Merge pull request #918 from Sephster/fix-914

Fix empty issue in PHP 5.4

.gitignore

@@ -11,4 +11,5 @@
 /tests/codecept/tests/_log
 oauth2-server.paw
 /output_*/
-/_site
+/_site
+.idea

.scrutinizer.yml

@@ -21,8 +21,7 @@ checks:
         fix_doc_comments: true
 tools:
     external_code_coverage:
-        timeout: 600
+        timeout: 1800
-        runs: 3
     php_code_coverage: false
     php_code_sniffer:
         config:
@@ -34,4 +33,4 @@ tools:
         excluded_dirs: [vendor, tests, examples]
     php_cpd:
         enabled: true
-        excluded_dirs: [vendor, tests, examples]
+        excluded_dirs: [vendor, tests, examples]

.travis.yml

@@ -1,18 +1,56 @@
 language: php
 
+sudo: false
+
+cache:
+  directories:
+  - vendor
+
 php:
   - 5.4
   - 5.5
   - 5.6
+  - 7.0
   - hhvm
+  
+matrix:
+  allow_failures:
+    - php: 7.0
+  fast_finish: true
 
 install:
   - travis_retry composer install --no-interaction --prefer-source
 
 script:
   - mkdir -p build/logs
-  - phpunit --coverage-text --verbose --coverage-clover=coverage.clover
+  - phpunit --coverage-text --verbose --coverage-clover=coverage.clover --coverage-html coverage
 
 after_script:
-  - wget https://scrutinizer-ci.com/ocular.phar
+  - bash -c 'if [ "$TRAVIS_PHP_VERSION" == "5.6" ]; then wget https://scrutinizer-ci.com/ocular.phar; fi;
-  - php ocular.phar code-coverage:upload --format=php-clover coverage.clover
+  - bash -c 'if [ "$TRAVIS_PHP_VERSION" == "5.6" ]; then php ocular.phar code-coverage:upload --format=php-clover coverage.clover; fi;
+  - git config --global user.email "travis@travis-ci.org"
+  - git config --global user.name "TravisCI"
+  - cp -R coverage ${HOME}/coverage
+  - cd ${HOME}
+  - git clone --quiet --branch=gh-pages https://${GITHUBTOKEN}@github.com/thephpleague/oauth2-server.git gh-pages > /dev/null
+  - cd gh-pages
+  - mkdir ${TRAVIS_BRANCH}
+  - cd ${TRAVIS_BRANCH}
+  - cp -Rf $HOME/coverage/* .
+  - git add -f .
+  - git commit -m "Travis pushed coverage of ${TRAVIS_COMMIT}@${TRAVIS_BRANCH} to gh-pages"
+  - git push -fq origin gh-pages > /dev/null
+branches:
+  only:
+    - master
+env:
+  global:
+    secure: "C4wD/BQefKSu9W594iyLp+IBCjlM8kKlmp+nXKXnZGi0L8IkV3m4mmNOb8PExxGMhZ3mlev5DnU4Uoh4oJaUxnkR1FpX4dSEpyzU3VknUzSE2yZOlL+bdCw3o85TGoCcp/+ReJCOw5sncxTskJKHlW1YMa33FznaXwLNoImpjTg="
+
+notifications:
+  webhooks:
+    urls:
+      - https://webhooks.gitter.im/e/7de0ca12596cd5268f30
+    on_success: always  # options: [always|never|change] default: always
+    on_failure: always  # options: [always|never|change] default: always
+    on_start: false     # default: false

CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 4.1.6 (released 2016-09-13)
+
+* Less restrictive on Authorization header check (Issue #652)
+
+## 4.1.5 (released 2016-01-04)
+
+* Enable Symfony 3.0 support (#412)
+
+## 4.1.4 (released 2015-11-13)
+
+* Fix for determining access token in header (Issue #328)
+* Refresh tokens are now returned for MAC responses (Issue #356)
+* Added integration list to readme (Issue #341)
+* Expose parameter passed to exceptions (Issue #345)
+* Removed duplicate routing setup code (Issue #346)
+* Docs fix (Issues #347, #360, #380)
+* Examples fix (Issues #348, #358)
+* Fix typo in docblock (Issue #352)
+* Improved timeouts for MAC tokens (Issue #364)
+* `hash_hmac()` should output raw binary data, not hexits (Issue #370)
+* Improved regex for matching all Base64 characters (Issue #371)
+* Fix incorrect signature parameter (Issue #372)
+* AuthCodeGrant and RefreshTokenGrant don't require client_secret (Issue #377)
+* Added priority argument to event listener (Issue #388)
+
+## 4.1.3 (released 2015-03-22)
+
+* Docblock, namespace and inconsistency fixes (Issue #303)
+* Docblock type fix (Issue #310)
+* Example bug fix (Issue #300)
+* Updated league/event to ~2.1 (Issue #311)
+* Fixed missing session scope (Issue #319)
+* Updated interface docs (Issue #323)
+* `.travis.yml` updates
+
+## 4.1.2 (released 2015-01-01)
+
+* Remove side-effects in hash_equals() implementation (Issue #290)
+
+## 4.1.1 (released 2014-12-31)
+
+* Changed `symfony/http-foundation` dependency version to `~2.4` so package can be installed in Laravel `4.1.*`
+
+## 4.1.0 (released 2014-12-27)
+
+* Added MAC token support (Issue #158)
+* Fixed example init code (Issue #280)
+* Toggle refresh token rotation (Issue #286)
+* Docblock fixes
+
+## 4.0.5 (released 2014-12-15)
+
+* Prevent duplicate session in auth code grant (Issue #282)
+
 ## 4.0.4 (released 2014-12-03)
 
 * Ensure refresh token hasn't expired (Issue #270)

README.md

@@ -5,7 +5,7 @@
 [![Build Status](https://img.shields.io/travis/thephpleague/oauth2-server/master.svg?style=flat-square)](https://travis-ci.org/thephpleague/oauth2-server)
 [![Coverage Status](https://img.shields.io/scrutinizer/coverage/g/thephpleague/oauth2-server.svg?style=flat-square)](https://scrutinizer-ci.com/g/thephpleague/oauth2-server/code-structure)
 [![Quality Score](https://img.shields.io/scrutinizer/g/thephpleague/oauth2-server.svg?style=flat-square)](https://scrutinizer-ci.com/g/thephpleague/oauth2-server)
-[![Total Downloads](https://img.shields.io/packagist/dt/league/oauth2-server.svg?style=flat-square)](https://packagist.org/packages/league/oauth2-server)
+[![Total Downloads](https://img.shields.io/packagist/dt/league/oauth2-server.svg?style=flat-square)](https://packagist.org/packages/league/oauth2-server) [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/thephpleague/oauth2-server?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
 
 
 A standards compliant [OAuth 2.0](http://tools.ietf.org/wg/oauth/draft-ietf-oauth-v2/) authorization server and resource server written in PHP which makes working with OAuth 2.0 trivial. You can easily configure an OAuth 2.0 server to protect your API with access tokens, or allow clients to request new access tokens and refresh them.
@@ -22,9 +22,11 @@ You can also define your own grants.
 In addition it supports the following token types:
 
 * Bearer tokens
-* MAC tokens (coming soon)
+* MAC tokens
 * JSON web tokens (coming soon)
 
+You can also create you own tokens.
+
 
 ## Requirements
 
@@ -49,10 +51,19 @@ Contribute to this documentation in the [gh-pages branch](https://github.com/the
 
 Please see [CONTRIBUTING](https://github.com/thephpleague/oauth2-server/blob/master/CONTRIBUTING.md) for details.
 
+## Integration
+
+- [CakePHP 3](https://github.com/uafrica/oauth-server)
+- [Laravel](https://github.com/lucadegasperi/oauth2-server-laravel)
+
 ## Support
 
 Bugs and feature request are tracked on [GitHub](https://github.com/thephpleague/oauth2-server/issues)
 
+## Security
+
+If you discover any security related issues, please email hello@alexbilbie.com instead of using the issue tracker.
+
 ## License
 
 This package is released under the MIT License. See the bundled [LICENSE](https://github.com/thephpleague/oauth2-server/blob/master/LICENSE) file for details.

composer.json

@@ -5,8 +5,8 @@
 	"license": "MIT",
 	"require": {
 		"php": ">=5.4.0",
-		"symfony/http-foundation": "~2.5",
+		"symfony/http-foundation": "~2.4|~3.0",
-		"league/event": "1.0.*"
+		"league/event": "~2.1"
 	},
 	"require-dev": {
 		"phpunit/phpunit": "4.3.*",

examples/relational/Model/Users.php

@@ -20,6 +20,6 @@ class Users
             return $result;
         }
 
-        return null;
+        return;
     }
 }

examples/relational/Storage/AccessTokenStorage.php

@@ -3,7 +3,6 @@
 namespace RelationalExample\Storage;
 
 use Illuminate\Database\Capsule\Manager as Capsule;
-use League\OAuth2\Server\Entity\AbstractTokenEntity;
 use League\OAuth2\Server\Entity\AccessTokenEntity;
 use League\OAuth2\Server\Entity\ScopeEntity;
 use League\OAuth2\Server\Storage\AbstractStorage;
@@ -28,7 +27,7 @@ class AccessTokenStorage extends AbstractStorage implements AccessTokenInterface
             return $token;
         }
 
-        return null;
+        return;
     }
 
     /**
@@ -87,7 +86,7 @@ class AccessTokenStorage extends AbstractStorage implements AccessTokenInterface
      */
     public function delete(AccessTokenEntity $token)
     {
-        Capsule::table('oauth_access_token_scopes')
+        Capsule::table('oauth_access_tokens')
                     ->where('access_token', $token->getId())
                     ->delete();
     }

examples/relational/Storage/AuthCodeStorage.php

@@ -29,7 +29,7 @@ class AuthCodeStorage extends AbstractStorage implements AuthCodeInterface
             return $token;
         }
 
-        return null;
+        return;
     }
 
     public function create($token, $expireTime, $sessionId, $redirectUri)

examples/relational/Storage/ClientStorage.php

@@ -41,7 +41,7 @@ class ClientStorage extends AbstractStorage implements ClientInterface
             return $client;
         }
 
-        return null;
+        return;
     }
 
     /**
@@ -65,6 +65,6 @@ class ClientStorage extends AbstractStorage implements ClientInterface
             return $client;
         }
 
-        return null;
+        return;
     }
 }

examples/relational/Storage/RefreshTokenStorage.php

@@ -27,7 +27,7 @@ class RefreshTokenStorage extends AbstractStorage implements RefreshTokenInterfa
             return $token;
         }
 
-        return null;
+        return;
     }
 
     /**

examples/relational/Storage/ScopeStorage.php

@@ -19,7 +19,7 @@ class ScopeStorage extends AbstractStorage implements ScopeInterface
                                 ->get();
 
         if (count($result) === 0) {
-            return null;
+            return;
         }
 
         return (new ScopeEntity($this->server))->hydrate([

examples/relational/Storage/SessionStorage.php

@@ -31,7 +31,7 @@ class SessionStorage extends AbstractStorage implements SessionInterface
             return $session;
         }
 
-        return null;
+        return;
     }
 
     /**
@@ -53,7 +53,7 @@ class SessionStorage extends AbstractStorage implements SessionInterface
             return $session;
         }
 
-        return null;
+        return;
     }
 
     /**

examples/relational/api.php

@@ -9,11 +9,6 @@ use RelationalExample\Storage;
 
 include __DIR__.'/vendor/autoload.php';
 
-// Routing setup
-$request = (new Request())->createFromGlobals();
-$router = new \Orno\Route\RouteCollection();
-$router->setStrategy(\Orno\Route\RouteStrategyInterface::RESTFUL_STRATEGY);
-
 // Set up the OAuth 2.0 resource server
 $sessionStorage = new Storage\SessionStorage();
 $accessTokenStorage = new Storage\AccessTokenStorage();
@@ -34,12 +29,14 @@ $router = new \Orno\Route\RouteCollection();
 // GET /tokeninfo
 $router->get('/tokeninfo', function (Request $request) use ($server) {
 
+    $accessToken = $server->getAccessToken();
+    $session = $server->getSessionStorage()->getByAccessToken($accessToken);
     $token = [
-        'owner_id'  =>  $server->getOwnerId(),
+        'owner_id' => $session->getOwnerId(),
-        'owner_type'  =>  $server->getOwnerType(),
+        'owner_type' => $session->getOwnerType(),
-        'access_token'  =>  $server->getAccessToken(),
+        'access_token' => $accessToken,
-        'client_id'  =>  $server->getClientId(),
+        'client_id' => $session->getClient()->getId(),
-        'scopes'  =>  $server->getScopes(),
+        'scopes' => $accessToken->getScopes(),
     ];
 
     return new Response(json_encode($token));
@@ -59,11 +56,11 @@ $router->get('/users', function (Request $request) use ($server) {
             'name'      =>  $result['name'],
         ];
 
-        if ($server->hasScope('email')) {
+        if ($server->getAccessToken()->hasScope('email')) {
             $user['email'] = $result['email'];
         }
 
-        if ($server->hasScope('photo')) {
+        if ($server->getAccessToken()->hasScope('photo')) {
             $user['photo'] = $result['photo'];
         }
 
@@ -74,7 +71,7 @@ $router->get('/users', function (Request $request) use ($server) {
 });
 
 // GET /users/{username}
-$router->get('/users/{username}', function (Request $request, $args) use ($server) {
+$router->get('/users/{username}', function (Request $request, Response $response, array $args) use ($server) {
 
     $result = (new Model\Users())->get($args['username']);
 
@@ -87,11 +84,11 @@ $router->get('/users/{username}', function (Request $request, $args) use ($serve
         'name'      =>  $result[0]['name'],
     ];
 
-    if ($server->hasScope('email')) {
+    if ($server->getAccessToken()->hasScope('email')) {
         $user['email'] = $result[0]['email'];
     }
 
-    if ($server->hasScope('photo')) {
+    if ($server->getAccessToken()->hasScope('photo')) {
         $user['photo'] = $result[0]['photo'];
     }
 

examples/relational/config/init.php

@@ -102,7 +102,7 @@ Capsule::table('oauth_scopes')->insert([
 print 'Creating sessions table'.PHP_EOL;
 
 Capsule::schema()->create('oauth_sessions', function ($table) {
-    $table->increments('id');
+    $table->increments('id')->unsigned();
     $table->string('owner_type');
     $table->string('owner_id');
     $table->string('client_id');
@@ -135,7 +135,7 @@ print 'Creating access tokens table'.PHP_EOL;
 
 Capsule::schema()->create('oauth_access_tokens', function ($table) {
     $table->string('access_token')->primary();
-    $table->integer('session_id');
+    $table->integer('session_id')->unsigned();
     $table->integer('expire_time');
 
     $table->foreign('session_id')->references('id')->on('oauth_sessions')->onDelete('cascade');
@@ -168,7 +168,7 @@ Capsule::schema()->create('oauth_refresh_tokens', function ($table) {
     $table->integer('expire_time');
     $table->string('access_token');
 
-    $table->foreign('access_token')->references('id')->on('oauth_access_tokens')->onDelete('cascade');
+    $table->foreign('access_token')->references('access_token')->on('oauth_access_tokens')->onDelete('cascade');
 });
 
 /******************************************************************************/
@@ -177,7 +177,7 @@ print 'Creating auth codes table'.PHP_EOL;
 
 Capsule::schema()->create('oauth_auth_codes', function ($table) {
     $table->string('auth_code')->primary();
-    $table->integer('session_id');
+    $table->integer('session_id')->unsigned();
     $table->integer('expire_time');
     $table->string('client_redirect_uri');
 
@@ -189,7 +189,7 @@ Capsule::schema()->create('oauth_auth_codes', function ($table) {
 print 'Creating oauth access token scopes table'.PHP_EOL;
 
 Capsule::schema()->create('oauth_access_token_scopes', function ($table) {
-    $table->increments('id');
+    $table->increments('id')->unsigned();
     $table->string('access_token');
     $table->string('scope');
 
@@ -240,8 +240,8 @@ Capsule::schema()->create('oauth_auth_code_scopes', function ($table) {
 print 'Creating oauth session scopes table'.PHP_EOL;
 
 Capsule::schema()->create('oauth_session_scopes', function ($table) {
-    $table->increments('id');
+    $table->increments('id')->unsigned();
-    $table->string('session_id');
+    $table->integer('session_id')->unsigned();
     $table->string('scope');
 
     $table->foreign('session_id')->references('id')->on('oauth_sessions')->onDelete('cascade');

src/AbstractServer.php

@@ -15,6 +15,7 @@ use League\Event\Emitter;
 use League\OAuth2\Server\Storage\AccessTokenInterface;
 use League\OAuth2\Server\Storage\AuthCodeInterface;
 use League\OAuth2\Server\Storage\ClientInterface;
+use League\OAuth2\Server\Storage\MacTokenInterface;
 use League\OAuth2\Server\Storage\RefreshTokenInterface;
 use League\OAuth2\Server\Storage\ScopeInterface;
 use League\OAuth2\Server\Storage\SessionInterface;
@@ -24,7 +25,6 @@ use Symfony\Component\HttpFoundation\Request;
 /**
  * OAuth 2.0 Resource Server
  */
-
 abstract class AbstractServer
 {
     /**
@@ -36,48 +36,61 @@ abstract class AbstractServer
 
     /**
      * Session storage
+     *
      * @var \League\OAuth2\Server\Storage\SessionInterface
      */
     protected $sessionStorage;
 
     /**
      * Access token storage
+     *
      * @var \League\OAuth2\Server\Storage\AccessTokenInterface
      */
     protected $accessTokenStorage;
 
     /**
      * Refresh token storage
+     *
      * @var \League\OAuth2\Server\Storage\RefreshTokenInterface
      */
     protected $refreshTokenStorage;
 
     /**
      * Auth code storage
+     *
      * @var \League\OAuth2\Server\Storage\AuthCodeInterface
      */
     protected $authCodeStorage;
 
     /**
      * Scope storage
+     *
      * @var \League\OAuth2\Server\Storage\ScopeInterface
      */
     protected $scopeStorage;
 
     /**
      * Client storage
+     *
      * @var \League\OAuth2\Server\Storage\ClientInterface
      */
     protected $clientStorage;
 
+    /**
+     * @var \League\OAuth2\Server\Storage\MacTokenInterface
+     */
+    protected $macStorage;
+
     /**
      * Token type
+     *
      * @var \League\OAuth2\Server\TokenType\TokenTypeInterface
      */
     protected $tokenType;
 
     /**
      * Event emitter
+     *
      * @var \League\Event\Emitter
      */
     protected $eventEmitter;
@@ -92,6 +105,7 @@ abstract class AbstractServer
 
     /**
      * Set an event emitter
+     *
      * @param object $emitter Event emitter object
      */
     public function setEventEmitter($emitter = null)
@@ -105,16 +119,19 @@ abstract class AbstractServer
 
     /**
      * Add an event listener to the event emitter
+     *
      * @param string   $eventName Event name
      * @param callable $listener  Callable function or method
+     * @param int      $priority  Priority of event listener
      */
-    public function addEventListener($eventName, callable $listener)
+    public function addEventListener($eventName, callable $listener, $priority = Emitter::P_NORMAL)
     {
-        $this->eventEmitter->addListener($eventName, $listener);
+        $this->eventEmitter->addListener($eventName, $listener, $priority);
     }
 
     /**
      * Returns the event emitter
+     *
      * @return \League\Event\Emitter
      */
     public function getEventEmitter()
@@ -124,7 +141,9 @@ abstract class AbstractServer
 
     /**
      * Sets the Request Object
+     *
      * @param \Symfony\Component\HttpFoundation\Request The Request Object
+     *
      * @return self
      */
     public function setRequest($request)
@@ -136,6 +155,7 @@ abstract class AbstractServer
 
     /**
      * Gets the Request object. It will create one from the globals if one is not set.
+     *
      * @return \Symfony\Component\HttpFoundation\Request
      */
     public function getRequest()
@@ -149,7 +169,9 @@ abstract class AbstractServer
 
     /**
      * Set the client storage
-     * @param  \League\OAuth2\Server\Storage\ClientInterface $storage
+     *
+     * @param \League\OAuth2\Server\Storage\ClientInterface $storage
+     *
      * @return self
      */
     public function setClientStorage(ClientInterface $storage)
@@ -162,7 +184,9 @@ abstract class AbstractServer
 
     /**
      * Set the session storage
-     * @param  \League\OAuth2\Server\Storage\SessionInterface $storage
+     *
+     * @param \League\OAuth2\Server\Storage\SessionInterface $storage
+     *
      * @return self
      */
     public function setSessionStorage(SessionInterface $storage)
@@ -175,7 +199,9 @@ abstract class AbstractServer
 
     /**
      * Set the access token storage
-     * @param  \League\OAuth2\Server\Storage\AccessTokenInterface $storage
+     *
+     * @param \League\OAuth2\Server\Storage\AccessTokenInterface $storage
+     *
      * @return self
      */
     public function setAccessTokenStorage(AccessTokenInterface $storage)
@@ -188,7 +214,9 @@ abstract class AbstractServer
 
     /**
      * Set the refresh token storage
-     * @param  \League\OAuth2\Server\Storage\RefreshTokenInterface $storage
+     *
+     * @param \League\OAuth2\Server\Storage\RefreshTokenInterface $storage
+     *
      * @return self
      */
     public function setRefreshTokenStorage(RefreshTokenInterface $storage)
@@ -201,7 +229,9 @@ abstract class AbstractServer
 
     /**
      * Set the auth code storage
-     * @param  \League\OAuth2\Server\Storage\AuthCodeInterface $storage
+     *
+     * @param \League\OAuth2\Server\Storage\AuthCodeInterface $storage
+     *
      * @return self
      */
     public function setAuthCodeStorage(AuthCodeInterface $storage)
@@ -214,7 +244,9 @@ abstract class AbstractServer
 
     /**
      * Set the scope storage
-     * @param  \League\OAuth2\Server\Storage\ScopeInterface $storage
+     *
+     * @param \League\OAuth2\Server\Storage\ScopeInterface $storage
+     *
      * @return self
      */
     public function setScopeStorage(ScopeInterface $storage)
@@ -227,6 +259,7 @@ abstract class AbstractServer
 
     /**
      * Return the client storage
+     *
      * @return \League\OAuth2\Server\Storage\ClientInterface
      */
     public function getClientStorage()
@@ -236,6 +269,7 @@ abstract class AbstractServer
 
     /**
      * Return the scope storage
+     *
      * @return \League\OAuth2\Server\Storage\ScopeInterface
      */
     public function getScopeStorage()
@@ -245,6 +279,7 @@ abstract class AbstractServer
 
     /**
      * Return the session storage
+     *
      * @return \League\OAuth2\Server\Storage\SessionInterface
      */
     public function getSessionStorage()
@@ -254,6 +289,7 @@ abstract class AbstractServer
 
     /**
      * Return the refresh token storage
+     *
      * @return \League\OAuth2\Server\Storage\RefreshTokenInterface
      */
     public function getRefreshTokenStorage()
@@ -263,6 +299,7 @@ abstract class AbstractServer
 
     /**
      * Return the access token storage
+     *
      * @return \League\OAuth2\Server\Storage\AccessTokenInterface
      */
     public function getAccessTokenStorage()
@@ -272,6 +309,7 @@ abstract class AbstractServer
 
     /**
      * Return the auth code storage
+     *
      * @return \League\OAuth2\Server\Storage\AuthCodeInterface
      */
     public function getAuthCodeStorage()
@@ -281,7 +319,9 @@ abstract class AbstractServer
 
     /**
      * Set the access token type
-     * @param  TokenTypeInterface $tokenType The token type
+     *
+     * @param TokenTypeInterface $tokenType The token type
+     *
      * @return void
      */
     public function setTokenType(TokenTypeInterface $tokenType)
@@ -292,10 +332,27 @@ abstract class AbstractServer
 
     /**
      * Get the access token type
+     *
      * @return TokenTypeInterface
      */
     public function getTokenType()
     {
         return $this->tokenType;
     }
+
+    /**
+     * @return MacTokenInterface
+     */
+    public function getMacStorage()
+    {
+        return $this->macStorage;
+    }
+
+    /**
+     * @param MacTokenInterface $macStorage
+     */
+    public function setMacStorage(MacTokenInterface $macStorage)
+    {
+        $this->macStorage = $macStorage;
+    }
 }

src/AuthorizationServer.php

@@ -20,50 +20,58 @@ use League\OAuth2\Server\TokenType\Bearer;
 class AuthorizationServer extends AbstractServer
 {
     /**
-     * The delimeter between scopes specified in the scope query string parameter
+     * The delimiter between scopes specified in the scope query string parameter
      * The OAuth 2 specification states it should be a space but most use a comma
+     *
      * @var string
      */
     protected $scopeDelimiter = ' ';
 
     /**
      * The TTL (time to live) of an access token in seconds (default: 3600)
+     *
      * @var integer
      */
     protected $accessTokenTTL = 3600;
 
     /**
      * The registered grant response types
+     *
      * @var array
      */
     protected $responseTypes = [];
 
     /**
      * The registered grant types
+     *
      * @var array
      */
     protected $grantTypes = [];
 
     /**
      * Require the "scope" parameter to be in checkAuthoriseParams()
+     *
      * @var boolean
      */
     protected $requireScopeParam = false;
 
     /**
      * Default scope(s) to be used if none is provided
+     *
      * @var string|array
      */
     protected $defaultScope;
 
     /**
      * Require the "state" parameter to be in checkAuthoriseParams()
+     *
      * @var boolean
      */
     protected $requireStateParam = false;
 
     /**
      * Create a new OAuth2 authorization server
+     *
      * @return self
      */
     public function __construct()
@@ -78,8 +86,10 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Enable support for a grant
-     * @param  GrantTypeInterface $grantType  A grant class which conforms to Interface/GrantTypeInterface
+     *
-     * @param  null|string        $identifier An identifier for the grant (autodetected if not passed)
+     * @param GrantTypeInterface $grantType  A grant class which conforms to Interface/GrantTypeInterface
+     * @param null|string        $identifier An identifier for the grant (autodetected if not passed)
+     *
      * @return self
      */
     public function addGrantType(GrantTypeInterface $grantType, $identifier = null)
@@ -102,7 +112,9 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Check if a grant type has been enabled
-     * @param  string $identifier The grant type identifier
+     *
+     * @param string $identifier The grant type identifier
+     *
      * @return boolean Returns "true" if enabled, "false" if not
      */
     public function hasGrantType($identifier)
@@ -112,6 +124,7 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Returns response types
+     *
      * @return array
      */
     public function getResponseTypes()
@@ -121,7 +134,9 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Require the "scope" parameter in checkAuthoriseParams()
-     * @param  boolean $require
+     *
+     * @param boolean $require
+     *
      * @return self
      */
     public function requireScopeParam($require = true)
@@ -133,6 +148,7 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Is the scope parameter required?
+     *
      * @return bool
      */
     public function scopeParamRequired()
@@ -142,7 +158,9 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Default scope to be used if none is provided and requireScopeParam() is false
+     *
      * @param string $default Name of the default scope
+     *
      * @return self
      */
     public function setDefaultScope($default = null)
@@ -154,6 +172,7 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Default scope to be used if none is provided and requireScopeParam is false
+     *
      * @return string|null
      */
     public function getDefaultScope()
@@ -162,7 +181,8 @@ class AuthorizationServer extends AbstractServer
     }
 
     /**
-     * Require the "state" paremter in checkAuthoriseParams()
+     * Require the "state" parameter in checkAuthoriseParams()
+     *
      * @return bool
      */
     public function stateParamRequired()
@@ -171,8 +191,10 @@ class AuthorizationServer extends AbstractServer
     }
 
     /**
-     * Require the "state" paremter in checkAuthoriseParams()
+     * Require the "state" parameter in checkAuthoriseParams()
-     * @param  boolean $require
+     *
+     * @param boolean $require
+     *
      * @return self
      */
     public function requireStateParam($require = true)
@@ -184,6 +206,7 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Get the scope delimiter
+     *
      * @return string The scope delimiter (default: ",")
      */
     public function getScopeDelimiter()
@@ -193,7 +216,9 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Set the scope delimiter
+     *
      * @param string $scopeDelimiter
+     *
      * @return self
      */
     public function setScopeDelimiter($scopeDelimiter = ' ')
@@ -205,6 +230,7 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Get the TTL for an access token
+     *
      * @return int The TTL
      */
     public function getAccessTokenTTL()
@@ -214,7 +240,9 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Set the TTL for an access token
+     *
      * @param int $accessTokenTTL The new TTL
+     *
      * @return self
      */
     public function setAccessTokenTTL($accessTokenTTL = 3600)
@@ -226,7 +254,9 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Issue an access token
+     *
      * @return array Authorise request parameters
+     *
      * @throws
      */
     public function issueAccessToken()
@@ -247,8 +277,11 @@ class AuthorizationServer extends AbstractServer
 
     /**
      * Return a grant type class
-     * @param  string $grantType The grant type identifier
+     *
+     * @param string $grantType The grant type identifier
+     *
      * @return Grant\GrantTypeInterface
+     *
      * @throws
      */
     public function getGrantType($grantType)

src/Entity/AbstractTokenEntity.php

@@ -21,37 +21,44 @@ abstract class AbstractTokenEntity
 {
     /**
      * Token identifier
+     *
      * @var string
      */
     protected $id;
 
     /**
      * Associated session
+     *
      * @var \League\OAuth2\Server\Entity\SessionEntity
      */
     protected $session;
 
     /**
      * Session scopes
+     *
      * @var \League\OAuth2\Server\Entity\ScopeEntity[]
      */
     protected $scopes;
 
     /**
      * Token expire time
+     *
      * @var int
      */
     protected $expireTime = 0;
 
     /**
      * Authorization or resource server
+     *
      * @var \League\OAuth2\Server\AbstractServer
      */
     protected $server;
 
     /**
      * __construct
-     * @param  \League\OAuth2\Server\AbstractServer $server
+     *
+     * @param \League\OAuth2\Server\AbstractServer $server
+     *
      * @return self
      */
     public function __construct(AbstractServer $server)
@@ -63,7 +70,9 @@ abstract class AbstractTokenEntity
 
     /**
      * Set session
-     * @param  \League\OAuth2\Server\Entity\SessionEntity $session
+     *
+     * @param \League\OAuth2\Server\Entity\SessionEntity $session
+     *
      * @return self
      */
     public function setSession(SessionEntity $session)
@@ -75,7 +84,9 @@ abstract class AbstractTokenEntity
 
     /**
      * Set the expire time of the token
-     * @param  integer $expireTime Unix time stamp
+     *
+     * @param integer $expireTime Unix time stamp
+     *
      * @return self
      */
     public function setExpireTime($expireTime)
@@ -87,6 +98,7 @@ abstract class AbstractTokenEntity
 
     /**
      * Return token expire time
+     *
      * @return int
      */
     public function getExpireTime()
@@ -96,6 +108,7 @@ abstract class AbstractTokenEntity
 
     /**
      * Is the token expired?
+     *
      * @return bool
      */
     public function isExpired()
@@ -105,7 +118,9 @@ abstract class AbstractTokenEntity
 
     /**
      * Set token ID
-     * @param  string $id Token ID
+     *
+     * @param string $id Token ID
+     *
      * @return self
      */
     public function setId($id = null)
@@ -117,6 +132,7 @@ abstract class AbstractTokenEntity
 
     /**
      * Get the token ID
+     *
      * @return string
      */
     public function getId()
@@ -126,7 +142,9 @@ abstract class AbstractTokenEntity
 
     /**
      * Associate a scope
-     * @param  \League\OAuth2\Server\Entity\ScopeEntity $scope
+     *
+     * @param \League\OAuth2\Server\Entity\ScopeEntity $scope
+     *
      * @return self
      */
     public function associateScope(ScopeEntity $scope)
@@ -140,7 +158,9 @@ abstract class AbstractTokenEntity
 
     /**
      * Format the local scopes array
+     *
      * @param  \League\OAuth2\Server\Entity\ScopeEntity[]
+     *
      * @return array
      */
     protected function formatScopes($unformatted = [])
@@ -161,6 +181,7 @@ abstract class AbstractTokenEntity
 
     /**
      * Returns the token as a string if the object is cast as a string
+     *
      * @return string
      */
     public function __toString()
@@ -174,12 +195,14 @@ abstract class AbstractTokenEntity
 
     /**
      * Expire the token
+     *
      * @return void
      */
     abstract public function expire();
 
     /**
      * Save the token
+     *
      * @return void
      */
     abstract public function save();

src/Entity/AccessTokenEntity.php

@@ -18,6 +18,7 @@ class AccessTokenEntity extends AbstractTokenEntity
 {
     /**
      * Get session
+     *
      * @return \League\OAuth2\Server\Entity\SessionEntity
      */
     public function getSession()
@@ -33,7 +34,9 @@ class AccessTokenEntity extends AbstractTokenEntity
 
     /**
      * Check if access token has an associated scope
-     * @param  string $scope Scope to check
+     *
+     * @param string $scope Scope to check
+     *
      * @return bool
      */
     public function hasScope($scope)
@@ -47,6 +50,7 @@ class AccessTokenEntity extends AbstractTokenEntity
 
     /**
      * Return all scopes associated with the access token
+     *
      * @return \League\OAuth2\Server\Entity\ScopeEntity[]
      */
     public function getScopes()

src/Entity/AuthCodeEntity.php

@@ -12,19 +12,22 @@
 namespace League\OAuth2\Server\Entity;
 
 /**
- * Access token entity class
+ * Auth Code entity class
  */
 class AuthCodeEntity extends AbstractTokenEntity
 {
     /**
      * Redirect URI
+     *
      * @var string
      */
     protected $redirectUri = '';
 
     /**
      * Set the redirect URI for the authorization request
-     * @param  string $redirectUri
+     *
+     * @param string $redirectUri
+     *
      * @return self
      */
     public function setRedirectUri($redirectUri)
@@ -36,6 +39,7 @@ class AuthCodeEntity extends AbstractTokenEntity
 
     /**
      * Get the redirect URI
+     *
      * @return string
      */
     public function getRedirectUri()
@@ -45,8 +49,10 @@ class AuthCodeEntity extends AbstractTokenEntity
 
     /**
      * Generate a redirect URI
-     * @param  string $state          The state parameter if set by the client
+     *
-     * @param  string $queryDelimeter The query delimiter ('?' for auth code grant, '#' for implicit grant)
+     * @param string $state          The state parameter if set by the client
+     * @param string $queryDelimeter The query delimiter ('?' for auth code grant, '#' for implicit grant)
+     *
      * @return string
      */
     public function generateRedirectUri($state = null, $queryDelimeter = '?')
@@ -62,6 +68,7 @@ class AuthCodeEntity extends AbstractTokenEntity
 
     /**
      * Get session
+     *
      * @return \League\OAuth2\Server\Entity\SessionEntity
      */
     public function getSession()
@@ -77,6 +84,7 @@ class AuthCodeEntity extends AbstractTokenEntity
 
     /**
      * Return all scopes associated with the session
+     *
      * @return \League\OAuth2\Server\Entity\ScopeEntity[]
      */
     public function getScopes()

src/Entity/ClientEntity.php

@@ -22,37 +22,44 @@ class ClientEntity
 
     /**
      * Client identifier
+     *
      * @var string
      */
     protected $id = null;
 
     /**
      * Client secret
+     *
      * @var string
      */
     protected $secret = null;
 
     /**
      * Client name
+     *
      * @var string
      */
     protected $name = null;
 
     /**
      * Client redirect URI
+     *
      * @var string
      */
     protected $redirectUri = null;
 
     /**
      * Authorization or resource server
+     *
      * @var \League\OAuth2\Server\AbstractServer
      */
     protected $server;
 
     /**
      * __construct
-     * @param  \League\OAuth2\Server\AbstractServer $server
+     *
+     * @param \League\OAuth2\Server\AbstractServer $server
+     *
      * @return self
      */
     public function __construct(AbstractServer $server)
@@ -64,6 +71,7 @@ class ClientEntity
 
     /**
      * Return the client identifier
+     *
      * @return string
      */
     public function getId()
@@ -73,6 +81,7 @@ class ClientEntity
 
     /**
      * Return the client secret
+     *
      * @return string
      */
     public function getSecret()
@@ -82,6 +91,7 @@ class ClientEntity
 
     /**
      * Get the client name
+     *
      * @return string
      */
     public function getName()
@@ -91,6 +101,7 @@ class ClientEntity
 
     /**
      * Returnt the client redirect URI
+     *
      * @return string
      */
     public function getRedirectUri()

src/Entity/EntityTrait.php

@@ -15,7 +15,9 @@ trait EntityTrait
 {
     /**
      * Hydrate an entity with properites
+     *
      * @param array $properties
+     *
      * @return self
      */
     public function hydrate(array $properties)

src/Entity/RefreshTokenEntity.php

@@ -18,19 +18,23 @@ class RefreshTokenEntity extends AbstractTokenEntity
 {
     /**
      * Access token associated to refresh token
+     *
      * @var \League\OAuth2\Server\Entity\AccessTokenEntity
      */
     protected $accessTokenEntity;
 
     /**
      * Id of the access token
+     *
      * @var string
      */
     protected $accessTokenId;
 
     /**
      * Set the ID of the associated access token
-     * @param  string $accessTokenId
+     *
+     * @param string $accessTokenId
+     *
      * @return self
      */
     public function setAccessTokenId($accessTokenId)
@@ -42,7 +46,9 @@ class RefreshTokenEntity extends AbstractTokenEntity
 
     /**
      * Associate an access token
-     * @param  \League\OAuth2\Server\Entity\AccessTokenEntity $accessTokenEntity
+     *
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity $accessTokenEntity
+     *
      * @return self
      */
     public function setAccessToken(AccessTokenEntity $accessTokenEntity)
@@ -54,6 +60,7 @@ class RefreshTokenEntity extends AbstractTokenEntity
 
     /**
      * Return access token
+     *
      * @return AccessTokenEntity
      */
     public function getAccessToken()

src/Entity/ScopeEntity.php

@@ -22,25 +22,30 @@ class ScopeEntity implements \JsonSerializable
 
     /**
      * Scope identifier
+     *
      * @var string
      */
     protected $id;
 
     /**
      * Scope description
+     *
      * @var string
      */
     protected $description;
 
     /**
      * Authorization or resource server
+     *
      * @var \League\OAuth2\Server\AbstractServer
      */
     protected $server;
 
     /**
      * __construct
-     * @param  \League\OAuth2\Server\AbstractServer $server
+     *
+     * @param \League\OAuth2\Server\AbstractServer $server
+     *
      * @return self
      */
     public function __construct(AbstractServer $server)
@@ -52,6 +57,7 @@ class ScopeEntity implements \JsonSerializable
 
     /**
      * Return the scope identifer
+     *
      * @return string
      */
     public function getId()
@@ -61,6 +67,7 @@ class ScopeEntity implements \JsonSerializable
 
     /**
      * Return the scope's description
+     *
      * @return string
      */
     public function getDescription()
@@ -70,6 +77,7 @@ class ScopeEntity implements \JsonSerializable
 
     /**
      * Returns a JSON object when entity is passed into json_encode
+     *
      * @return array
      */
     public function jsonSerialize()

src/Entity/SessionEntity.php

@@ -21,61 +21,72 @@ class SessionEntity
 {
     /**
      * Session identifier
+     *
      * @var string
      */
     protected $id;
 
     /**
      * Client identifier
+     *
      * @var \League\OAuth2\Server\Entity\ClientEntity
      */
     protected $client;
 
     /**
      * Session owner identifier
+     *
      * @var string
      */
     protected $ownerId;
 
     /**
      * Session owner type (e.g. "user")
+     *
      * @var string
      */
     protected $ownerType;
 
     /**
      * Auth code
+     *
      * @var \League\OAuth2\Server\Entity\AuthCodeEntity
      */
     protected $authCode;
 
     /**
      * Access token
+     *
      * @var \League\OAuth2\Server\Entity\AccessTokenEntity
      */
     protected $accessToken;
 
     /**
      * Refresh token
+     *
      * @var \League\OAuth2\Server\Entity\RefreshTokenEntity
      */
     protected $refreshToken;
 
     /**
      * Session scopes
+     *
      * @var \Symfony\Component\HttpFoundation\ParameterBag
      */
     protected $scopes;
 
     /**
      * Authorization or resource server
+     *
      * @var \League\OAuth2\Server\AuthorizationServer|\League\OAuth2\Server\ResourceServer
      */
     protected $server;
 
     /**
      * __construct
-     * @param  \League\OAuth2\Server\AbstractServer $server
+     *
+     * @param \League\OAuth2\Server\AbstractServer $server
+     *
      * @return self
      */
     public function __construct(AbstractServer $server)
@@ -87,7 +98,9 @@ class SessionEntity
 
     /**
      * Set the session identifier
-     * @param  string $id
+     *
+     * @param string $id
+     *
      * @return self
      */
     public function setId($id)
@@ -99,6 +112,7 @@ class SessionEntity
 
     /**
      * Return the session identifier
+     *
      * @return string
      */
     public function getId()
@@ -108,7 +122,9 @@ class SessionEntity
 
     /**
      * Associate a scope
-     * @param  \League\OAuth2\Server\Entity\ScopeEntity $scope
+     *
+     * @param \League\OAuth2\Server\Entity\ScopeEntity $scope
+     *
      * @return self
      */
     public function associateScope(ScopeEntity $scope)
@@ -122,7 +138,9 @@ class SessionEntity
 
     /**
      * Check if access token has an associated scope
-     * @param  string $scope Scope to check
+     *
+     * @param string $scope Scope to check
+     *
      * @return bool
      */
     public function hasScope($scope)
@@ -136,6 +154,7 @@ class SessionEntity
 
     /**
      * Return all scopes associated with the session
+     *
      * @return \League\OAuth2\Server\Entity\ScopeEntity[]
      */
     public function getScopes()
@@ -149,7 +168,9 @@ class SessionEntity
 
     /**
      * Format the local scopes array
+     *
      * @param  \League\OAuth2\Server\Entity\Scope[]
+     *
      * @return array
      */
     private function formatScopes($unformatted = [])
@@ -168,7 +189,9 @@ class SessionEntity
 
     /**
      * Associate an access token with the session
-     * @param  \League\OAuth2\Server\Entity\AccessTokenEntity $accessToken
+     *
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity $accessToken
+     *
      * @return self
      */
     public function associateAccessToken(AccessTokenEntity $accessToken)
@@ -180,7 +203,9 @@ class SessionEntity
 
     /**
      * Associate a refresh token with the session
-     * @param  \League\OAuth2\Server\Entity\RefreshTokenEntity $refreshToken
+     *
+     * @param \League\OAuth2\Server\Entity\RefreshTokenEntity $refreshToken
+     *
      * @return self
      */
     public function associateRefreshToken(RefreshTokenEntity $refreshToken)
@@ -192,7 +217,9 @@ class SessionEntity
 
     /**
      * Associate a client with the session
-     * @param  \League\OAuth2\Server\Entity\ClientEntity $client The client
+     *
+     * @param \League\OAuth2\Server\Entity\ClientEntity $client The client
+     *
      * @return self
      */
     public function associateClient(ClientEntity $client)
@@ -204,6 +231,7 @@ class SessionEntity
 
     /**
      * Return the session client
+     *
      * @return \League\OAuth2\Server\Entity\ClientEntity
      */
     public function getClient()
@@ -219,8 +247,10 @@ class SessionEntity
 
     /**
      * Set the session owner
-     * @param  string $type The type of the owner (e.g. user, app)
+     *
-     * @param  string $id   The identifier of the owner
+     * @param string $type The type of the owner (e.g. user, app)
+     * @param string $id   The identifier of the owner
+     *
      * @return self
      */
     public function setOwner($type, $id)
@@ -235,6 +265,7 @@ class SessionEntity
 
     /**
      * Return session owner identifier
+     *
      * @return string
      */
     public function getOwnerId()
@@ -244,6 +275,7 @@ class SessionEntity
 
     /**
      * Return session owner type
+     *
      * @return string
      */
     public function getOwnerType()
@@ -253,6 +285,7 @@ class SessionEntity
 
     /**
      * Save the session
+     *
      * @return void
      */
     public function save()

src/Event/ClientAuthenticationFailedEvent.php

@@ -18,12 +18,14 @@ class ClientAuthenticationFailedEvent extends AbstractEvent
 {
     /**
      * Request
+     *
      * @var \Symfony\Component\HttpFoundation\Request
      */
     private $request;
 
     /**
      * Init the event with a request
+     *
      * @param \Symfony\Component\HttpFoundation\Request $request
      */
     public function __construct(Request $request)
@@ -33,6 +35,7 @@ class ClientAuthenticationFailedEvent extends AbstractEvent
 
     /**
      * The name of the event
+     *
      * @return string
      */
     public function getName()
@@ -42,6 +45,7 @@ class ClientAuthenticationFailedEvent extends AbstractEvent
 
     /**
      * Return request
+     *
      * @return \Symfony\Component\HttpFoundation\Request
      */
     public function getRequest()

src/Event/SessionOwnerEvent.php

@@ -18,12 +18,14 @@ class SessionOwnerEvent extends AbstractEvent
 {
     /**
      * Session entity
+     *
      * @var \League\OAuth2\Server\Entity\SessionEntity
      */
     private $session;
 
     /**
      * Init the event with a session
+     *
      * @param \League\OAuth2\Server\Entity\SessionEntity $session
      */
     public function __construct(SessionEntity $session)
@@ -33,6 +35,7 @@ class SessionOwnerEvent extends AbstractEvent
 
     /**
      * The name of the event
+     *
      * @return string
      */
     public function getName()
@@ -42,6 +45,7 @@ class SessionOwnerEvent extends AbstractEvent
 
     /**
      * Return session
+     *
      * @return \League\OAuth2\Server\Entity\SessionEntity
      */
     public function getSession()

src/Event/UserAuthenticationFailedEvent.php

@@ -18,12 +18,14 @@ class UserAuthenticationFailedEvent extends AbstractEvent
 {
     /**
      * Request
+     *
      * @var \Symfony\Component\HttpFoundation\Request
      */
     private $request;
 
     /**
      * Init the event with a request
+     *
      * @param \Symfony\Component\HttpFoundation\Request $request
      */
     public function __construct(Request $request)
@@ -33,6 +35,7 @@ class UserAuthenticationFailedEvent extends AbstractEvent
 
     /**
      * The name of the event
+     *
      * @return string
      */
     public function getName()
@@ -42,6 +45,7 @@ class UserAuthenticationFailedEvent extends AbstractEvent
 
     /**
      * Return request
+     *
      * @return \Symfony\Component\HttpFoundation\Request
      */
     public function getRequest()

src/Exception/InvalidGrantException.php

@@ -32,6 +32,7 @@ class InvalidGrantException extends OAuthException
 
     public function __construct($parameter)
     {
+        $this->parameter = $parameter;
         parent::__construct(
             sprintf(
                 'The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. Check the "%s" parameter.',

src/Exception/InvalidRequestException.php

@@ -32,6 +32,7 @@ class InvalidRequestException extends OAuthException
 
     public function __construct($parameter, $redirectUri = null)
     {
+        $this->parameter = $parameter;
         parent::__construct(
             sprintf(
                 'The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the "%s" parameter.',

src/Exception/InvalidScopeException.php

@@ -32,6 +32,7 @@ class InvalidScopeException extends OAuthException
 
     public function __construct($parameter, $redirectUri = null)
     {
+        $this->parameter = $parameter;
         parent::__construct(
             sprintf(
                 'The requested scope is invalid, unknown, or malformed. Check the "%s" scope.',

src/Exception/OAuthException.php

@@ -26,6 +26,7 @@ class OAuthException extends \Exception
 
     /**
      * Redirect URI if the server should redirect back to the client
+     *
      * @var string|null
      */
     public $redirectUri = null;
@@ -35,8 +36,14 @@ class OAuthException extends \Exception
      */
     public $errorType = '';
 
+    /**
+     * Parameter eventually passed to Exception
+     */
+    public $parameter = '';
+
     /**
      * Throw a new exception
+     *
      * @param string $msg Exception Message
      */
     public function __construct($msg = 'An error occured')
@@ -46,6 +53,7 @@ class OAuthException extends \Exception
 
     /**
      * Should the server redirect back to the client?
+     *
      * @return bool
      */
     public function shouldRedirect()
@@ -55,6 +63,7 @@ class OAuthException extends \Exception
 
     /**
      * Return redirect URI if set
+     *
      * @return string|null
      */
     public function getRedirectUri()
@@ -68,8 +77,19 @@ class OAuthException extends \Exception
         );
     }
 
+    /**
+     * Return parameter if set
+     *
+     * @return string
+     */
+    public function getParameter()
+    {
+        return $this->parameter;
+    }
+
     /**
      * Get all headers that have to be send with the error response
+     *
      * @return array Array with header values
      */
     public function getHttpHeaders()

src/Exception/ServerErrorException.php

@@ -31,7 +31,9 @@ class ServerErrorException extends OAuthException
      */
     public function __construct($parameter = null)
     {
+        $this->parameter = $parameter;
         $parameter = is_null($parameter) ? 'The authorization server encountered an unexpected condition which prevented it from fulfilling the request.' : $parameter;
         parent::__construct($parameter);
+
     }
 }

src/Exception/UnsupportedGrantTypeException.php

@@ -32,6 +32,7 @@ class UnsupportedGrantTypeException extends OAuthException
 
     public function __construct($parameter)
     {
+        $this->parameter = $parameter;
         parent::__construct(
             sprintf(
                 'The authorization grant type "%s" is not supported by the authorization server.',

src/Exception/UnsupportedResponseTypeException.php

@@ -31,6 +31,7 @@ class UnsupportedResponseTypeException extends OAuthException
      */
     public function __construct($parameter, $redirectUri = null)
     {
+        $this->parameter = $parameter;
         parent::__construct('The authorization server does not support obtaining an access token using this method.');
         $this->redirectUri = $redirectUri;
     }

src/Grant/AbstractGrant.php

@@ -23,30 +23,35 @@ abstract class AbstractGrant implements GrantTypeInterface
 {
     /**
      * Grant identifier
+     *
      * @var string
      */
     protected $identifier = '';
 
     /**
      * Response type
+     *
      * @var string
      */
     protected $responseType;
 
     /**
      * Callback to authenticate a user's name and password
+     *
      * @var callable
      */
     protected $callback;
 
     /**
      * AuthServer instance
+     *
      * @var \League\OAuth2\Server\AuthorizationServer
      */
     protected $server;
 
     /**
      * Access token expires in override
+     *
      * @var int
      */
     protected $accessTokenTTL;
@@ -79,6 +84,7 @@ abstract class AbstractGrant implements GrantTypeInterface
 
     /**
      * Get the TTL for an access token
+     *
      * @return int The TTL
      */
     public function getAccessTokenTTL()
@@ -92,7 +98,9 @@ abstract class AbstractGrant implements GrantTypeInterface
 
     /**
      * Override the default access token expire time
-     * @param  int $accessTokenTTL
+     *
+     * @param int $accessTokenTTL
+     *
      * @return self
      */
     public function setAccessTokenTTL($accessTokenTTL)
@@ -114,10 +122,13 @@ abstract class AbstractGrant implements GrantTypeInterface
 
     /**
      * Given a list of scopes, validate them and return an array of Scope entities
-     * @param  string                                    $scopeParam  A string of scopes (e.g. "profile email birthday")
+     *
-     * @param  \League\OAuth2\Server\Entity\ClientEntity $client      Client entity
+     * @param string                                    $scopeParam  A string of scopes (e.g. "profile email birthday")
-     * @param  string|null                               $redirectUri The redirect URI to return the user to
+     * @param \League\OAuth2\Server\Entity\ClientEntity $client      Client entity
+     * @param string|null                               $redirectUri The redirect URI to return the user to
+     *
      * @return \League\OAuth2\Server\Entity\ScopeEntity[]
+     *
      * @throws \League\OAuth2\Server\Exception\InvalidScopeException If scope is invalid, or no scopes passed when required
      * @throws
      */
@@ -167,7 +178,9 @@ abstract class AbstractGrant implements GrantTypeInterface
 
     /**
      * Format the local scopes array
+     *
      * @param  \League\OAuth2\Server\Entity\ScopeEntity[]
+     *
      * @return array
      */
     protected function formatScopes($unformated = [])

src/Grant/AuthCodeGrant.php

@@ -27,37 +27,52 @@ class AuthCodeGrant extends AbstractGrant
 {
     /**
      * Grant identifier
+     *
      * @var string
      */
     protected $identifier = 'authorization_code';
 
     /**
      * Response type
+     *
      * @var string
      */
     protected $responseType = 'code';
 
     /**
      * AuthServer instance
+     *
      * @var \League\OAuth2\Server\AuthorizationServer
      */
     protected $server = null;
 
     /**
      * Access token expires in override
+     *
      * @var int
      */
     protected $accessTokenTTL = null;
 
     /**
      * The TTL of the auth token
+     *
      * @var integer
      */
     protected $authTokenTTL = 600;
 
+    /**
+     * Whether to require the client secret when
+     * completing the flow.
+     *
+     * @var boolean
+     */
+    protected $requireClientSecret = true;
+
     /**
      * Override the default access token expire time
-     * @param  int $authTokenTTL
+     *
+     * @param int $authTokenTTL
+     *
      * @return void
      */
     public function setAuthTokenTTL($authTokenTTL)
@@ -65,6 +80,27 @@ class AuthCodeGrant extends AbstractGrant
         $this->authTokenTTL = $authTokenTTL;
     }
 
+    /**
+     *
+     * @param bool $required True to require client secret during access
+     *                       token request. False if not. Default = true
+     */
+    public function setRequireClientSecret($required)
+    {
+        $this->requireClientSecret = $required;
+    }
+
+    /**
+     * True if client secret is required during
+     * access token request. False if it isn't.
+     *
+     * @return bool
+     */
+    public function shouldRequireClientSecret()
+    {
+        return $this->requireClientSecret;
+    }
+
     /**
      * Check authorize parameters
      *
@@ -129,9 +165,10 @@ class AuthCodeGrant extends AbstractGrant
     /**
      * Parse a new authorize request
      *
-     * @param  string $type       The session owner's type
+     * @param string $type       The session owner's type
-     * @param  string $typeId     The session owner's ID
+     * @param string $typeId     The session owner's ID
-     * @param  array  $authParams The authorize request $_GET parameters
+     * @param array  $authParams The authorize request $_GET parameters
+     *
      * @return string An authorisation code
      */
     public function newAuthorizeRequest($type, $typeId, $authParams = [])
@@ -140,7 +177,6 @@ class AuthCodeGrant extends AbstractGrant
         $session = new SessionEntity($this->server);
         $session->setOwner($type, $typeId);
         $session->associateClient($authParams['client']);
-        $session->save();
 
         // Create a new auth code
         $authCode = new AuthCodeEntity($this->server);
@@ -150,8 +186,10 @@ class AuthCodeGrant extends AbstractGrant
 
         foreach ($authParams['scopes'] as $scope) {
             $authCode->associateScope($scope);
+            $session->associateScope($scope);
         }
 
+        $session->save();
         $authCode->setSession($session);
         $authCode->save();
 
@@ -160,7 +198,9 @@ class AuthCodeGrant extends AbstractGrant
 
     /**
      * Complete the auth code grant
+     *
      * @return array
+     *
      * @throws
      */
     public function completeFlow()
@@ -173,7 +213,7 @@ class AuthCodeGrant extends AbstractGrant
 
         $clientSecret = $this->server->getRequest()->request->get('client_secret',
             $this->server->getRequest()->getPassword());
-        if (is_null($clientSecret)) {
+        if ($this->shouldRequireClientSecret() && is_null($clientSecret)) {
             throw new Exception\InvalidRequestException('client_secret');
         }
 
@@ -250,7 +290,6 @@ class AuthCodeGrant extends AbstractGrant
         $code->expire();
 
         // Save all the things
-        $session->save();
         $accessToken->setSession($session);
         $accessToken->save();
 
@@ -261,4 +300,4 @@ class AuthCodeGrant extends AbstractGrant
 
         return $this->server->getTokenType()->generateResponse();
     }
-}
+}

src/Grant/ClientCredentialsGrant.php

@@ -25,31 +25,37 @@ class ClientCredentialsGrant extends AbstractGrant
 {
     /**
      * Grant identifier
+     *
      * @var string
      */
     protected $identifier = 'client_credentials';
 
     /**
      * Response type
+     *
      * @var string
      */
     protected $responseType = null;
 
     /**
      * AuthServer instance
+     *
      * @var \League\OAuth2\Server\AuthorizationServer
      */
     protected $server = null;
 
     /**
      * Access token expires in override
+     *
      * @var int
      */
     protected $accessTokenTTL = null;
 
     /**
      * Complete the client credentials grant
+     *
      * @return array
+     *
      * @throws
      */
     public function completeFlow()

src/Grant/GrantTypeInterface.php

@@ -20,32 +20,39 @@ interface GrantTypeInterface
 {
     /**
      * Return the identifier
+     *
      * @return string
      */
     public function getIdentifier();
 
     /**
      * Return the identifier
-     * @param  string $identifier
+     *
+     * @param string $identifier
+     *
      * @return self
      */
     public function setIdentifier($identifier);
 
     /**
      * Return the response type
+     *
      * @return string
      */
     public function getResponseType();
 
     /**
      * Inject the authorization server into the grant
-     * @param  \League\OAuth2\Server\AuthorizationServer $server The authorization server instance
+     *
+     * @param \League\OAuth2\Server\AuthorizationServer $server The authorization server instance
+     *
      * @return self
      */
     public function setAuthorizationServer(AuthorizationServer $server);
 
     /**
      * Complete the grant flow
+     *
      * @return array
      */
     public function completeFlow();

src/Grant/PasswordGrant.php

@@ -26,31 +26,37 @@ class PasswordGrant extends AbstractGrant
 {
     /**
      * Grant identifier
+     *
      * @var string
      */
     protected $identifier = 'password';
 
     /**
      * Response type
+     *
      * @var string
      */
     protected $responseType;
 
     /**
      * Callback to authenticate a user's name and password
+     *
      * @var callable
      */
     protected $callback;
 
     /**
      * Access token expires in override
+     *
      * @var int
      */
     protected $accessTokenTTL;
 
     /**
      * Set the callback to verify a user's username and password
-     * @param  callable $callback The callback function
+     *
+     * @param callable $callback The callback function
+     *
      * @return void
      */
     public function setVerifyCredentialsCallback(callable $callback)
@@ -60,7 +66,9 @@ class PasswordGrant extends AbstractGrant
 
     /**
      * Return the callback function
+     *
      * @return callable
+     *
      * @throws
      */
     protected function getVerifyCredentialsCallback()
@@ -74,7 +82,9 @@ class PasswordGrant extends AbstractGrant
 
     /**
      * Complete the password grant
+     *
      * @return array
+     *
      * @throws
      */
     public function completeFlow()

src/Grant/RefreshTokenGrant.php

@@ -19,7 +19,7 @@ use League\OAuth2\Server\Exception;
 use League\OAuth2\Server\Util\SecureKey;
 
 /**
- * Referesh token grant
+ * Refresh token grant
  */
 class RefreshTokenGrant extends AbstractGrant
 {
@@ -30,13 +30,31 @@ class RefreshTokenGrant extends AbstractGrant
 
     /**
      * Refresh token TTL (default = 604800 | 1 week)
+     *
      * @var integer
      */
     protected $refreshTokenTTL = 604800;
 
+    /**
+     * Rotate token (default = true)
+     *
+     * @var integer
+     */
+    protected $refreshTokenRotate = true;
+
+    /**
+     * Whether to require the client secret when
+     * completing the flow.
+     *
+     * @var boolean
+     */
+    protected $requireClientSecret = true;
+
     /**
      * Set the TTL of the refresh token
-     * @param  int $refreshTokenTTL
+     *
+     * @param int $refreshTokenTTL
+     *
      * @return void
      */
     public function setRefreshTokenTTL($refreshTokenTTL)
@@ -46,6 +64,7 @@ class RefreshTokenGrant extends AbstractGrant
 
     /**
      * Get the TTL of the refresh token
+     *
      * @return int
      */
     public function getRefreshTokenTTL()
@@ -53,6 +72,47 @@ class RefreshTokenGrant extends AbstractGrant
         return $this->refreshTokenTTL;
     }
 
+    /**
+     * Set the rotation boolean of the refresh token
+     * @param bool $refreshTokenRotate
+     */
+    public function setRefreshTokenRotation($refreshTokenRotate = true)
+    {
+        $this->refreshTokenRotate = $refreshTokenRotate;
+    }
+
+    /**
+     * Get rotation boolean of the refresh token
+     *
+     * @return bool
+     */
+    public function shouldRotateRefreshTokens()
+    {
+        return $this->refreshTokenRotate;
+    }
+
+    /**
+     *
+     * @param bool $required True to require client secret during access
+     *                       token request. False if not. Default = true
+     */
+    public function setRequireClientSecret($required)
+    {
+        $this->requireClientSecret = $required;
+    }
+
+    /**
+     * True if client secret is required during
+     * access token request. False if it isn't.
+     *
+     * @return bool
+     */
+    public function shouldRequireClientSecret()
+    {
+        return $this->requireClientSecret;
+    }
+
+
     /**
      * {@inheritdoc}
      */
@@ -65,7 +125,7 @@ class RefreshTokenGrant extends AbstractGrant
 
         $clientSecret = $this->server->getRequest()->request->get('client_secret',
             $this->server->getRequest()->getPassword());
-        if (is_null($clientSecret)) {
+        if ($this->shouldRequireClientSecret() && is_null($clientSecret)) {
             throw new Exception\InvalidRequestException('client_secret');
         }
 
@@ -142,18 +202,22 @@ class RefreshTokenGrant extends AbstractGrant
         $this->server->getTokenType()->setParam('access_token', $newAccessToken->getId());
         $this->server->getTokenType()->setParam('expires_in', $this->getAccessTokenTTL());
 
-        // Expire the old refresh token
+        if ($this->shouldRotateRefreshTokens()) {
-        $oldRefreshToken->expire();
+            // Expire the old refresh token
+            $oldRefreshToken->expire();
 
-        // Generate a new refresh token
+            // Generate a new refresh token
-        $newRefreshToken = new RefreshTokenEntity($this->server);
+            $newRefreshToken = new RefreshTokenEntity($this->server);
-        $newRefreshToken->setId(SecureKey::generate());
+            $newRefreshToken->setId(SecureKey::generate());
-        $newRefreshToken->setExpireTime($this->getRefreshTokenTTL() + time());
+            $newRefreshToken->setExpireTime($this->getRefreshTokenTTL() + time());
-        $newRefreshToken->setAccessToken($newAccessToken);
+            $newRefreshToken->setAccessToken($newAccessToken);
-        $newRefreshToken->save();
+            $newRefreshToken->save();
 
-        $this->server->getTokenType()->setParam('refresh_token', $newRefreshToken->getId());
+            $this->server->getTokenType()->setParam('refresh_token', $newRefreshToken->getId());
+        } else {
+            $this->server->getTokenType()->setParam('refresh_token', $oldRefreshToken->getId());
+        }
 
         return $this->server->getTokenType()->generateResponse();
     }
-}
+}

src/ResourceServer.php

@@ -12,11 +12,14 @@
 namespace League\OAuth2\Server;
 
 use League\OAuth2\Server\Entity\AccessTokenEntity;
+use League\OAuth2\Server\Exception\AccessDeniedException;
+use League\OAuth2\Server\Exception\InvalidRequestException;
 use League\OAuth2\Server\Storage\AccessTokenInterface;
 use League\OAuth2\Server\Storage\ClientInterface;
 use League\OAuth2\Server\Storage\ScopeInterface;
 use League\OAuth2\Server\Storage\SessionInterface;
 use League\OAuth2\Server\TokenType\Bearer;
+use League\OAuth2\Server\TokenType\MAC;
 
 /**
  * OAuth 2.0 Resource Server
@@ -25,22 +28,26 @@ class ResourceServer extends AbstractServer
 {
     /**
      * The access token
+     *
      * @var \League\OAuth2\Server\Entity\AccessTokenEntity
      */
     protected $accessToken;
 
     /**
      * The query string key which is used by clients to present the access token (default: access_token)
+     *
      * @var string
      */
     protected $tokenKey = 'access_token';
 
     /**
      * Initialise the resource server
-     * @param  SessionInterface     $sessionStorage
+     *
-     * @param  AccessTokenInterface $accessTokenStorage
+     * @param \League\OAuth2\Server\Storage\SessionInterface     $sessionStorage
-     * @param  ClientInterface      $clientStorage
+     * @param \League\OAuth2\Server\Storage\AccessTokenInterface $accessTokenStorage
-     * @param  ScopeInterface       $scopeStorage
+     * @param \League\OAuth2\Server\Storage\ClientInterface      $clientStorage
+     * @param \League\OAuth2\Server\Storage\ScopeInterface       $scopeStorage
+     *
      * @return self
      */
     public function __construct(
@@ -64,7 +71,9 @@ class ResourceServer extends AbstractServer
 
     /**
      * Sets the query string key for the access token.
+     *
      * @param string $key The new query string key
+     *
      * @return self
      */
     public function setIdKey($key)
@@ -76,6 +85,7 @@ class ResourceServer extends AbstractServer
 
     /**
      * Gets the access token
+     *
      * @return \League\OAuth2\Server\Entity\AccessTokenEntity
      */
     public function getAccessToken()
@@ -85,31 +95,33 @@ class ResourceServer extends AbstractServer
 
     /**
      * Checks if the access token is valid or not
-     * @param bool $headersOnly Limit Access Token to Authorization header only
+     *
-     * @param AccessTokenEntity|null $accessToken Access Token
+     * @param bool                                                $headerOnly Limit Access Token to Authorization header
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity|null $accessToken Access Token
+     *
+     * @throws \League\OAuth2\Server\Exception\AccessDeniedException
+     * @throws \League\OAuth2\Server\Exception\InvalidRequestException
      *
      * @return bool
-     *
-     * @throws
      */
-    public function isValidRequest($headersOnly = true, $accessToken = null)
+    public function isValidRequest($headerOnly = true, $accessToken = null)
     {
         $accessTokenString = ($accessToken !== null)
                                 ? $accessToken
-                                : $this->determineAccessToken($headersOnly);
+                                : $this->determineAccessToken($headerOnly);
 
         // Set the access token
         $this->accessToken = $this->getAccessTokenStorage()->get($accessTokenString);
 
         // Ensure the access token exists
         if (!$this->accessToken instanceof AccessTokenEntity) {
-            throw new Exception\AccessDeniedException();
+            throw new AccessDeniedException();
         }
 
         // Check the access token hasn't expired
         // Ensure the auth code hasn't expired
         if ($this->accessToken->isExpired() === true) {
-            throw new Exception\AccessDeniedException();
+            throw new AccessDeniedException();
         }
 
         return true;
@@ -117,22 +129,27 @@ class ResourceServer extends AbstractServer
 
     /**
      * Reads in the access token from the headers
-     * @param bool $headersOnly Limit Access Token to Authorization header only
+     *
-     * @throws Exception\InvalidRequestException Thrown if there is no access token presented
+     * @param bool $headerOnly Limit Access Token to Authorization header
+     *
+     * @throws \League\OAuth2\Server\Exception\InvalidRequestException Thrown if there is no access token presented
+     *
      * @return string
      */
-    public function determineAccessToken($headersOnly = false)
+    public function determineAccessToken($headerOnly = false)
     {
-        if ($this->getRequest()->headers->get('Authorization') !== null) {
+	$authHeader = $this->getRequest()->headers->get('Authorization');
+
+        if (!empty($authHeader)) {
             $accessToken = $this->getTokenType()->determineAccessTokenInHeader($this->getRequest());
-        } elseif ($headersOnly === false) {
+        } elseif ($headerOnly === false && (! $this->getTokenType() instanceof MAC)) {
             $accessToken = ($this->getRequest()->server->get('REQUEST_METHOD') === 'GET')
                                 ? $this->getRequest()->query->get($this->tokenKey)
                                 : $this->getRequest()->request->get($this->tokenKey);
         }
 
         if (empty($accessToken)) {
-            throw new Exception\InvalidRequestException('access token');
+            throw new InvalidRequestException('access token');
         }
 
         return $accessToken;

src/Storage/AbstractStorage.php

@@ -20,13 +20,16 @@ abstract class AbstractStorage implements StorageInterface
 {
     /**
      * Server
+     *
      * @var \League\OAuth2\Server\AbstractServer $server
      */
     protected $server;
 
     /**
      * Set the server
+     *
      * @param \League\OAuth2\Server\AbstractServer $server
+     *
      * @return self
      */
     public function setServer(AbstractServer $server)
@@ -38,6 +41,7 @@ abstract class AbstractStorage implements StorageInterface
 
     /**
      * Return the server
+     *
      * @return \League\OAuth2\Server\AbstractServer
      */
     protected function getServer()

src/Storage/AccessTokenInterface.php

@@ -21,38 +21,48 @@ interface AccessTokenInterface extends StorageInterface
 {
     /**
      * Get an instance of Entity\AccessTokenEntity
-     * @param  string                                         $token The access token
+     *
-     * @return \League\OAuth2\Server\Entity\AccessTokenEntity
+     * @param string $token The access token
+     *
+     * @return \League\OAuth2\Server\Entity\AccessTokenEntity | null
      */
     public function get($token);
 
     /**
      * Get the scopes for an access token
-     * @param  \League\OAuth2\Server\Entity\AccessTokenEntity $token The access token
+     *
-     * @return array                                            Array of \League\OAuth2\Server\Entity\ScopeEntity
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity $token The access token
+     *
+     * @return \League\OAuth2\Server\Entity\ScopeEntity[] Array of \League\OAuth2\Server\Entity\ScopeEntity
      */
     public function getScopes(AccessTokenEntity $token);
 
     /**
      * Creates a new access token
-     * @param  string                                   $token      The access token
+     *
-     * @param  integer                                  $expireTime The expire time expressed as a unix timestamp
+     * @param string         $token      The access token
-     * @param  string|integer                           $sessionId  The session ID
+     * @param integer        $expireTime The expire time expressed as a unix timestamp
-     * @return \League\OAuth2\Server\Entity\AccessTokenEntity
+     * @param string|integer $sessionId  The session ID
+     *
+     * @return void
      */
     public function create($token, $expireTime, $sessionId);
 
     /**
      * Associate a scope with an acess token
-     * @param  \League\OAuth2\Server\Entity\AccessTokenEntity $token The access token
+     *
-     * @param  \League\OAuth2\Server\Entity\ScopeEntity         $scope The scope
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity $token The access token
+     * @param \League\OAuth2\Server\Entity\ScopeEntity       $scope The scope
+     *
      * @return void
      */
     public function associateScope(AccessTokenEntity $token, ScopeEntity $scope);
 
     /**
      * Delete an access token
-     * @param  \League\OAuth2\Server\Entity\AccessTokenEntity $token The access token to delete
+     *
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity $token The access token to delete
+     *
      * @return void
      */
     public function delete(AccessTokenEntity $token);

src/Storage/AuthCodeInterface.php

@@ -21,13 +21,16 @@ interface AuthCodeInterface extends StorageInterface
 {
     /**
      * Get the auth code
-     * @param  string                                      $code
+     *
-     * @return \League\OAuth2\Server\Entity\AuthCodeEntity
+     * @param string $code
+     *
+     * @return \League\OAuth2\Server\Entity\AuthCodeEntity | null
      */
     public function get($code);
 
     /**
      * Create an auth code.
+     *
      * @param string  $token       The token ID
      * @param integer $expireTime  Token expire time
      * @param integer $sessionId   Session identifier
@@ -39,22 +42,28 @@ interface AuthCodeInterface extends StorageInterface
 
     /**
      * Get the scopes for an access token
-     * @param  \League\OAuth2\Server\Entity\AuthCodeEntity $token The auth code
+     *
-     * @return array                                       Array of \League\OAuth2\Server\Entity\ScopeEntity
+     * @param \League\OAuth2\Server\Entity\AuthCodeEntity $token The auth code
+     *
+     * @return \League\OAuth2\Server\Entity\ScopeEntity[] Array of \League\OAuth2\Server\Entity\ScopeEntity
      */
     public function getScopes(AuthCodeEntity $token);
 
     /**
      * Associate a scope with an acess token
-     * @param  \League\OAuth2\Server\Entity\AuthCodeEntity $token The auth code
+     *
-     * @param  \League\OAuth2\Server\Entity\ScopeEntity    $scope The scope
+     * @param \League\OAuth2\Server\Entity\AuthCodeEntity $token The auth code
+     * @param \League\OAuth2\Server\Entity\ScopeEntity    $scope The scope
+     *
      * @return void
      */
     public function associateScope(AuthCodeEntity $token, ScopeEntity $scope);
 
     /**
      * Delete an access token
-     * @param  \League\OAuth2\Server\Entity\AuthCodeEntity $token The access token to delete
+     *
+     * @param \League\OAuth2\Server\Entity\AuthCodeEntity $token The access token to delete
+     *
      * @return void
      */
     public function delete(AuthCodeEntity $token);

src/Storage/ClientInterface.php

@@ -20,18 +20,22 @@ interface ClientInterface extends StorageInterface
 {
     /**
      * Validate a client
-     * @param  string                                   $clientId     The client's ID
+     *
-     * @param  string                                   $clientSecret The client's secret (default = "null")
+     * @param string $clientId     The client's ID
-     * @param  string                                   $redirectUri  The client's redirect URI (default = "null")
+     * @param string $clientSecret The client's secret (default = "null")
-     * @param  string                                   $grantType    The grant type used (default = "null")
+     * @param string $redirectUri  The client's redirect URI (default = "null")
-     * @return \League\OAuth2\Server\Entity\ClientEntity
+     * @param string $grantType    The grant type used (default = "null")
+     *
+     * @return \League\OAuth2\Server\Entity\ClientEntity | null
      */
     public function get($clientId, $clientSecret = null, $redirectUri = null, $grantType = null);
 
     /**
      * Get the client associated with a session
-     * @param  \League\OAuth2\Server\Entity\SessionEntity $session The session
+     *
-     * @return \League\OAuth2\Server\Entity\ClientEntity
+     * @param \League\OAuth2\Server\Entity\SessionEntity $session The session
+     *
+     * @return \League\OAuth2\Server\Entity\ClientEntity | null
      */
     public function getBySession(SessionEntity $session);
 }

src/Storage/MacTokenInterface.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * OAuth 2.0 MAC Token Interface
+ *
+ * @package     league/oauth2-server
+ * @author      Alex Bilbie <hello@alexbilbie.com>
+ * @copyright   Copyright (c) Alex Bilbie
+ * @license     http://mit-license.org/
+ * @link        https://github.com/thephpleague/oauth2-server
+ */
+
+namespace League\OAuth2\Server\Storage;
+
+
+/**
+ * MacTokenInterface
+ */
+interface MacTokenInterface extends StorageInterface
+{
+    /**
+     * Create a MAC key linked to an access token
+     * @param  string $macKey
+     * @param  string $accessToken
+     * @return void
+     */
+    public function create($macKey, $accessToken);
+
+    /**
+     * Get a MAC key by access token
+     * @param  string $accessToken
+     * @return string
+     */
+    public function getByAccessToken($accessToken);
+}

src/Storage/RefreshTokenInterface.php

@@ -20,23 +20,29 @@ interface RefreshTokenInterface extends StorageInterface
 {
     /**
      * Return a new instance of \League\OAuth2\Server\Entity\RefreshTokenEntity
-     * @param  string                                          $token
+     *
-     * @return \League\OAuth2\Server\Entity\RefreshTokenEntity
+     * @param string $token
+     *
+     * @return \League\OAuth2\Server\Entity\RefreshTokenEntity | null
      */
     public function get($token);
 
     /**
      * Create a new refresh token_name
-     * @param  string                                          $token
+     *
-     * @param  integer                                         $expireTime
+     * @param string  $token
-     * @param  string                                          $accessToken
+     * @param integer $expireTime
+     * @param string  $accessToken
+     *
      * @return \League\OAuth2\Server\Entity\RefreshTokenEntity
      */
     public function create($token, $expireTime, $accessToken);
 
     /**
      * Delete the refresh token
-     * @param  \League\OAuth2\Server\Entity\RefreshTokenEntity $token
+     *
+     * @param \League\OAuth2\Server\Entity\RefreshTokenEntity $token
+     *
      * @return void
      */
     public function delete(RefreshTokenEntity $token);

src/Storage/ScopeInterface.php

@@ -18,10 +18,12 @@ interface ScopeInterface extends StorageInterface
 {
     /**
      * Return information about a scope
-     * @param  string                                   $scope     The scope
+     *
-     * @param  string                                   $grantType The grant type used in the request (default = "null")
+     * @param string $scope     The scope
-     * @param  string                                   $clientId  The client sending the request (default = "null")
+     * @param string $grantType The grant type used in the request (default = "null")
-     * @return \League\OAuth2\Server\Entity\ScopeEntity
+     * @param string $clientId  The client sending the request (default = "null")
+     *
+     * @return \League\OAuth2\Server\Entity\ScopeEntity | null
      */
     public function get($scope, $grantType = null, $clientId = null);
 }

src/Storage/SessionInterface.php

@@ -23,39 +23,49 @@ interface SessionInterface extends StorageInterface
 {
     /**
      * Get a session from an access token
-     * @param  \League\OAuth2\Server\Entity\AccessTokenEntity $accessToken The access token
+     *
-     * @return \League\OAuth2\Server\Entity\SessionEntity
+     * @param \League\OAuth2\Server\Entity\AccessTokenEntity $accessToken The access token
+     *
+     * @return \League\OAuth2\Server\Entity\SessionEntity | null
      */
     public function getByAccessToken(AccessTokenEntity $accessToken);
 
     /**
      * Get a session from an auth code
-     * @param  \League\OAuth2\Server\Entity\AuthCodeEntity $authCode The auth code
+     *
-     * @return \League\OAuth2\Server\Entity\SessionEntity
+     * @param \League\OAuth2\Server\Entity\AuthCodeEntity $authCode The auth code
+     *
+     * @return \League\OAuth2\Server\Entity\SessionEntity | null
      */
     public function getByAuthCode(AuthCodeEntity $authCode);
 
     /**
      * Get a session's scopes
+     *
      * @param  \League\OAuth2\Server\Entity\SessionEntity
-     * @return array Array of \League\OAuth2\Server\Entity\ScopeEntity
+     *
+     * @return \League\OAuth2\Server\Entity\ScopeEntity[] Array of \League\OAuth2\Server\Entity\ScopeEntity
      */
     public function getScopes(SessionEntity $session);
 
     /**
      * Create a new session
-     * @param  string  $ownerType         Session owner's type (user, client)
+     *
-     * @param  string  $ownerId           Session owner's ID
+     * @param string $ownerType         Session owner's type (user, client)
-     * @param  string  $clientId          Client ID
+     * @param string $ownerId           Session owner's ID
-     * @param  string  $clientRedirectUri Client redirect URI (default = null)
+     * @param string $clientId          Client ID
+     * @param string $clientRedirectUri Client redirect URI (default = null)
+     *
      * @return integer The session's ID
      */
     public function create($ownerType, $ownerId, $clientId, $clientRedirectUri = null);
 
     /**
      * Associate a scope with a session
-     * @param  \League\OAuth2\Server\Entity\SessionEntity $session The session
+     *
-     * @param  \League\OAuth2\Server\Entity\ScopeEntity   $scope The scope
+     * @param \League\OAuth2\Server\Entity\SessionEntity $session The session
+     * @param \League\OAuth2\Server\Entity\ScopeEntity   $scope   The scope
+     *
      * @return void
      */
     public function associateScope(SessionEntity $session, ScopeEntity $scope);

src/Storage/StorageInterface.php

@@ -20,6 +20,7 @@ interface StorageInterface
 {
     /**
      * Set the server
+     *
      * @param \League\OAuth2\Server\AbstractServer $server
      */
     public function setServer(AbstractServer $server);

src/TokenType/AbstractTokenType.php

@@ -18,18 +18,21 @@ abstract class AbstractTokenType
 {
     /**
      * Response array
+     *
      * @var array
      */
     protected $response = [];
 
     /**
      * Server
+     *
      * @var \League\OAuth2\Server\AbstractServer $server
      */
     protected $server;
 
     /**
      * Server
+     *
      * @var \League\OAuth2\Server\Entity\SessionEntity $session
      */
     protected $session;

src/TokenType/Bearer.php

@@ -38,9 +38,16 @@ class Bearer extends AbstractTokenType implements TokenTypeInterface
      */
     public function determineAccessTokenInHeader(Request $request)
     {
-        $header = $request->headers->get('Authorization');
+        if ($request->headers->has('Authorization') === false) {
-        $accessToken = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $header));
+            return;
+        }
 
-        return ($accessToken === 'Bearer') ? '' : $accessToken;
+        $header = $request->headers->get('Authorization');
+
+        if (substr($header, 0, 7) !== 'Bearer ') {
+            return;
+        }
+
+        return trim(substr($header, 7));
     }
 }

src/TokenType/MAC.php

@@ -0,0 +1,156 @@
+<?php
+/**
+ * OAuth 2.0 MAC Token Type
+ *
+ * @package     league/oauth2-server
+ * @author      Alex Bilbie <hello@alexbilbie.com>
+ * @copyright   Copyright (c) Alex Bilbie
+ * @license     http://mit-license.org/
+ * @link        https://github.com/thephpleague/oauth2-server
+ */
+
+namespace League\OAuth2\Server\TokenType;
+
+use League\OAuth2\Server\Util\SecureKey;
+use Symfony\Component\HttpFoundation\ParameterBag;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * MAC Token Type
+ */
+class MAC extends AbstractTokenType implements TokenTypeInterface
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function generateResponse()
+    {
+        $macKey = SecureKey::generate();
+        $this->server->getMacStorage()->create($macKey, $this->getParam('access_token'));
+
+        $response = [
+            'access_token'  =>  $this->getParam('access_token'),
+            'token_type'    =>  'mac',
+            'expires_in'    =>  $this->getParam('expires_in'),
+            'mac_key'       =>  $macKey,
+            'mac_algorithm' =>  'hmac-sha-256',
+        ];
+
+        if (!is_null($this->getParam('refresh_token'))) {
+            $response['refresh_token'] = $this->getParam('refresh_token');
+        }
+
+        return $response;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function determineAccessTokenInHeader(Request $request)
+    {
+        if ($request->headers->has('Authorization') === false) {
+            return;
+        }
+
+        $header = $request->headers->get('Authorization');
+
+        if (substr($header, 0, 4) !== 'MAC ') {
+            return;
+        }
+
+        // Find all the parameters expressed in the header
+        $paramsRaw = explode(',', substr($header, 4));
+        $params = new ParameterBag();
+
+        array_map(function ($param) use (&$params) {
+            $param = trim($param);
+
+            preg_match_all('/([a-zA-Z]*)="([\w=\/+]*)"/', $param, $matches);
+
+            // @codeCoverageIgnoreStart
+            if (count($matches) !== 3) {
+                return;
+            }
+            // @codeCoverageIgnoreEnd
+
+            $key = reset($matches[1]);
+            $value = trim(reset($matches[2]));
+
+            if (empty($value)) {
+                return;
+            }
+
+            $params->set($key, $value);
+        }, $paramsRaw);
+
+        // Validate parameters
+        if ($params->has('id') === false || $params->has('ts') === false || $params->has('nonce') === false || $params->has('mac') === false) {
+            return;
+        }
+
+        if (abs($params->get('ts') - time()) > 300) {
+            return;
+        }
+
+        $accessToken = $params->get('id');
+        $timestamp = (int) $params->get('ts');
+        $nonce = $params->get('nonce');
+        $signature = $params->get('mac');
+
+        // Try to find the MAC key for the access token
+        $macKey = $this->server->getMacStorage()->getByAccessToken($accessToken);
+
+        if ($macKey === null) {
+            return;
+        }
+
+        // Calculate and compare the signature
+        $calculatedSignatureParts = [
+            $timestamp,
+            $nonce,
+            strtoupper($request->getMethod()),
+            $request->getRequestUri(),
+            $request->getHost(),
+            $request->getPort(),
+        ];
+
+        if ($params->has('ext')) {
+            $calculatedSignatureParts[] = $params->get('ext');
+        }
+
+        $calculatedSignature = base64_encode(
+            hash_hmac(
+                'sha256',
+                implode("\n", $calculatedSignatureParts),
+                $macKey,
+                true  // raw_output: outputs raw binary data
+            )
+        );
+
+        // Return the access token if the signature matches
+        return ($this->hash_equals($calculatedSignature, $signature)) ? $accessToken : null;
+    }
+
+    /**
+     * Prevent timing attack
+     * @param  string $knownString
+     * @param  string $userString
+     * @return bool
+     */
+    private function hash_equals($knownString, $userString)
+    {
+        if (function_exists('\hash_equals')) {
+            return \hash_equals($knownString, $userString);
+        }
+        if (strlen($knownString) !== strlen($userString)) {
+            return false;
+        }
+        $len = strlen($knownString);
+        $result = 0;
+        for ($i = 0; $i < $len; $i++) {
+            $result |= (ord($knownString[$i]) ^ ord($userString[$i]));
+        }
+        // They are only identical strings if $result is exactly 0...
+        return 0 === $result;
+    }
+}

src/TokenType/TokenTypeInterface.php

@@ -19,19 +19,23 @@ interface TokenTypeInterface
 {
     /**
      * Generate a response
+     *
      * @return array
      */
     public function generateResponse();
 
     /**
      * Set the server
+     *
      * @param \League\OAuth2\Server\AbstractServer $server
+     *
      * @return self
      */
     public function setServer(AbstractServer $server);
 
     /**
      * Set a key/value response pair
+     *
      * @param string $key
      * @param mixed  $value
      */
@@ -39,20 +43,25 @@ interface TokenTypeInterface
 
     /**
      * Get a key from the response array
-     * @param  string $key
+     *
+     * @param string $key
+     *
      * @return mixed
      */
     public function getParam($key);
 
     /**
      * @param \League\OAuth2\Server\Entity\SessionEntity $session
+     *
      * @return self
      */
     public function setSession(SessionEntity $session);
 
     /**
      * Determine the access token in the authorization header
-     * @param  \Symfony\Component\HttpFoundation\Request $request
+     *
+     * @param \Symfony\Component\HttpFoundation\Request $request
+     *
      * @return string
      */
     public function determineAccessTokenInHeader(Request $request);

src/Util/KeyAlgorithm/DefaultAlgorithm.php

@@ -18,18 +18,19 @@ class DefaultAlgorithm implements KeyAlgorithmInterface
      */
     public function generate($len = 40)
     {
-        // We generate twice as many bytes here because we want to ensure we have
+        $stripped = '';
-        // enough after we base64 encode it to get the length we need because we
+        do {
-        // take out the "/", "+", and "=" characters.
+            $bytes = openssl_random_pseudo_bytes($len, $strong);
-        $bytes = openssl_random_pseudo_bytes($len * 2, $strong);
 
-        // We want to stop execution if the key fails because, well, that is bad.
+            // We want to stop execution if the key fails because, well, that is bad.
-        if ($bytes === false || $strong === false) {
+            if ($bytes === false || $strong === false) {
-            // @codeCoverageIgnoreStart
+                // @codeCoverageIgnoreStart
-            throw new \Exception('Error Generating Key');
+                throw new \Exception('Error Generating Key');
-            // @codeCoverageIgnoreEnd
+                // @codeCoverageIgnoreEnd
-        }
+            }
+            $stripped .= str_replace(['/', '+', '='], '', base64_encode($bytes));
+        } while (strlen($stripped) < $len);
 
-        return substr(str_replace(['/', '+', '='], '', base64_encode($bytes)), 0, $len);
+        return substr($stripped, 0, $len);
     }
 }

src/Util/KeyAlgorithm/KeyAlgorithmInterface.php

@@ -15,7 +15,9 @@ interface KeyAlgorithmInterface
 {
     /**
      * Generate a new unique code
-     * @param  integer $len Length of the generated code
+     *
+     * @param integer $len Length of the generated code
+     *
      * @return string
      */
     public function generate($len);

src/Util/RedirectUri.php

@@ -18,9 +18,11 @@ class RedirectUri
 {
     /**
      * Generate a new redirect uri
-     * @param  string $uri            The base URI
+     *
-     * @param  array  $params         The query string parameters
+     * @param string $uri            The base URI
-     * @param  string $queryDelimeter The query string delimeter (default: "?")
+     * @param array  $params         The query string parameters
+     * @param string $queryDelimeter The query string delimeter (default: "?")
+     *
      * @return string The updated URI
      */
     public static function make($uri, $params = [], $queryDelimeter = '?')

src/Util/SecureKey.php

@@ -23,7 +23,9 @@ class SecureKey
 
     /**
      * Generate a new unique code
-     * @param  integer $len Length of the generated code
+     *
+     * @param integer $len Length of the generated code
+     *
      * @return string
      */
     public static function generate($len = 40)

tests/unit/Entity/AbstractTokenEntityTest.php

@@ -2,10 +2,10 @@
 
 namespace LeagueTests\Entity;
 
-use LeagueTests\Stubs\StubAbstractTokenEntity;
 use League\OAuth2\Server\AuthorizationServer;
 use League\OAuth2\Server\Entity\ScopeEntity;
 use League\OAuth2\Server\Entity\SessionEntity;
+use LeagueTests\Stubs\StubAbstractTokenEntity;
 use Mockery as M;
 
 class AbstractTokenEntityTest extends \PHPUnit_Framework_TestCase

tests/unit/Grant/AbstractGrantTest.php

@@ -2,12 +2,12 @@
 
 namespace LeagueTests\Grant;
 
-use LeagueTests\Stubs\StubAbstractGrant;
 use League\OAuth2\Server\AuthorizationServer;
 use League\OAuth2\Server\Entity\ClientEntity;
 use League\OAuth2\Server\Entity\ScopeEntity;
 use League\OAuth2\Server\Exception\InvalidRequestException;
 use League\OAuth2\Server\Grant;
+use LeagueTests\Stubs\StubAbstractGrant;
 use Mockery as M;
 
 class AbstractGrantTest extends \PHPUnit_Framework_TestCase

tests/unit/Grant/RefreshTokenGrantTest.php

@@ -288,7 +288,7 @@ class RefreshTokenGrantTest extends \PHPUnit_Framework_TestCase
     public function testCompleteFlowExpiredRefreshToken()
     {
         $this->setExpectedException('League\OAuth2\Server\Exception\InvalidRefreshException');
-        
+
         $_POST = [
             'grant_type'    => 'refresh_token',
             'client_id'     =>  'testapp',
@@ -421,4 +421,150 @@ class RefreshTokenGrantTest extends \PHPUnit_Framework_TestCase
 
         $server->issueAccessToken();
     }
+
+    public function testCompleteFlowRotateRefreshToken()
+    {
+        $_POST = [
+            'grant_type'    => 'refresh_token',
+            'client_id'     =>  'testapp',
+            'client_secret' =>  'foobar',
+            'refresh_token' =>  'refresh_token',
+        ];
+
+        $server = new AuthorizationServer();
+        $grant = new RefreshTokenGrant();
+
+        $clientStorage = M::mock('League\OAuth2\Server\Storage\ClientInterface');
+        $clientStorage->shouldReceive('setServer');
+        $clientStorage->shouldReceive('get')->andReturn(
+            (new ClientEntity($server))->hydrate(['id' => 'testapp'])
+        );
+
+        $sessionStorage = M::mock('League\OAuth2\Server\Storage\SessionInterface');
+        $sessionStorage->shouldReceive('setServer');
+        $sessionStorage->shouldReceive('getScopes')->shouldReceive('getScopes')->andReturn([]);
+        $sessionStorage->shouldReceive('associateScope');
+        $sessionStorage->shouldReceive('getByAccessToken')->andReturn(
+            (new SessionEntity($server))
+        );
+
+        $accessTokenStorage = M::mock('League\OAuth2\Server\Storage\AccessTokenInterface');
+        $accessTokenStorage->shouldReceive('setServer');
+        $accessTokenStorage->shouldReceive('get')->andReturn(
+            (new AccessTokenEntity($server))
+        );
+        $accessTokenStorage->shouldReceive('delete');
+        $accessTokenStorage->shouldReceive('create');
+        $accessTokenStorage->shouldReceive('getScopes')->andReturn([
+            (new ScopeEntity($server))->hydrate(['id' => 'foo']),
+        ]);
+        $accessTokenStorage->shouldReceive('associateScope');
+
+        $refreshTokenStorage = M::mock('League\OAuth2\Server\Storage\RefreshTokenInterface');
+        $refreshTokenStorage->shouldReceive('setServer');
+        $refreshTokenStorage->shouldReceive('associateScope');
+        $refreshTokenStorage->shouldReceive('delete');
+        $refreshTokenStorage->shouldReceive('create');
+        $refreshTokenStorage->shouldReceive('get')->andReturn(
+            (new RefreshTokenEntity($server))->setId('refresh_token')->setExpireTime(time() + 86400)
+        );
+
+        $scopeStorage = M::mock('League\OAuth2\Server\Storage\ScopeInterface');
+        $scopeStorage->shouldReceive('setServer');
+        $scopeStorage->shouldReceive('get')->andReturn(
+            (new ScopeEntity($server))->hydrate(['id' => 'foo'])
+        );
+
+        $server->setClientStorage($clientStorage);
+        $server->setScopeStorage($scopeStorage);
+        $server->setSessionStorage($sessionStorage);
+        $server->setAccessTokenStorage($accessTokenStorage);
+        $server->setRefreshTokenStorage($refreshTokenStorage);
+
+        $server->addGrantType($grant);
+
+        $response = $server->issueAccessToken();
+        $this->assertTrue(array_key_exists('access_token', $response));
+        $this->assertTrue(array_key_exists('refresh_token', $response));
+        $this->assertTrue(array_key_exists('token_type', $response));
+        $this->assertTrue(array_key_exists('expires_in', $response));
+        $this->assertNotEquals($response['refresh_token'], $_POST['refresh_token']);
+
+        $grant->setRefreshTokenRotation(false);
+        $response = $server->issueAccessToken();
+        $this->assertTrue(array_key_exists('access_token', $response));
+        $this->assertTrue(array_key_exists('refresh_token', $response));
+        $this->assertTrue(array_key_exists('token_type', $response));
+        $this->assertTrue(array_key_exists('expires_in', $response));
+        $this->assertEquals($response['refresh_token'], $_POST['refresh_token']);
+    }
+
+    public function testCompleteFlowShouldRequireClientSecret()
+    {
+        $_POST = [
+            'grant_type'    => 'refresh_token',
+            'client_id'     =>  'testapp',
+            'refresh_token' =>  'refresh_token',
+        ];
+
+        $server = new AuthorizationServer();
+        $grant = new RefreshTokenGrant();
+        $grant->setRequireClientSecret(false);
+
+        $clientStorage = M::mock('League\OAuth2\Server\Storage\ClientInterface');
+        $clientStorage->shouldReceive('setServer');
+        $clientStorage->shouldReceive('get')->andReturn(
+            (new ClientEntity($server))->hydrate(['id' => 'testapp'])
+        );
+
+        $sessionStorage = M::mock('League\OAuth2\Server\Storage\SessionInterface');
+        $sessionStorage->shouldReceive('setServer');
+        $sessionStorage->shouldReceive('getScopes')->shouldReceive('getScopes')->andReturn([]);
+        $sessionStorage->shouldReceive('associateScope');
+        $sessionStorage->shouldReceive('getByAccessToken')->andReturn(
+            (new SessionEntity($server))
+        );
+
+        $accessTokenStorage = M::mock('League\OAuth2\Server\Storage\AccessTokenInterface');
+        $accessTokenStorage->shouldReceive('setServer');
+        $accessTokenStorage->shouldReceive('get')->andReturn(
+            (new AccessTokenEntity($server))
+        );
+        $accessTokenStorage->shouldReceive('delete');
+        $accessTokenStorage->shouldReceive('create');
+        $accessTokenStorage->shouldReceive('getScopes')->andReturn([
+            (new ScopeEntity($server))->hydrate(['id' => 'foo']),
+        ]);
+        $accessTokenStorage->shouldReceive('associateScope');
+
+        $refreshTokenStorage = M::mock('League\OAuth2\Server\Storage\RefreshTokenInterface');
+        $refreshTokenStorage->shouldReceive('setServer');
+        $refreshTokenStorage->shouldReceive('associateScope');
+        $refreshTokenStorage->shouldReceive('delete');
+        $refreshTokenStorage->shouldReceive('create');
+        $refreshTokenStorage->shouldReceive('get')->andReturn(
+            (new RefreshTokenEntity($server))->setId('refresh_token')->setExpireTime(time() + 86400)
+        );
+
+        $scopeStorage = M::mock('League\OAuth2\Server\Storage\ScopeInterface');
+        $scopeStorage->shouldReceive('setServer');
+        $scopeStorage->shouldReceive('get')->andReturn(
+            (new ScopeEntity($server))->hydrate(['id' => 'foo'])
+        );
+
+        $server->setClientStorage($clientStorage);
+        $server->setScopeStorage($scopeStorage);
+        $server->setSessionStorage($sessionStorage);
+        $server->setAccessTokenStorage($accessTokenStorage);
+        $server->setRefreshTokenStorage($refreshTokenStorage);
+
+        $server->addGrantType($grant);
+
+        $response = $server->issueAccessToken();
+        $this->assertTrue(array_key_exists('access_token', $response));
+        $this->assertTrue(array_key_exists('refresh_token', $response));
+        $this->assertTrue(array_key_exists('token_type', $response));
+        $this->assertTrue(array_key_exists('expires_in', $response));
+
+    }
 }

tests/unit/TokenType/MacTest.php

@@ -0,0 +1,165 @@
+<?php
+
+namespace LeagueTests\TokenType;
+
+use League\OAuth2\Server\AuthorizationServer;
+use League\OAuth2\Server\Entity\AccessTokenEntity;
+use League\OAuth2\Server\TokenType\MAC;
+use Mockery as M;
+use Symfony\Component\HttpFoundation\Request;
+
+class MacTest extends \PHPUnit_Framework_TestCase
+{
+    public function testGenerateResponse()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('create');
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $accessToken = new AccessTokenEntity($server);
+        $accessToken->setId(uniqid());
+        $accessToken->setExpireTime(time());
+
+        $tokenType->setParam('access_token', $accessToken->getId());
+        $tokenType->setParam('expires_in', 3600);
+
+        $response = $tokenType->generateResponse();
+
+        $this->assertEquals($accessToken->getId(), $response['access_token']);
+        $this->assertEquals('mac', $response['token_type']);
+        $this->assertEquals(3600, $response['expires_in']);
+        $this->assertEquals('hmac-sha-256', $response['mac_algorithm']);
+        $this->assertArrayHasKey('mac_key', $response);
+    }
+
+    public function testDetermineAccessTokenInHeaderValid()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('getByAccessToken')->andReturn('abcdef');
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $ts = time();
+
+        $request = Request::createFromGlobals();
+        $calculatedSignatureParts = [
+            $ts,
+            'foo',
+            strtoupper($request->getMethod()),
+            $request->getRequestUri(),
+            $request->getHost(),
+            $request->getPort(),
+            'ext'
+        ];
+        $calculatedSignature = base64_encode(hash_hmac('sha256', implode("\n", $calculatedSignatureParts), 'abcdef', true));
+
+        $request->headers->set('Authorization',  sprintf('MAC id="foo", nonce="foo", ts="%s", mac="%s", ext="ext"', $ts, $calculatedSignature));
+
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $response = $tokenType->determineAccessTokenInHeader($request);
+        $this->assertEquals('foo', $response);
+    }
+
+    public function testDetermineAccessTokenInHeaderMissingHeader()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('getByAccessToken')->andReturn('abcdef');
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $request = Request::createFromGlobals();
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $response = $tokenType->determineAccessTokenInHeader($request);
+
+        $this->assertEquals(null, $response);
+    }
+
+    public function testDetermineAccessTokenInHeaderMissingAuthMac()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('getByAccessToken')->andReturn('abcdef');
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $request = Request::createFromGlobals();
+        $request->headers->set('Authorization', '');
+
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $response = $tokenType->determineAccessTokenInHeader($request);
+
+        $this->assertEquals(null, $response);
+    }
+
+    public function testDetermineAccessTokenInHeaderInvalidParam()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('getByAccessToken')->andReturn('abcdef');
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $request = Request::createFromGlobals();
+        $request->headers->set('Authorization', 'MAC ');
+
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $response = $tokenType->determineAccessTokenInHeader($request);
+
+        $this->assertEquals(null, $response);
+    }
+
+    public function testDetermineAccessTokenInHeaderMismatchTimestamp()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('getByAccessToken')->andReturn('abcdef');
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $ts = time() - 100;
+
+        $request = Request::createFromGlobals();
+        $request->headers->set('Authorization',  sprintf('MAC id="foo", nonce="foo", ts="%s", mac="%s", ext="ext"', $ts, 'foo'));
+
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $response = $tokenType->determineAccessTokenInHeader($request);
+        $this->assertEquals(null, $response);
+    }
+
+    public function testDetermineAccessTokenInHeaderMissingMacKey()
+    {
+        $macStorage = M::mock('\League\OAuth2\Server\Storage\MacTokenInterface');
+        $macStorage->shouldReceive('getByAccessToken')->andReturn(null);
+
+        $server = new AuthorizationServer();
+        $server->setMacStorage($macStorage);
+
+        $ts = time();
+
+        $request = Request::createFromGlobals();
+        $request->headers->set('Authorization',  sprintf('MAC id="foo", nonce="foo", ts="%s", mac="%s", ext="ext"', $ts, 'foo'));
+
+        $tokenType = new MAC();
+        $tokenType->setServer($server);
+
+        $response = $tokenType->determineAccessTokenInHeader($request);
+        $this->assertEquals(null, $response);
+    }
+}