Merge branch 'develop'v0.2

24 files changed, 238 insertions, 128 deletions

diff --git a/src/OAuth2/Controller/AccessController.php b/src/OAuth2/Controller/AccessController.php
index 8c2449a..883c64a 100644
--- a/src/OAuth2/Controller/AccessController.php
+++ b/src/OAuth2/Controller/AccessController.php
@@ -25,7 +25,7 @@ class OAuth2_Controller_AccessController implements OAuth2_Controller_AccessCont
         $this->util = $util;
     }
 
-    public function verifyAccessRequest(OAuth2_Request $request)
+    public function verifyAccessRequest(OAuth2_RequestInterface $request)
     {
         $token = $this->tokenType->getAccessTokenParameter($request);
         $this->response = $this->tokenType->getResponse();
diff --git a/src/OAuth2/Controller/AccessControllerInterface.php b/src/OAuth2/Controller/AccessControllerInterface.php
index ff63b13..a7b77c8 100644
--- a/src/OAuth2/Controller/AccessControllerInterface.php
+++ b/src/OAuth2/Controller/AccessControllerInterface.php
@@ -2,7 +2,7 @@
 
 interface OAuth2_Controller_AccessControllerInterface extends OAuth2_Response_ProviderInterface
 {
-    public function verifyAccessRequest(OAuth2_Request $request);
+    public function verifyAccessRequest(OAuth2_RequestInterface $request);
 
     public function getAccessTokenData($token_param, $scope = null);
 }
\ No newline at end of file
diff --git a/src/OAuth2/Controller/AuthorizeController.php b/src/OAuth2/Controller/AuthorizeController.php
index c7603ff..09ff56c 100644
--- a/src/OAuth2/Controller/AuthorizeController.php
+++ b/src/OAuth2/Controller/AuthorizeController.php
@@ -27,7 +27,7 @@ class OAuth2_Controller_AuthorizeController implements OAuth2_Controller_Authori
         $this->util = $util;
     }
 
-    public function handleAuthorizeRequest(OAuth2_Request $request, $is_authorized, $user_id = null)
+    public function handleAuthorizeRequest(OAuth2_RequestInterface $request, $is_authorized, $user_id = null)
     {
         if (!is_bool($is_authorized)) {
             throw new InvalidArgumentException('Argument "is_authorized" must be a boolean.  This method must know if the user has granted access to the client.');
@@ -56,7 +56,7 @@ class OAuth2_Controller_AuthorizeController implements OAuth2_Controller_Authori
         return new OAuth2_Response_Redirect($uri);
     }
 
-    public function validateAuthorizeRequest(OAuth2_Request $request)
+    public function validateAuthorizeRequest(OAuth2_RequestInterface $request)
     {
         // Make sure a valid client id was supplied (we can not redirect because we were unable to verify the URI)
         if (!$client_id = $request->query("client_id")) {
@@ -139,7 +139,7 @@ class OAuth2_Controller_AuthorizeController implements OAuth2_Controller_Authori
         }
 
         // Return retrieved client details together with input
-        return ($request->query + $clientData + array('state' => null));
+        return ((array)$request->getAllQueryParameters() + $clientData + array('state' => null));
     }
 
     public function getResponse()
diff --git a/src/OAuth2/Controller/AuthorizeControllerInterface.php b/src/OAuth2/Controller/AuthorizeControllerInterface.php
index 463ebda..4110297 100644
--- a/src/OAuth2/Controller/AuthorizeControllerInterface.php
+++ b/src/OAuth2/Controller/AuthorizeControllerInterface.php
@@ -14,7 +14,7 @@ interface OAuth2_Controller_AuthorizeControllerInterface extends OAuth2_Response
     const RESPONSE_TYPE_AUTHORIZATION_CODE = 'code';
     const RESPONSE_TYPE_ACCESS_TOKEN = 'token';
 
-    public function handleAuthorizeRequest(OAuth2_Request $request, $is_authorized, $user_id = null);
+    public function handleAuthorizeRequest(OAuth2_RequestInterface $request, $is_authorized, $user_id = null);
 
-    public function validateAuthorizeRequest(OAuth2_Request $request);
+    public function validateAuthorizeRequest(OAuth2_RequestInterface $request);
 }
\ No newline at end of file
diff --git a/src/OAuth2/Controller/GrantController.php b/src/OAuth2/Controller/GrantController.php
index d22ddd8..0e46802 100644
--- a/src/OAuth2/Controller/GrantController.php
+++ b/src/OAuth2/Controller/GrantController.php
@@ -15,15 +15,16 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
         foreach ($grantTypes as $grantType) {
             $this->addGrantType($grantType);
         }
+
         if (is_null($util)) {
             $util = new OAuth2_Util();
         }
         $this->util = $util;
     }
 
-    public function handleGrantRequest(OAuth2_Request $request, $grantType = null)
+    public function handleGrantRequest(OAuth2_RequestInterface $request)
     {
-        if ($token = $this->grantAccessToken($request, $grantType)) {
+        if ($token = $this->grantAccessToken($request)) {
             $this->response = new OAuth2_Response($token);
         }
         return $this->response;
@@ -32,9 +33,9 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
     /**
      * Grant or deny a requested access token.
      * This would be called from the "/token" endpoint as defined in the spec.
-     * Obviously, you can call your endpoint whatever you want.
+     * You can call your endpoint whatever you want.
      *
-     * @param $request - OAuth2_Request
+     * @param $request - OAuth2_RequestInterface
      * Request object to grant access token
      * @param $grantType - mixed
      * OAuth2_GrantTypeInterface instance or one of the grant types configured in the constructor
@@ -48,31 +49,27 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
      *
      * @ingroup oauth2_section_4
      */
-    public function grantAccessToken(OAuth2_Request $request, $grantType = null)
+    public function grantAccessToken(OAuth2_RequestInterface $request)
     {
-        if (!$grantType instanceof OAuth2_GrantTypeInterface) {
-            if (is_null($grantType)) {
-                if (!$grantType = $request->parameter('grant_type')) {
-                    $this->response = new OAuth2_Response_Error(400, 'invalid_request', 'The grant type was not specified in the request');
-                    return null;
-                }
-            } else if (!is_string($grantType)) {
-                throw new InvalidArgumentException('parameter $grantType must be an instance of OAuth2_GrantTypeInterface, a string representing a configured grant type, or null to pull grant type from request');
-            }
-            if (!isset($this->grantTypes[$grantType])) {
-                /* TODO: If this is an OAuth2 supported grant type that we have chosen not to implement, throw a 501 Not Implemented instead */
-                $this->response = new OAuth2_Response_Error(400, 'unsupported_grant_type', sprintf('Grant type "%s" not supported', $grantType));
-                return null;
-            }
-            $grantType = $this->grantTypes[$grantType];
+        // Determine grant type from request
+        if (!($grantType = $request->query('grant_type')) && !($grantType = $request->request('grant_type'))) {
+            $this->response = new OAuth2_Response_Error(400, 'invalid_request', 'The grant type was not specified in the request');
+            return null;
         }
+        if (!isset($this->grantTypes[$grantType])) {
+            /* TODO: If this is an OAuth2 supported grant type that we have chosen not to implement, throw a 501 Not Implemented instead */
+            $this->response = new OAuth2_Response_Error(400, 'unsupported_grant_type', sprintf('Grant type "%s" not supported', $grantType));
+            return null;
+        }
+        $grantType = $this->grantTypes[$grantType];
 
+        // get and validate client authorization from the request
         if (!$clientData = $this->getClientCredentials($request)) {
             return null;
         }
 
         if (!isset($clientData['client_id']) || !isset($clientData['client_secret'])) {
-            throw new LogicException('the clientData array must have "client_id" and "client_secret" values set.  Use getClientCredentials()');
+            throw new LogicException('the clientData array must have "client_id" and "client_secret" values set.');
         }
 
         if ($this->clientStorage->checkClientCredentials($clientData['client_id'], $clientData['client_secret']) === false) {
@@ -80,13 +77,12 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
             return null;
         }
 
-        if (!$this->clientStorage->checkRestrictedGrantType($clientData['client_id'], $grantType)) {
+        if (!$this->clientStorage->checkRestrictedGrantType($clientData['client_id'], $grantType->getQuerystringIdentifier())) {
             $this->response = new OAuth2_Response_Error(400, 'unauthorized_client', 'The grant type is unauthorized for this client_id');
             return null;
         }
 
-        /* TODO: Find a better way to handle grantTypes and their responses */
-
+        // validate the request for the token
         if (!$grantType->validateRequest($request)) {
             if ($grantType instanceof OAuth2_Response_ProviderInterface && $response = $grantType->getResponse()) {
                 $this->response = $response;
@@ -122,18 +118,14 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
         }
 
         // Check scope, if provided
-        if (isset($request->query['scope']) && (!is_array($tokenData) || !isset($tokenData["scope"]) || !$this->util->checkScope($request->query['scope'], $tokenData["scope"]))) {
+        if (null != $request->query('scope') && (!is_array($tokenData) || !isset($tokenData["scope"]) || !$this->util->checkScope($request->query('scope'), $tokenData["scope"]))) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_scope', 'An unsupported scope was requested.');
             return null;
         }
 
-        $user_id = isset($tokenData['user_id']) ? $tokenData['user_id'] : null;
-        $token = $this->accessToken->createAccessToken($clientData['client_id'], $user_id, $tokenData['scope']);
-
-        // TODO: Remove this
-        $grantType->finishGrantRequest($token);
+        $tokenData['user_id'] = isset($tokenData['user_id']) ? $tokenData['user_id'] : null;
 
-        return $token;
+        return $grantType->createAccessToken($this->accessToken, $clientData, $tokenData);
     }
 
     /**
@@ -156,7 +148,7 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
      *
      * @ingroup oauth2_section_2
      */
-    public function getClientCredentials(OAuth2_Request $request)
+    public function getClientCredentials(OAuth2_RequestInterface $request)
     {
         if (!is_null($request->headers('PHP_AUTH_USER')) && !is_null($request->headers('PHP_AUTH_PW'))) {
             return array('client_id' => $request->headers('PHP_AUTH_USER'), 'client_secret' => $request->headers('PHP_AUTH_PW'));
@@ -186,7 +178,7 @@ class OAuth2_Controller_GrantController implements OAuth2_Controller_GrantContro
     public function addGrantType(OAuth2_GrantTypeInterface $grantType, $identifier = null)
     {
         if (is_null($identifier) || is_numeric($identifier)) {
-            $identifier = $grantType->getIdentifier();
+            $identifier = $grantType->getQuerystringIdentifier();
         }
 
         $this->grantTypes[$identifier] = $grantType;
diff --git a/src/OAuth2/Controller/GrantControllerInterface.php b/src/OAuth2/Controller/GrantControllerInterface.php
index 77fd66f..2bdcfd0 100644
--- a/src/OAuth2/Controller/GrantControllerInterface.php
+++ b/src/OAuth2/Controller/GrantControllerInterface.php
@@ -2,9 +2,16 @@
 
 interface OAuth2_Controller_GrantControllerInterface extends OAuth2_Response_ProviderInterface
 {
-    public function handleGrantRequest(OAuth2_Request $request, $grantType = null);
+    /**
+     * handleGrantRequest
+     *
+     * @param $request
+     * OAuth2_RequestInterface - The current http request
+     *
+     **/
+    public function handleGrantRequest(OAuth2_RequestInterface $request);
 
-    public function grantAccessToken(OAuth2_Request $request, $grantType = null);
+    public function grantAccessToken(OAuth2_RequestInterface $request);
 
-    public function getClientCredentials(OAuth2_Request $request);
+    public function getClientCredentials(OAuth2_RequestInterface $request);
 }
\ No newline at end of file
diff --git a/src/OAuth2/GrantType/AuthorizationCode.php b/src/OAuth2/GrantType/AuthorizationCode.php
index 5ae1bd1..2a40b2f 100644
--- a/src/OAuth2/GrantType/AuthorizationCode.php
+++ b/src/OAuth2/GrantType/AuthorizationCode.php
@@ -13,14 +13,14 @@ class OAuth2_GrantType_AuthorizationCode implements OAuth2_GrantTypeInterface, O
         $this->storage = $storage;
     }
 
-    public function getIdentifier()
+    public function getQuerystringIdentifier()
     {
         return 'authorization_code';
     }
 
     public function validateRequest($request)
     {
-        if (!isset($request->query['code']) || !$request->query['code']) {
+        if (!$request->query('code')) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_request', 'Missing parameter: "code" is required');
             return false;
         }
@@ -30,7 +30,7 @@ class OAuth2_GrantType_AuthorizationCode implements OAuth2_GrantTypeInterface, O
 
     public function getTokenDataFromRequest($request)
     {
-        if (!$tokenData = $this->storage->getAuthorizationCode($request->query['code'])) {
+        if (!$tokenData = $this->storage->getAuthorizationCode($request->query('code'))) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_grant', "Authorization code doesn't exist or is invalid for the client");
             return null;
         }
@@ -49,7 +49,7 @@ class OAuth2_GrantType_AuthorizationCode implements OAuth2_GrantTypeInterface, O
         return $tokenData;
     }
 
-    public function validateTokenData(array $tokenData, array $clientData)
+    public function validateTokenData($tokenData, array $clientData)
     {
         // Check the code exists
         if ($tokenData === null || $clientData['client_id'] != $tokenData['client_id']) {
@@ -66,8 +66,10 @@ class OAuth2_GrantType_AuthorizationCode implements OAuth2_GrantTypeInterface, O
         return true;
     }
 
-    public function finishGrantRequest($token)
-    {}
+    public function createAccessToken(OAuth2_ResponseType_AccessTokenInterface $accessToken, array $clientData, array $tokenData)
+    {
+        return $accessToken->createAccessToken($clientData['client_id'], $tokenData['user_id'], $tokenData['scope']);
+    }
 
     public function getResponse()
     {
diff --git a/src/OAuth2/GrantType/ClientCredentials.php b/src/OAuth2/GrantType/ClientCredentials.php
index 4d47c6b..2dae255 100644
--- a/src/OAuth2/GrantType/ClientCredentials.php
+++ b/src/OAuth2/GrantType/ClientCredentials.php
@@ -2,7 +2,7 @@
 
 class OAuth2_GrantType_ClientCredentials implements OAuth2_GrantTypeInterface
 {
-    public function getIdentifier()
+    public function getQuerystringIdentifier()
     {
         return 'client_credentials';
     }
@@ -22,12 +22,19 @@ class OAuth2_GrantType_ClientCredentials implements OAuth2_GrantTypeInterface
         );
     }
 
-    public function validateTokenData(array $tokenData, array $clientData)
+    public function validateTokenData($tokenData, array $clientData)
     {
         // Scope is validated in the client class
         return true;
     }
 
-    public function finishGrantRequest($token)
-    {}
+    public function createAccessToken(OAuth2_ResponseType_AccessTokenInterface $accessToken, array $clientData, array $tokenData)
+    {
+        /*
+         * Client Credentials Grant does NOT include a refresh token
+         * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.4.3
+         */
+        $includeRefreshToken = false;
+        return $accessToken->createAccessToken($clientData['client_id'], $tokenData['user_id'], $tokenData['scope'], $includeRefreshToken);
+    }
 }
\ No newline at end of file
diff --git a/src/OAuth2/GrantType/RefreshToken.php b/src/OAuth2/GrantType/RefreshToken.php
index 36057fd..5bc9732 100644
--- a/src/OAuth2/GrantType/RefreshToken.php
+++ b/src/OAuth2/GrantType/RefreshToken.php
@@ -7,21 +7,25 @@ class OAuth2_GrantType_RefreshToken implements OAuth2_GrantTypeInterface, OAuth2
 {
     private $storage;
     private $response;
+    private $config;
     private $oldRefreshToken;
 
-    public function __construct(OAuth2_Storage_RefreshTokenInterface $storage)
+    public function __construct(OAuth2_Storage_RefreshTokenInterface $storage, $config = array())
     {
+        $this->config = array_merge(array(
+            'always_issue_new_refresh_token' => false
+        ), $config);
         $this->storage = $storage;
     }
 
-    public function getIdentifier()
+    public function getQuerystringIdentifier()
     {
         return 'refresh_token';
     }
 
     public function validateRequest($request)
     {
-        if (!isset($request->query["refresh_token"]) || !$request->query['refresh_token']) {
+        if (!$request->query("refresh_token")) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_request', 'Missing parameter: "refresh_token" is required');
             return false;
         }
@@ -31,7 +35,7 @@ class OAuth2_GrantType_RefreshToken implements OAuth2_GrantTypeInterface, OAuth2
 
     public function getTokenDataFromRequest($request)
     {
-        if (!$stored = $this->storage->getRefreshToken($request->query["refresh_token"])) {
+        if (!$stored = $this->storage->getRefreshToken($request->query("refresh_token"))) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_grant', 'Invalid refresh token');
             return false;
         }
@@ -39,7 +43,7 @@ class OAuth2_GrantType_RefreshToken implements OAuth2_GrantTypeInterface, OAuth2
         return $stored;
     }
 
-    public function validateTokenData(array $tokenData, array $clientData)
+    public function validateTokenData($tokenData, array $clientData)
     {
         if ($tokenData === null || $clientData['client_id'] != $tokenData["client_id"]) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_grant', 'Invalid refresh token');
@@ -57,9 +61,21 @@ class OAuth2_GrantType_RefreshToken implements OAuth2_GrantTypeInterface, OAuth2
         return true;
     }
 
-    public function finishGrantRequest($token)
+    public function createAccessToken(OAuth2_ResponseType_AccessTokenInterface $accessToken, array $clientData, array $tokenData)
     {
-        $this->storage->unsetRefreshToken($this->oldRefreshToken);
+        /*
+         * It is optional to force a new refresh token when a refresh token is used.
+         * However, if a new refresh token is issued, the old one MUST be expired
+         * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-6
+         */
+        $issueNewRefreshToken = $this->config['always_issue_new_refresh_token'];
+        $token = $accessToken->createAccessToken($clientData['client_id'], $tokenData['user_id'], $tokenData['scope'], $issueNewRefreshToken);
+
+        if ($issueNewRefreshToken) {
+            $this->storage->unsetRefreshToken($this->oldRefreshToken);
+        }
+
+        return $token;
     }
 
     public function getResponse()
diff --git a/src/OAuth2/GrantType/UserCredentials.php b/src/OAuth2/GrantType/UserCredentials.php
index 5a5dabe..51d05aa 100644
--- a/src/OAuth2/GrantType/UserCredentials.php
+++ b/src/OAuth2/GrantType/UserCredentials.php
@@ -13,14 +13,14 @@ class OAuth2_GrantType_UserCredentials implements OAuth2_GrantTypeInterface, OAu
         $this->storage = $storage;
     }
 
-    public function getIdentifier()
+    public function getQuerystringIdentifier()
     {
         return 'password';
     }
 
     public function validateRequest($request)
     {
-        if (!isset($request->query["username"]) || !isset($request->query["password"]) || !$request->query["username"] || !$request->query["password"]) {
+        if (!$request->query("password") || !$request->query("username")) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_request', 'Missing parameters: "username" and "password" required');
             return false;
         }
@@ -30,22 +30,32 @@ class OAuth2_GrantType_UserCredentials implements OAuth2_GrantTypeInterface, OAu
 
     public function getTokenDataFromRequest($request)
     {
-        if (!$tokenData = $this->storage->checkUserCredentials($request->query["username"], $request->query["password"])) {
+        if (!$this->storage->checkUserCredentials($request->query("username"), $request->query("password"))) {
             $this->response = new OAuth2_Response_Error(400, 'invalid_grant', 'Invalid username and password combination');
             return false;
         }
 
+        $tokenData = $this->storage->getUserDetails($request->query("username"));
+
+        // tokenData can be an empty array
+        if (false === $tokenData || is_null($tokenData)) {
+            $this->response = new OAuth2_Response_Error(400, 'invalid_grant', 'Unable to retrieve user information');
+            return false;
+        }
+
         return $tokenData;
     }
 
-    public function validateTokenData(array $tokenData, array $clientData)
+    public function validateTokenData($tokenData, array $clientData)
     {
         // Scope is validated in the client class
         return true;
     }
 
-    public function finishGrantRequest($token)
-    {}
+    public function createAccessToken(OAuth2_ResponseType_AccessTokenInterface $accessToken, array $clientData, array $tokenData)
+    {
+        return $accessToken->createAccessToken($clientData['client_id'], $tokenData['user_id'], $tokenData['scope']);
+    }
 
     public function getResponse()
     {
diff --git a/src/OAuth2/GrantTypeInterface.php b/src/OAuth2/GrantTypeInterface.php
index 25146de..0573f9d 100644
--- a/src/OAuth2/GrantTypeInterface.php
+++ b/src/OAuth2/GrantTypeInterface.php
@@ -2,9 +2,9 @@
 
 interface OAuth2_GrantTypeInterface
 {
-    public function getIdentifier();
+    public function getQuerystringIdentifier();
     public function validateRequest($request);
     public function getTokenDataFromRequest($request);
-    public function validateTokenData(array $tokenData, array $clientData);
-    public function finishGrantRequest($token);
+    public function validateTokenData($tokenData, array $clientData);
+    public function createAccessToken(OAuth2_ResponseType_AccessTokenInterface $accessToken, array $clientData, array $tokenData);
 }
\ No newline at end of file
diff --git a/src/OAuth2/Request.php b/src/OAuth2/Request.php
index 3f745c9..3ddc3ff 100644
--- a/src/OAuth2/Request.php
+++ b/src/OAuth2/Request.php
@@ -14,6 +14,7 @@ class OAuth2_Request implements OAuth2_RequestInterface
     public $files;
     public $cookies;
     public $headers;
+    public $content;
 
     /**
      * Constructor.
@@ -79,9 +80,9 @@ class OAuth2_Request implements OAuth2_RequestInterface
         return isset($this->headers[$name]) ? $this->headers[$name] : $default;
     }
 
-    public function parameter($name, $default = null)
+    public function getAllQueryParameters()
     {
-        return $this->query($name) ? $this->query($name) : $this->request($name, $default);
+        return $this->query;
     }
 
     /**
diff --git a/src/OAuth2/RequestInterface.php b/src/OAuth2/RequestInterface.php
index c23eb55..0195605 100644
--- a/src/OAuth2/RequestInterface.php
+++ b/src/OAuth2/RequestInterface.php
@@ -2,4 +2,13 @@
 
 interface OAuth2_RequestInterface
 {
+    public function query($name, $default = null);
+
+    public function request($name, $default = null);
+
+    public function server($name, $default = null);
+
+    public function headers($name, $default = null);
+
+    public function getAllQueryParameters();
 }
\ No newline at end of file
diff --git a/src/OAuth2/Response/AuthenticationError.php b/src/OAuth2/Response/AuthenticationError.php
index 7c2566a..c3c5a62 100644
--- a/src/OAuth2/Response/AuthenticationError.php
+++ b/src/OAuth2/Response/AuthenticationError.php
@@ -8,7 +8,7 @@ class OAuth2_Response_AuthenticationError extends OAuth2_Response_Error
     public function __construct($statusCode, $error, $errorDescription, $tokenType, $realm, $scope = null)
     {
         parent::__construct($statusCode, $error, $errorDescription);
-        $authHeader = sprintf('WWW-Authenticate: %s realm=%s', $tokenType, $realm);
+        $authHeader = sprintf('%s realm=%s', $tokenType, $realm);
         if ($scope) {
             $authHeader = sprintf('%s, scope=%s', $authHeader, $scope);
         }
diff --git a/src/OAuth2/ResponseType/AccessToken.php b/src/OAuth2/ResponseType/AccessToken.php
index 43efc95..37b5e54 100644
--- a/src/OAuth2/ResponseType/AccessToken.php
+++ b/src/OAuth2/ResponseType/AccessToken.php
@@ -17,7 +17,7 @@ class OAuth2_ResponseType_AccessToken implements OAuth2_ResponseType_AccessToken
             'token_type'             => 'bearer',
             'access_lifetime'        => 3600,
             'refresh_token_lifetime' => 1209600,
-        ));
+        ), $config);
     }
 
     // same params as above
@@ -28,8 +28,13 @@ class OAuth2_ResponseType_AccessToken implements OAuth2_ResponseType_AccessToken
 
         $params += array('scope' => null, 'state' => null);
 
-        // should this call from a grant type?
-        $result["fragment"] = $this->createAccessToken($params['client_id'], $user_id, $params['scope']);
+        /*
+         * a refresh token MUST NOT be included in the fragment
+         *
+         * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.2.2
+         */
+        $includeRefreshToken = false;
+        $result["fragment"] = $this->createAccessToken($params['client_id'], $user_id, $params['scope'], $includeRefreshToken);
 
         if (isset($params['state'])) {
             $result["fragment"]["state"] = $params['state'];
@@ -48,11 +53,13 @@ class OAuth2_ResponseType_AccessToken implements OAuth2_ResponseType_AccessToken
      * Client identifier related to the access token.
      * @param $scope
      * (optional) Scopes to be stored in space-separated string.
+     * @param bool $excludeRefreshToken
+     * If true, the refresh_token will be omitted from the response
      *
      * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-5
      * @ingroup oauth2_section_5
      */
-    public function createAccessToken($client_id, $user_id, $scope = null)
+    public function createAccessToken($client_id, $user_id, $scope = null, $includeRefreshToken = true)
     {
         $token = array(
             "access_token" => $this->generateAccessToken(),
@@ -63,9 +70,13 @@ class OAuth2_ResponseType_AccessToken implements OAuth2_ResponseType_AccessToken
 
         $this->tokenStorage->setAccessToken($token["access_token"], $client_id, $user_id, $this->config['access_lifetime'] ? time() + $this->config['access_lifetime'] : null, $scope);
 
-        // Issue a refresh token also, if we support them
-        /* TODO: How do we handle this? */
-        if ($this->refreshStorage) {
+        /*
+         * Issue a refresh token also, if we support them
+         *
+         * Refresh Tokens are considered supported if an instance of OAuth2_Storage_RefreshTokenInterface
+         * is supplied in the constructor
+         */
+        if ($includeRefreshToken && $this->refreshStorage) {
             $token["refresh_token"] = $this->generateRefreshToken();
             $this->refreshStorage->setRefreshToken($token['refresh_token'], $client_id, $user_id, time() + $this->config['refresh_token_lifetime'], $scope);
         }
diff --git a/src/OAuth2/ResponseType/AccessTokenInterface.php b/src/OAuth2/ResponseType/AccessTokenInterface.php
index 5247f6f..457c3b8 100644
--- a/src/OAuth2/ResponseType/AccessTokenInterface.php
+++ b/src/OAuth2/ResponseType/AccessTokenInterface.php
@@ -2,5 +2,5 @@
 
 interface OAuth2_ResponseType_AccessTokenInterface extends OAuth2_ResponseTypeInterface
 {
-    public function createAccessToken($client_id, $user_id, $scope = null);
+    public function createAccessToken($client_id, $user_id, $scope = null, $includeRefreshToken = true);
 }
\ No newline at end of file
diff --git a/src/OAuth2/Server.php b/src/OAuth2/Server.php
index bfad2ab..c67057d 100644
--- a/src/OAuth2/Server.php
+++ b/src/OAuth2/Server.php
@@ -2,7 +2,10 @@
 
 /**
 * Service class for OAuth
-* Inspired by oauth2-php (https://github.com/quizlet/oauth2-php)
+* This class serves only to wrap the other Controller classes
+* @see OAuth2_Controller_AccessController
+* @see OAuth2_Controller_AuthorizeController
+* @see OAuth2_Controller_GrantController
 */
 class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
     OAuth2_Controller_AuthorizeControllerInterface, OAuth2_Controller_GrantControllerInterface
@@ -27,14 +30,18 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      * array - array of Objects to implement storage
      * OAuth2_Storage object implementing all required storage types (ClientCredentialsInterface and AccessTokenInterface as a minimum)
      *
+     * @param array $config
+     * specify a different token lifetime, token header name, etc
+     *
      * @param array $grantTypes
      * An array of OAuth2_GrantTypeInterface to use for granting access tokens
      *
-     * @param array $config
-     * specify a different token lifetime, token header name, etc
+     * @param array $responseTypes
+     * Response types to use.  array keys should be "code" and and "token" for
+     * Access Token and Authorization Code response types
      *
-     * @param array $response
-     * Send in an instance of OAuth2_ResponseInterface to use a different response object
+     * @param OAuth2_ResponseType_AccessTokenInterface $accessTokenResponseType
+     * Response type to use for access token
      *
      * @return
      * TRUE if everything in required scope is contained in available scope,
@@ -44,7 +51,7 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      *
      * @ingroup oauth2_section_7
      */
-    public function __construct($storage = array(), array $config = array(), array $grantTypes = array(), array $responseTypes = array(), OAuth2_ResponseType_AccessToken $accessTokenResponseType = null)
+    public function __construct($storage = array(), array $config = array(), array $grantTypes = array(), array $responseTypes = array(), OAuth2_ResponseType_AccessTokenInterface $accessTokenResponseType = null)
     {
         $validStorage = array(
             'access_token' => 'OAuth2_Storage_AccessTokenInterface',
@@ -147,7 +154,7 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
                     if (isset($this->storages['refresh_token'])) {
                         $refreshStorage = $this->storages['refresh_token'];
                     }
-                    $config = array_intersect_key($this->config, array_flip(explode(' ', 'token_type access_lifetime')));
+                    $config = array_intersect_key($this->config, array_flip(explode(' ', 'token_type access_lifetime refresh_token_lifetime')));
                     $this->accessTokenResponseType = new OAuth2_ResponseType_AccessToken($this->storages['access_token'], $refreshStorage, $config);
                 }
             }
@@ -167,7 +174,7 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
             if (isset($this->storages['refresh_token'])) {
                 $refreshStorage = $this->storages['refresh_token'];
             }
-            $config = array_intersect_key($this->config, array_flip(explode(' ', 'token_type access_lifetime')));
+            $config = array_intersect_key($this->config, array_flip(explode(' ', 'token_type access_lifetime refresh_token_lifetime')));
             $responseTypes['token'] = new OAuth2_ResponseType_AccessToken($this->storages['access_token'], $refreshStorage, $config);
         }
 
@@ -217,8 +224,9 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      *
      * @param $request - OAuth2_Request
      * Request object to grant access token
-     * @param $grantType - mixed
-     * OAuth2_GrantTypeInterface instance or one of the grant types configured in the constructor
+     *
+     * @return
+     * OAuth_Response
      *
      * @throws InvalidArgumentException
      * @throws LogicException
@@ -229,21 +237,21 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      *
      * @ingroup oauth2_section_4
      */
-    public function handleGrantRequest(OAuth2_Request $request, $grantType = null)
+    public function handleGrantRequest(OAuth2_RequestInterface $request)
     {
-        $value = $this->getGrantController()->handleGrantRequest($request, $grantType);
+        $value = $this->getGrantController()->handleGrantRequest($request);
         $this->response = $this->grantController->getResponse();
         return $value;
     }
 
-    public function grantAccessToken(OAuth2_Request $request, $grantType = null)
+    public function grantAccessToken(OAuth2_RequestInterface $request)
     {
-        $value = $this->getGrantController()->grantAccessToken($request, $grantType);
+        $value = $this->getGrantController()->grantAccessToken($request);
         $this->response = $this->grantController->getResponse();
         return $value;
     }
 
-    public function getClientCredentials(OAuth2_Request $request)
+    public function getClientCredentials(OAuth2_RequestInterface $request)
     {
         $value = $this->getGrantController()->getClientCredentials($request);
         $this->response = $this->grantController->getResponse();
@@ -269,8 +277,10 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      * list of space-delimited strings.
      * - state: (optional) An opaque value used by the client to maintain
      * state between the request and callback.
+     *
      * @param $is_authorized
      * TRUE or FALSE depending on whether the user authorized the access.
+     *
      * @param $user_id
      * Identifier of user who authorized the client
      *
@@ -278,7 +288,7 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      *
      * @ingroup oauth2_section_4
      */
-    public function handleAuthorizeRequest(OAuth2_Request $request, $is_authorized, $user_id = null)
+    public function handleAuthorizeRequest(OAuth2_RequestInterface $request, $is_authorized, $user_id = null)
     {
         $value = $this->getAuthorizeController()->handleAuthorizeRequest($request, $is_authorized, $user_id);
         $this->response = $this->authorizeController->getResponse();
@@ -304,14 +314,14 @@ class OAuth2_Server implements OAuth2_Controller_AccessControllerInterface,
      *
      * @ingroup oauth2_section_3
      */
-    public function validateAuthorizeRequest(OAuth2_Request $request)
+    public function validateAuthorizeRequest(OAuth2_RequestInterface $request)
     {
         $value = $this->getAuthorizeController()->validateAuthorizeRequest($request);
         $this->response = $this->authorizeController->getResponse();
         return $value;
     }
 
-    public function verifyAccessRequest(OAuth2_Request $request)
+    public function verifyAccessRequest(OAuth2_RequestInterface $request)
     {
         $value = $this->getAccessController()->verifyAccessRequest($request);
         $this->response = $this->accessController->getResponse();
diff --git a/src/OAuth2/Storage/ClientCredentialsInterface.php b/src/OAuth2/Storage/ClientCredentialsInterface.php
index 0110c9f..374d628 100644
--- a/src/OAuth2/Storage/ClientCredentialsInterface.php
+++ b/src/OAuth2/Storage/ClientCredentialsInterface.php
@@ -35,8 +35,7 @@ interface OAuth2_Storage_ClientCredentialsInterface extends OAuth2_Storage_Clien
      * @param $client_id
      * Client identifier to be check with.
      * @param $grant_type
-     * Grant type to be check with, would be one of the values contained in
-     * OAuth2::GRANT_TYPE_REGEXP.
+     * Grant type to be check with
      *
      * @return
      * TRUE if the grant type is supported by this client identifier, and
diff --git a/src/OAuth2/Storage/Memory.php b/src/OAuth2/Storage/Memory.php
index c986076..ec5d97a 100644
--- a/src/OAuth2/Storage/Memory.php
+++ b/src/OAuth2/Storage/Memory.php
@@ -58,7 +58,12 @@ class OAuth2_Storage_Memory implements OAuth2_Storage_AuthorizationCodeInterface
 
     public function setUserCredentials($user_credentials)
     {
-        $this->userCredentials = $user_credentials;
+        return isset($this->userCredentials[$username]) ? $this->userCredentials[$username] : null;
+    }
+
+    public function getUserDetails($username)
+    {
+        return $this->getUser($username);
     }
 
     /* ClientCredentialsInterface */
diff --git a/src/OAuth2/Storage/Pdo.php b/src/OAuth2/Storage/Pdo.php
index e806bed..de659e2 100644
--- a/src/OAuth2/Storage/Pdo.php
+++ b/src/OAuth2/Storage/Pdo.php
@@ -5,7 +5,7 @@
 */
 class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
     OAuth2_Storage_AccessTokenInterface, OAuth2_Storage_ClientCredentialsInterface,
-    OAuth2_Storage_UserCredentialsInterface
+    OAuth2_Storage_UserCredentialsInterface, OAuth2_Storage_RefreshTokenInterface
 {
     private $db;
     private $config;
@@ -32,17 +32,18 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
         $connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
 
         $this->config = array_merge(array(
-            'client_table_name' => 'oauth_clients',
-            'token_table_name' => 'oauth_access_tokens',
-            'code_table_name' => 'oauth_authorization_codes',
-            'user_table_name' => 'oauth_users',
+            'client_table' => 'oauth_clients',
+            'access_token_table' => 'oauth_access_tokens',
+            'refresh_token_table' => 'oauth_refresh_tokens',
+            'code_table' => 'oauth_authorization_codes',
+            'user_table' => 'oauth_users',
         ), $config);
     }
 
     /* ClientCredentialsInterface */
     public function checkClientCredentials($client_id, $client_secret = null)
     {
-        $stmt = $this->db->prepare(sprintf('SELECT * from %s where client_id = "%s"', $this->config['client_table_name'], $client_id));
+        $stmt = $this->db->prepare(sprintf('SELECT * from %s where client_id = "%s"', $this->config['client_table'], $client_id));
         $stmt->execute();
         $result = $stmt->fetch();
 
@@ -52,7 +53,7 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
 
     public function getClientDetails($client_id)
     {
-        $stmt = $this->db->prepare(sprintf('SELECT * from %s where client_id = "%s"', $this->config['client_table_name'], $client_id));
+        $stmt = $this->db->prepare(sprintf('SELECT * from %s where client_id = "%s"', $this->config['client_table'], $client_id));
         $stmt->execute();
 
         return $stmt->fetch();
@@ -72,7 +73,7 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
     /* AccessTokenInterface */
     public function getAccessToken($access_token)
     {
-        $stmt = $this->db->prepare(sprintf('SELECT * from %s where access_token = "%s"', $this->config['token_table_name'], $access_token));
+        $stmt = $this->db->prepare(sprintf('SELECT * from %s where access_token = "%s"', $this->config['access_token_table'], $access_token));
 
         $token = $stmt->execute();
         if ($token = $stmt->fetch()) {
@@ -90,9 +91,9 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
 
         // if it exists, update it.
         if ($this->getAccessToken($access_token)) {
-            $stmt = $this->db->prepare(sprintf('UPDATE %s SET client_id=:client_id, expires=:expires, user_id=:user_id, scope=:scope where access_token=:access_token', $this->config['token_table_name']));
+            $stmt = $this->db->prepare(sprintf('UPDATE %s SET client_id=:client_id, expires=:expires, user_id=:user_id, scope=:scope where access_token=:access_token', $this->config['access_token_table']));
         } else {
-            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (access_token, client_id, expires, user_id, scope) VALUES (:access_token, :client_id, :expires, :user_id, :scope)', $this->config['token_table_name']));
+            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (access_token, client_id, expires, user_id, scope) VALUES (:access_token, :client_id, :expires, :user_id, :scope)', $this->config['access_token_table']));
         }
         return $stmt->execute(compact('access_token', 'client_id', 'user_id', 'expires', 'scope'));
     }
@@ -100,7 +101,7 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
     /* AuthorizationCodeInterface */
     public function getAuthorizationCode($code)
     {
-        $stmt = $this->db->prepare(sprintf('SELECT * from %s where authorization_code = "%s"', $this->config['code_table_name'], $code));
+        $stmt = $this->db->prepare(sprintf('SELECT * from %s where authorization_code = "%s"', $this->config['code_table'], $code));
         $stmt->execute();
 
         if ($code = $stmt->fetch()) {
@@ -118,9 +119,9 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
 
         // if it exists, update it.
         if ($this->getAuthorizationCode($code)) {
-            $stmt = $this->db->prepare($sql = sprintf('UPDATE %s SET client_id=:client_id, user_id=:user_id, redirect_uri=:redirect_uri, expires=:expires, scope=:scope where authorization_code=:code', $this->config['code_table_name']));
+            $stmt = $this->db->prepare($sql = sprintf('UPDATE %s SET client_id=:client_id, user_id=:user_id, redirect_uri=:redirect_uri, expires=:expires, scope=:scope where authorization_code=:code', $this->config['code_table']));
         } else {
-            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (authorization_code, client_id, user_id, redirect_uri, expires, scope) VALUES (:code, :client_id, :user_id, :redirect_uri, :expires, :scope)', $this->config['code_table_name']));
+            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (authorization_code, client_id, user_id, redirect_uri, expires, scope) VALUES (:code, :client_id, :user_id, :redirect_uri, :expires, :scope)', $this->config['code_table']));
         }
         return $stmt->execute(compact('code', 'client_id', 'user_id', 'redirect_uri', 'expires', 'scope'));
     }
@@ -134,6 +135,42 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
         return false;
     }
 
+    public function getUserDetails($username)
+    {
+        return $this->getUser($username);
+    }
+
+    /* RefreshTokenInterface */
+    public function getRefreshToken($refresh_token)
+    {
+        $stmt = $this->db->prepare(sprintf('SELECT * FROM %s WHERE refresh_token = "%s"', $this->config['refresh_token_table'], $refresh_token));
+
+        $token = $stmt->execute();
+        if ($token = $stmt->fetch()) {
+            // convert expires to epoch time
+            $token['expires'] = strtotime($token['expires']);
+        }
+
+        return $token;
+    }
+
+    public function setRefreshToken($refresh_token, $client_id, $user_id, $expires, $scope = NULL)
+    {
+        // convert expires to datestring
+        $expires = date('Y-m-d H:i:s', $expires);
+
+        $stmt = $this->db->prepare(sprintf('INSERT INTO %s (refresh_token, client_id, user_id, expires, scope) VALUES (:refresh_token, :client_id, :user_id, :expires, :scope)', $this->config['refresh_token_table']));
+
+        return $stmt->execute(compact('refresh_token', 'client_id', 'user_id', 'expires', 'scope'));
+    }
+
+    public function unsetRefreshToken($refresh_token)
+    {
+        $stmt = $this->db->prepare(sprintf('DELETE FROM %s WHERE refresh_token = "%s"', $this->config['refresh_token_table'], $refresh_token));
+
+        return $stmt->execute();
+    }
+
     // plaintext passwords are bad!  Override this for your application
     protected function checkPassword($user, $password)
     {
@@ -142,7 +179,7 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
 
     public function getUser($username)
     {
-        $stmt = $this->db->prepare($sql = sprintf('SELECT * from %s where username=:username', $this->config['user_table_name']));
+        $stmt = $this->db->prepare($sql = sprintf('SELECT * from %s where username=:username', $this->config['user_table']));
         $stmt->execute(array('username' => $username));
         return $stmt->fetch();
     }
@@ -151,10 +188,10 @@ class OAuth2_Storage_Pdo implements OAuth2_Storage_AuthorizationCodeInterface,
     {
         // if it exists, update it.
         if ($this->getUser($username)) {
-            $stmt = $this->db->prepare($sql = sprintf('UPDATE %s SET username=:username, password=:password, first_name=:firstName, last_name=:lastName where username=:username', $this->config['user_table_name']));
+            $stmt = $this->db->prepare($sql = sprintf('UPDATE %s SET username=:username, password=:password, first_name=:firstName, last_name=:lastName where username=:username', $this->config['user_table']));
         } else {
-            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (username, password, first_name, last_name) VALUES (:username, :password, :firstName, :lastName)', $this->config['user_table_name']));
+            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (username, password, first_name, last_name) VALUES (:username, :password, :firstName, :lastName)', $this->config['user_table']));
         }
         return $stmt->execute(compact('username', 'password', 'firstName', 'lastName'));
     }
-}
\ No newline at end of file
+}

diff --git a/src/OAuth2/Storage/UserCredentialsInterface.php b/src/OAuth2/Storage/UserCredentialsInterface.php
index 8ecf866..9fff562 100644
--- a/src/OAuth2/Storage/UserCredentialsInterface.php
+++ b/src/OAuth2/Storage/UserCredentialsInterface.php
@@ -3,13 +3,13 @@
 /**
  * Storage engines that support the "Resource Owner Password Credentials"
  * grant type should implement this interface
- * 
+ *
  * @author Dave Rochwerger <catch.dave@gmail.com>
  * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-20#section-4.3
  */
 interface OAuth2_Storage_UserCredentialsInterface
 {
-    
+
     /**
      * Grant access tokens for basic user credentials.
      *
@@ -42,4 +42,12 @@ interface OAuth2_Storage_UserCredentialsInterface
      * @ingroup oauth2_section_4
      */
     public function checkUserCredentials($username, $password);
+
+    /**
+     * @return
+     * ARRAY the associated "scope" or "user_id" values if applicable, or an empty array
+     * if this does not apply
+     *
+     */
+    public function getUserDetails($username);
 }
\ No newline at end of file
diff --git a/src/OAuth2/TokenType/Bearer.php b/src/OAuth2/TokenType/Bearer.php
index bcccd08..08492a4 100644
--- a/src/OAuth2/TokenType/Bearer.php
+++ b/src/OAuth2/TokenType/Bearer.php
@@ -42,14 +42,10 @@ class OAuth2_TokenType_Bearer implements OAuth2_TokenTypeInterface, OAuth2_Respo
      * Old Android version bug (at least with version 2.2)
      * @see http://code.google.com/p/android/issues/detail?id=6684
      *
-     * We don't want to test this functionality as it relies on superglobals and headers:
-     * @codeCoverageIgnoreStart
      */
-    public function getAccessTokenParameter(OAuth2_Request $request)
+    public function getAccessTokenParameter(OAuth2_RequestInterface $request)
     {
-        if (isset($request->server['AUTHORIZATION'])) {
-            $headers = $request->server['AUTHORIZATION'];
-        }
+        $headers = $request->server('AUTHORIZATION');
 
         // Check that exactly one method was used
         $methodsUsed = !empty($headers) + !is_null($request->query($this->config['token_param_name'])) + !is_null($request->request($this->config['token_param_name']));
diff --git a/src/OAuth2/TokenType/MAC.php b/src/OAuth2/TokenType/MAC.php
index c809a3b..6d47932 100644
--- a/src/OAuth2/TokenType/MAC.php
+++ b/src/OAuth2/TokenType/MAC.php
@@ -10,7 +10,7 @@ class OAuth2_TokenType_MAC implements OAuth2_TokenTypeInterface
         return 'mac';
     }
 
-    public function getAccessTokenParameter(OAuth2_Request $request)
+    public function getAccessTokenParameter(OAuth2_RequestInterface $request)
     {
         throw new LogicException("Not supported");
 
diff --git a/src/OAuth2/TokenTypeInterface.php b/src/OAuth2/TokenTypeInterface.php
index ab8ac9f..27ca292 100644
--- a/src/OAuth2/TokenTypeInterface.php
+++ b/src/OAuth2/TokenTypeInterface.php
@@ -3,5 +3,5 @@
 interface OAuth2_TokenTypeInterface
 {
     public function getTokenType();
-    public function getAccessTokenParameter(OAuth2_Request $request);
+    public function getAccessTokenParameter(OAuth2_RequestInterface $request);
 }
\ No newline at end of file