearer, Bearer abcdef';
+        $request = new League\OAuth2\Server\Util\Request(array(), array(), array(), array(), $_SERVER);
+
+        $s = $this->returnDefault();
+        $s->setRequest($request);
+
+        $reflector = new ReflectionClass($s);
+        $method = $reflector->getMethod('determineAccessToken');
+        $method->setAccessible(true);
+
+        $method->invoke($s);
+    }
+
    public function test_determineAccessToken_fromHeader()
    {
        $request = new League\OAuth2\Server\Util\Request();
@@ -106,6 +124,29 @@ class Resource_Server_test extends PHPUnit_Framework_TestCase
 	    $this->assertEquals('abcdef', $result);
    }

+    public function test_determineAccessToken_fromBrokenCurlHeader()
+    {
+        $request = new League\OAuth2\Server\Util\Request();
+
+        $requestReflector = new ReflectionClass($request);
+        $param = $requestReflector->getProperty('headers');
+        $param->setAccessible(true);
+        $param->setValue($request, array(
+            'Authorization' =>  'Bearer abcdef, Bearer abcdef'
+        ));
+        $s = $this->returnDefault();
+        $s->setRequest($request);
+
+        $reflector = new ReflectionClass($s);
+
+        $method = $reflector->getMethod('determineAccessToken');
+        $method->setAccessible(true);
+
+        $result = $method->invoke($s);
+
+        $this->assertEquals('abcdef', $result);
+    }
+
    public function test_determineAccessToken_fromMethod()
    {
    	$s = $this->returnDefault();
@@ -155,8 +196,8 @@ class Resource_Server_test extends PHPUnit_Framework_TestCase
    	));

    	$this->session->shouldReceive('getScopes')->andReturn(array(
-            array('key' =>  'foo'),
-            array('key' =>  'bar')
+            array('scope' =>  'foo'),
+            array('scope' =>  'bar')
        ));

   		$request = new League\OAuth2\Server\Util\Request();
--- a/tests/util/RequestTest.php
+++ b/tests/util/RequestTest.php
@@ -59,6 +59,20 @@ class Request_test extends PHPUnit_Framework_TestCase
 		$this->assertEquals(array('Host' => 'foobar.com'), $this->request->header());
 	}

+	function test_canonical_header()
+	{
+		$request = new League\OAuth2\Server\Util\Request(
+			array('foo' => 'bar'),
+			array('foo' => 'bar'),
+			array('foo' => 'bar'),
+			array('foo' => 'bar'),
+			array('HTTP_HOST' => 'foobar.com'),
+			array('authorization' => 'Bearer ajdfkljadslfjasdlkj')
+		);
+
+		$this->assertEquals('Bearer ajdfkljadslfjasdlkj', $request->header('Authorization'));
+	}
+
 	/**
 	 * @expectedException InvalidArgumentException
 	 */
Author	SHA1	Message	Date
Alex Bilbie	1d3bc85423	Merge branch 'release/3.0' # Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.	2013-12-02 18:44:48 +00:00
Alex Bilbie	10a4bf41ed	Version bump	2013-12-02 18:44:08 +00:00
Alex Bilbie	041104e2b1	Updated changelog	2013-12-02 18:43:42 +00:00
Alex Bilbie	031cf3064a	Moved some grant related functions into a trait to reduce duplicate code	2013-12-02 18:42:54 +00:00
Alex Bilbie	954ff19823	Removed suggested composer packages	2013-11-29 12:35:29 +00:00
Alex Bilbie	5bb1359ad7	Added some initial changelogs	2013-11-29 12:34:18 +00:00
Alex Bilbie	2bd61f040b	Updated minimum PHP requirement to 5.4+ to support future changes	2013-11-29 12:34:08 +00:00
Alex Bilbie	bacc9ce316	Added some extra keywords	2013-11-29 12:23:35 +00:00
Alex Bilbie	5ec2c24b5c	Removed build in DB providers, will be included in separate repos	2013-11-29 12:23:05 +00:00
Alex Bilbie	ec9a08af63	Updated .gitignore	2013-11-25 23:59:37 +00:00
Alex Bilbie	6cade987a2	Added html coverage	2013-11-25 23:59:10 +00:00
Alex Bilbie	44408b873f	Make sure $this is returned	2013-11-25 23:58:42 +00:00
Alex Bilbie	b4bfa69c88	Removed nyan cat printer	2013-11-25 23:52:45 +00:00
Alex Bilbie	9c3c70a5fb	Removed old build script	2013-11-25 23:52:25 +00:00
Alex Bilbie	556e9cc9ab	Merge pull request #101 from jackshakes/develop Update Implicit Grant token TTL and response structure	2013-11-25 15:05:22 -08:00
jlehner	d3158a830b	Update Implicit Grant Type with the following: - Added accessTokenTTL variable and setter method - Updated response in the completeFlow method to include all required parameters per OAuth2 spec - completeFlow function accounts for local grant TTL override	2013-09-26 14:40:56 -04:00
Alex Bilbie	4a71c376b8	Merge branch 'refs/heads/master' into develop Conflicts: .travis.yml README.md	2013-09-26 11:18:10 +01:00
Alex Bilbie	ed427cba37	Merge pull request #92 from hailwood/patch-1 Adding 'auto_approve' to client details array (with updated interface docs)	2013-09-26 03:07:07 -07:00
Alex Bilbie	a358835522	Merge pull request #100 from fotovio/develop Fixed Issues with Returns and Columns of Fluent Storage	2013-09-26 03:06:11 -07:00
Daniel Schniepp	23627c659e	Fixed issues with returns and columns	2013-09-25 16:59:45 +02:00
Alex Bilbie	bee71c1e83	Merge pull request #94 from daveWid/request-interface-cleanup Request interface cleanup	2013-09-08 03:23:26 -07:00
Alex Bilbie	ad97273455	Gave "bearer" a capital "B". Fixes #96	2013-09-07 18:00:13 +01:00
Alex Bilbie	0b55dc4c01	Gave "bearer" a capital "B"	2013-09-07 17:59:44 +01:00
Alex Bilbie	4985770d07	Gave "bearer" a capital "B"	2013-09-07 17:59:34 +01:00
Dave Widmer	a2bf4e0dfb	Removing constructor and buildFromGlobals from RequestInterface. Fixes: #88	2013-09-06 09:14:24 -04:00
Alex Bilbie	cfbb037e07	Removed all code coverage output except text to stdout	2013-09-06 10:39:08 +01:00
Alex Bilbie	6c28fea213	Merge pull request #87 from daveWid/normalize-headers Normalize headers	2013-09-06 02:36:54 -07:00
Matthew Hailwood	e5dc3001c4	Update ClientInterface.php	2013-09-04 12:43:12 +12:00
Matthew Hailwood	69531c3eb5	Adding auto_approve field to client details array.	2013-09-04 12:38:45 +12:00
Phil Sturgeon	89f3446b98	Merge pull request #79 from reinink/patch-1 Fixed link to authorization server guide.	2013-08-27 09:01:16 -07:00
Dave Widmer	69710a5909	Normalizing headers to a Ucfirst-With-Dashes format.	2013-08-20 11:40:02 -04:00
Phil Sturgeon	85353c5844	Test in PHP 5.5 too	2013-08-08 09:25:17 -04:00
Alex Bilbie	879d98abfb	Merge pull request #84 from nhorvath/develop Update Implicit.php	2013-08-02 11:58:01 -07:00
nhorvath	f612e105bd	Update Implicit.php Fix typo in class name. Change "Implict" to "Implicit"	2013-08-02 14:51:13 -04:00
Alex Bilbie	56f63bb4c0	Added printer, don't test anything in vendor/	2013-07-30 10:17:59 +01:00
Alex Bilbie	8a42bc796f	Removed printer [ci skip]	2013-07-30 10:13:47 +01:00
Alex Bilbie	8fa7b303fa	Added Nyan printer for the lolz	2013-07-30 10:10:59 +01:00
Alex Bilbie	55b86e26ad	[ci skip]	2013-07-30 10:10:29 +01:00
toopay	e1f09db6af	update composer	2013-07-27 07:34:46 +07:00
toopay	1e28faabb9	Blacklist all vendors	2013-07-27 06:56:40 +07:00
toopay	9a3a91760a	Update composer	2013-07-27 06:47:21 +07:00
toopay	78d65e102a	update travis	2013-07-27 06:47:10 +07:00
toopay	701010b129	Update travis	2013-07-27 06:32:04 +07:00
toopay	84afff9ad2	Default phpunit config that will be ignored if phpunit.xml exists	2013-07-27 06:31:15 +07:00
toopay	cfc61147e1	Add phpunit coverage listener	2013-07-27 06:29:46 +07:00
Jonathan Reinink	66ddba808f	Fixed link to authorization server guide.	2013-07-26 10:04:09 -04:00
Alex Bilbie	6324a97118	Added badges [ci skip]	2013-07-26 11:08:24 +01:00
Alex Bilbie	4170f4e841	Update .travis.yml	2013-07-26 10:56:23 +01:00
Alex Bilbie	5c21370691	Added `satooshi/php-coveralls` to composer.json [ci skip]	2013-07-26 10:55:56 +01:00
Phil Sturgeon	c176c1cddc	Added contributors	2013-07-24 13:14:48 -04:00
Alex Bilbie	71b6f2c2bc	Merge pull request #78 from philipbrown/fix_fluent_client_argument_default Fix fluent client argument default	2013-07-18 09:11:31 -07:00
Philip Brown	f1567df802	Set $grantType default	2013-07-17 11:40:06 +01:00
Alex Bilbie	307964d571	Fixed missing $this	2013-06-18 18:27:34 +01:00
Alex Bilbie	a1ca904255	Merge branch 'develop' of github.com:php-loep/oauth2-server into develop	2013-06-18 18:17:02 +01:00
Alex Bilbie	6e045afa26	Merge pull request #70 from gstjohn/master Fix to docblocks	2013-06-08 04:28:34 -07:00
Garrett St. John	8f15158d1c	Fix to docblocks	2013-06-06 14:00:17 -07:00
Garrett St. John	ca4e749986	Fix to docblocks	2013-06-06 13:09:15 -07:00
Alex Bilbie	cc0ab4905a	Merge pull request #68 from jasongrimes/public-determineAccessToken Make determineAccessToken() public	2013-06-06 06:52:12 -07:00
Jason Grimes	e5a48c929b	Make determineAccessToken() public in order to check if an access token was sent before checking its validity.	2013-06-05 23:59:29 -04:00
Alex Bilbie	829cef936a	mErge branch 'feature/fluent' into develop	2013-06-02 14:59:31 +01:00
Alex Bilbie	f78e05cb08	Anal space fixes	2013-06-02 14:59:05 +01:00
Alex Bilbie	0999bf4de3	Added missing functions	2013-06-02 14:58:59 +01:00
Alex Bilbie	e442253e26	Anal spacing fixes and removed PHP5.4+ specific array syntax	2013-06-02 14:58:52 +01:00
Alex Bilbie	4c4155fdac	Added \Illuminate\Support\Facades\DB namespace	2013-06-02 14:54:49 +01:00
Alex Bilbie	d901e90602	Added \Illuminate\Support\Facades\DB namespace	2013-06-02 14:41:38 +01:00
Alex Bilbie	32a7ed38a9	Updated PSR compliance. Added Illuminate\Support\Facades\DB namespace	2013-06-02 14:40:59 +01:00
Alex Bilbie	9dec6c4bfe	Added Doctrine/DBAL implementation of storage classes (thanks @inanimatt)	2013-06-02 14:25:06 +01:00
Alex Bilbie	bcfb9ec475	Merge branch 'release/2.1.1' into develop	2013-06-02 13:55:12 +01:00
Alex Bilbie	98be9ab252	Merge branch 'release/2.1.1'	2013-06-02 13:55:01 +01:00
Alex Bilbie	e0f4ccb775	Updated changelog	2013-06-02 13:54:54 +01:00
Alex Bilbie	dca0898c2f	Version bump	2013-06-02 13:54:47 +01:00
Alex Bilbie	7da9e1a9d7	Merge pull request #64 from alexmcroberts/develop Conditional isValid flag to check for Authorization header only. Fixes #57	2013-06-02 05:46:45 -07:00
Alex McRoberts	a4a8f6e661	This fixes #57 . By passing in a conditional flag refering to headersOnly, the library would stil respect RFC6749 Section 7 and RFC6750 Section 2.	2013-05-27 21:27:30 -07:00
Alex Bilbie	a9ecca92fc	Fixed broken test	2013-05-27 19:38:07 +01:00
Alex Bilbie	47c24e3181	Corrected array key call. Fixes #63	2013-05-27 20:33:07 +02:00
Alex Bilbie	4d36ebd3e7	Added namespaces	2013-05-14 09:50:40 +01:00
Alex Bilbie	0b3a9dc888	Converted PHP 5.4 array syntax to old-skool syntax	2013-05-14 09:46:14 +01:00
Alex Bilbie	1fcdbf45b2	Removed docblocks	2013-05-14 09:45:19 +01:00
Alex Bilbie	94a064e2f4	Added fluent storage from #54	2013-05-14 09:44:12 +01:00
Alex Bilbie	92b6ce3335	Added default value for final argument in ClientInterface::getClient(). Fixes #56	2013-05-14 09:00:36 +01:00
Alex Bilbie	ee9549287e	Updated docblocks	2013-05-14 08:59:53 +01:00
Alex Bilbie	4b3e0bf668	Fixed semantic meaning of `requireScopeParam()` and `requireStateParam()` by changing their default value to true	2013-05-10 23:01:54 -07:00
Alex Bilbie	05d4b68586	Optimised regex and re-added trim() following conversation in #52	2013-05-10 23:00:47 -07:00
Alex Bilbie	ec9c39c108	Merge branch 'release/2.1' into develop	2013-05-10 17:59:37 -07:00
Alex Bilbie	5d0b295a82	Merge branch 'release/2.1'	2013-05-10 17:59:29 -07:00
Alex Bilbie	9ec5442f90	Updated changelog	2013-05-10 17:59:08 -07:00
Alex Bilbie	4112913813	Version bump	2013-05-10 17:58:57 -07:00
Alex Bilbie	5eb4227709	Merge branch 'feature/auth-code-scopes' into develop. Fixes #44	2013-05-10 17:42:05 -07:00
Alex Bilbie	f5251a6080	Updated sessions	2013-05-10 17:39:29 -07:00
Alex Bilbie	86fb02d218	Added cascading relationship between oauth_sessions_authcodes and oauth_sessions	2013-05-10 17:32:39 -07:00
Alex Bilbie	ef4a138237	Fixed associateAuthCodeScope() query	2013-05-10 17:29:28 -07:00
Alex Bilbie	d531a37412	Don't add scope IDs	2013-05-10 17:26:23 -07:00
Alex Bilbie	ca599437f6	Added oauth_session_authcode_scopes	2013-05-10 17:24:46 -07:00
Alex Bilbie	252afddbd3	Updated oauth_session_authcodes table. Added id field, remove scope_ids field	2013-05-10 17:24:31 -07:00
Alex Bilbie	c57c4b1b4f	Fixed key name	2013-05-10 17:19:53 -07:00
Alex Bilbie	ba2dc90f3b	Altered associateScope logic	2013-05-10 17:08:20 -07:00
Alex Bilbie	7373f312da	Updated variable name	2013-05-10 17:08:10 -07:00
Alex Bilbie	a01810d8fa	Updated validateAuthCode in PDO Session	2013-05-10 17:07:29 -07:00
Alex Bilbie	3ea3eb5ebd	Implemented getAuthCodeScopes() in PDO Session	2013-05-10 17:07:06 -07:00
Alex Bilbie	11022e16ef	Updated validateAuthCode() in SessionInterface	2013-05-10 17:06:44 -07:00
Alex Bilbie	8d06a7b685	Updated getAuthCodeScopes() in SessionInterface	2013-05-10 17:06:05 -07:00
Alex Bilbie	c66c8092f9	Revert "Return the session_id for validateAuthCode instead of an array" This reverts commit `51138f8738`.	2013-05-10 16:57:39 -07:00
Alex Bilbie	591139f44d	Added associateAuthCodeScope to PDO	2013-05-10 16:57:18 -07:00
Alex Bilbie	410ad09b5c	Updated PDO associateAuthCode	2013-05-10 16:56:38 -07:00
Alex Bilbie	51138f8738	Return the session_id for validateAuthCode instead of an array	2013-05-10 16:53:52 -07:00
Alex Bilbie	aa8d38108f	Associate scopes to auth codes in separate method. Creating an auth code now returns an ID	2013-05-10 16:53:21 -07:00
Alex Bilbie	9372cc85d0	Added getAuthCodeScopes() method	2013-05-10 16:50:34 -07:00
Alex Bilbie	accb80289f	Added associateAuthCodeScope() method	2013-05-10 16:50:13 -07:00
Alex Bilbie	e591fbb25c	Merge branch 'feature/refresh-token-rotation' into develop	2013-05-10 16:13:22 -07:00
Alex Bilbie	fdb89fb5e4	Updated tests	2013-05-10 16:13:11 -07:00
Alex Bilbie	ce51821043	If rotateRefreshTokens() is true then associate new access tokens	2013-05-10 16:13:06 -07:00
Alex Bilbie	eac33d50b3	Added missing semicolon	2013-05-10 16:12:43 -07:00
Alex Bilbie	2552b73b17	Added rotateRefreshTokens() method	2013-05-10 16:00:40 -07:00
Alex Bilbie	8c4019693b	Updated @ziege's patch to overcome awkward access token definition requirement (i.e. access token can have a space in it) and also optimised code. Fixes #52	2013-05-10 12:57:34 -07:00
ziege	b88ef82563	Fixed two probems in access token check 1) The method returned the wrong result in case when the access token itself contained the string "Bearer". 2) When using cURL, the request is sometimes send twice (in my case when the first request returned a 404 error), and the Authorization header of the second request is doubled, so that you get a "Authorization: Bearer XXX, Bearer XXX". This case is checked now. (BTW: Tested with the current PHP version 5.4.15 on Windows.)	2013-05-10 20:00:01 +02:00
Alex Bilbie	3e5b4a1735	Move zetacomponents/database to "suggest" in composer.json. Fixes #51	2013-05-10 10:13:17 -07:00
Alex Bilbie	41a7125370	Accidentally used PHP 5.4 style bracket	2013-05-09 11:48:21 -07:00
Alex Bilbie	c40484abb1	Merge branch 'feature/refresh-token-rewrite' into develop	2013-05-09 11:42:31 -07:00
Alex Bilbie	f4bcfee687	Update associated scopes if requested in refresh access token. Fixes #47	2013-05-09 11:42:28 -07:00
Alex Bilbie	6d8eb9d05e	Added removeRefreshToken method to SessionInterface	2013-05-09 11:40:29 -07:00
Alex Bilbie	76f2f6a5e1	Don't delete old sessions when issuing new access tokens using the Password or Client Credential grants. Fixes #32	2013-05-09 10:43:44 -07:00
Alex Bilbie	d677b765b2	Renamed scopes.key to scopes.scope. Updated ScopeInterface and PDO/Scope. Fixes #45	2013-05-09 10:23:41 -07:00
Alex Bilbie	7035792325	Allow for multiple default scopes. Fixes #42	2013-05-09 10:15:36 -07:00
Alex Bilbie	351c2e97ea	If scope parameter is required and there are not requested scopes AND there is no default scope set then fail Should have been included in with previous commit	2013-05-09 10:06:44 -07:00
Alex Bilbie	ddefb2ee16	Set the scope parameter to not be required by default. Fixes #43	2013-05-09 10:02:41 -07:00
Alex Bilbie	c3b41a5e8a	Merge branch 'release/2.0.5' into develop	2013-05-09 09:47:33 -07:00
Alex Bilbie	b16c58bfe1	mErge branch 'release/2.0.5'	2013-05-09 09:47:21 -07:00
Alex Bilbie	e6d0a19e8f	Version bump	2013-05-09 09:47:11 -07:00
Alex Bilbie	2296d09e92	Changelog update	2013-05-09 09:47:07 -07:00
Alex Bilbie	69af252844	Fixed docblock	2013-05-09 09:45:10 -07:00
Alex Bilbie	d9c598af3c	Removed `DEFAULT ''` that has slipped in	2013-05-09 09:38:08 -07:00
Alex Bilbie	3cb79fc2b5	Fixed oauth_session_token_scopes primary key	2013-05-09 09:31:05 -07:00
Alex Bilbie	39379fe5b6	Merge branch 'release/2.0.4' into develop	2013-05-09 08:01:45 -07:00