merges develop into trunk for v0.8 tagv0.8

17 files changed, 722 insertions, 199 deletions

diff --git a/test/OAuth2/Server/Authorize/BasicValidationTest.php b/test/OAuth2/Controller/Authorize/BasicValidationTest.php
index efbd95e..ce6a93a 100644
--- a/test/OAuth2/Server/Authorize/BasicValidationTest.php
+++ b/test/OAuth2/Controller/Authorize/BasicValidationTest.php
@@ -1,12 +1,12 @@
 <?php
 
-class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_TestCase
+class OAuth2_Controller_Authorize_BasicValidationTest extends PHPUnit_Framework_TestCase
 {
     public function testNoClientIdResponse()
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
@@ -18,7 +18,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->query['client_id'] = 'Fake Client ID'; // invalid client id
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
@@ -30,7 +30,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->query['client_id'] = 'Test Client ID'; // valid client id
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_uri');
@@ -43,7 +43,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $request = OAuth2_Request::createFromGlobals();
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -61,7 +61,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'invalid'; // invalid response type
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -79,7 +79,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com#fragment'; // valid redirect URI
         $request->query['response_type'] = 'code'; // invalid response type
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_uri');
@@ -93,7 +93,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'code';
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -114,7 +114,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'code';
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $parts = parse_url($response->getHttpHeader('Location'));
@@ -124,7 +124,7 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $this->assertEquals($query['error_description'], 'This application requires you specify a scope parameter');
 
         $request->query['scope'] = 'testscope';
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $parts = parse_url($response->getHttpHeader('Location'));
@@ -134,14 +134,14 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $this->assertFalse(isset($query['error']));
     }
 
-    public function testValidateRedirectUri()
+    public function testInvalidRedirectUri()
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->query['client_id'] = 'Test Client ID with Redirect Uri'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // invalid redirect URI
         $request->query['response_type'] = 'code';
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 400);
 
@@ -149,6 +149,24 @@ class OAuth2_Server_Authorize_BasicValidationTest extends PHPUnit_Framework_Test
         $this->assertEquals($response->getParameter('error_description'), 'The redirect URI provided is missing or does not match');
     }
 
+    public function testMultipleRedirectUris()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request::createFromGlobals();
+        $request->query['client_id'] = 'Test Client ID with Multiple Redirect Uris'; // valid client id
+        $request->query['redirect_uri'] = 'http://brentertainment.com'; // valid redirect URI
+        $request->query['response_type'] = 'code';
+
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
+        $this->assertEquals($response->getStatusCode(), 302);
+
+        // call again with different (but still valid) redirect URI
+        $request->query['redirect_uri'] = 'http://morehazards.com';
+
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
+        $this->assertEquals($response->getStatusCode(), 302);
+    }
+
     private function getTestServer($config = array())
     {
         $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
diff --git a/test/OAuth2/Server/Authorize/CodeTest.php b/test/OAuth2/Controller/Authorize/CodeTest.php
index c099298..3647c74 100644
--- a/test/OAuth2/Server/Authorize/CodeTest.php
+++ b/test/OAuth2/Controller/Authorize/CodeTest.php
@@ -1,6 +1,6 @@
 <?php
 
-class OAuth2_Server_Authorize_CodeTest extends PHPUnit_Framework_TestCase
+class OAuth2_Controller_Authorize_CodeTest extends PHPUnit_Framework_TestCase
 {
     public function testUserDeniesAccessResponse()
     {
@@ -9,7 +9,7 @@ class OAuth2_Server_Authorize_CodeTest extends PHPUnit_Framework_TestCase
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'code';
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -27,7 +27,7 @@ class OAuth2_Server_Authorize_CodeTest extends PHPUnit_Framework_TestCase
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'code';
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -60,7 +60,7 @@ class OAuth2_Server_Authorize_CodeTest extends PHPUnit_Framework_TestCase
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'code';
         $request->query['state'] = 'test'; // valid state string (just needs to be passed back to us)
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
 
@@ -86,7 +86,7 @@ class OAuth2_Server_Authorize_CodeTest extends PHPUnit_Framework_TestCase
         $request->query['response_type'] = 'code';
         $request->query['state'] = 'test'; // valid state string (just needs to be passed back to us)
         $request->query['fake'] = 'something'; // extra query param
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $this->assertNull($response->getParameter('error'));
diff --git a/test/OAuth2/Server/Authorize/ImplicitTest.php b/test/OAuth2/Controller/Authorize/ImplicitTest.php
index 30dcb39..b1ea03b 100644
--- a/test/OAuth2/Server/Authorize/ImplicitTest.php
+++ b/test/OAuth2/Controller/Authorize/ImplicitTest.php
@@ -1,6 +1,6 @@
 <?php
 
-class OAuth2_Server_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
+class OAuth2_Controller_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
 {
     public function testImplicitNotAllowedResponse()
     {
@@ -9,7 +9,7 @@ class OAuth2_Server_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'token'; // invalid response type
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -27,7 +27,7 @@ class OAuth2_Server_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'token'; // valid response type
-        $response = $server->handleAuthorizeRequest($request, false);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), false);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $location = $response->getHttpHeader('Location');
@@ -45,7 +45,7 @@ class OAuth2_Server_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
         $request->query['client_id'] = 'Test Client ID'; // valid client id
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'token'; // valid response type
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $this->assertNull($response->getParameter('error'));
@@ -75,7 +75,7 @@ class OAuth2_Server_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
         $request->query['redirect_uri'] = 'http://adobe.com'; // valid redirect URI
         $request->query['response_type'] = 'token'; // valid response type
         $request->query['state'] = 'test'; // valid state string (just needs to be passed back to us)
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $this->assertNull($response->getParameter('error'));
@@ -99,7 +99,7 @@ class OAuth2_Server_Authorize_ImplicitTest extends PHPUnit_Framework_TestCase
         $request->query['response_type'] = 'token'; // valid response type
         $request->query['state'] = 'test'; // valid state string (just needs to be passed back to us)
         $request->query['fake'] = 'something'; // add extra param to querystring
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         $this->assertEquals($response->getStatusCode(), 302);
         $this->assertNull($response->getParameter('error'));
diff --git a/test/OAuth2/Server/Access/BasicValidationTest.php b/test/OAuth2/Controller/Resource/BasicValidationTest.php
index b20045f..faae4bb 100644
--- a/test/OAuth2/Server/Access/BasicValidationTest.php
+++ b/test/OAuth2/Controller/Resource/BasicValidationTest.php
@@ -1,15 +1,14 @@
 <?php
 
-class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCase
+class OAuth2_Controller_Resource_BasicValidationTest extends PHPUnit_Framework_TestCase
 {
     public function testNoAccessToken()
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
         $this->assertEquals($response->getParameter('error_description'), 'The access token was not found');
@@ -20,10 +19,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'tH1s i5 B0gU5';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
         $this->assertEquals($response->getParameter('error_description'), 'Malformed auth header');
@@ -35,10 +33,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $request = OAuth2_Request::createFromGlobals();
         $request->request['access_token'] = 'TEST';
         $request->query['access_token'] = 'TEST';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
         $this->assertEquals($response->getParameter('error_description'), 'Only one method may be used to authenticate at a time (Auth header, GET or POST)');
@@ -50,10 +47,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $request = OAuth2_Request::createFromGlobals();
         $request->server['REQUEST_METHOD'] = 'GET';
         $request->request['access_token'] = 'TEST';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
         $this->assertEquals($response->getParameter('error_description'), 'When putting the token in the body, the method must be POST');
@@ -66,10 +62,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $request->server['REQUEST_METHOD'] = 'POST';
         $request->server['CONTENT_TYPE'] = 'application/json';
         $request->request['access_token'] = 'TEST';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
         $this->assertEquals($response->getParameter('error_description'), 'The content type for POST requests must be "application/x-www-form-urlencoded"');
@@ -80,10 +75,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'Bearer TESTTOKEN';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 401);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
         $this->assertEquals($response->getParameter('error_description'), 'The access token provided is invalid');
@@ -94,10 +88,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'Bearer accesstoken-expired';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 401);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
         $this->assertEquals($response->getParameter('error_description'), 'The access token provided has expired');
@@ -109,10 +102,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'Bearer accesstoken-scope';
         $scope = 'outofscope';
-        $allow = $server->verifyResourceRequest($request, $scope);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response(), $scope);
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 401);
         $this->assertEquals($response->getParameter('error'), 'insufficient_scope');
         $this->assertEquals($response->getParameter('error_description'), 'The request requires higher privileges than provided by the access token');
@@ -123,10 +115,9 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'Bearer accesstoken-malformed';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertFalse($allow);
 
-        $response = $server->getResponse();
         $this->assertEquals($response->getStatusCode(), 401);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
         $this->assertEquals($response->getParameter('error_description'), 'Malformed token (missing "expires" or "client_id")');
@@ -137,7 +128,7 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $server = $this->getTestServer();
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'Bearer accesstoken-scope';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertTrue($allow);
     }
 
@@ -147,7 +138,7 @@ class OAuth2_Server_Access_BasicValidationTest extends PHPUnit_Framework_TestCas
         $request = OAuth2_Request::createFromGlobals();
         $request->headers['AUTHORIZATION'] = 'Bearer accesstoken-scope';
         $request->query['scope'] = 'testscope';
-        $allow = $server->verifyResourceRequest($request);
+        $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         $this->assertTrue($allow);
     }
 
diff --git a/test/OAuth2/Server/Grant/BasicValidationTest.php b/test/OAuth2/Controller/Token/BasicValidationTest.php
index d6defba..d8a256b 100644
--- a/test/OAuth2/Server/Grant/BasicValidationTest.php
+++ b/test/OAuth2/Controller/Token/BasicValidationTest.php
@@ -1,12 +1,12 @@
 <?php
 
-class OAuth2_Server_Grant_BasicValidationTest extends PHPUnit_Framework_TestCase
+class OAuth2_Controller_Token_BasicValidationTest extends PHPUnit_Framework_TestCase
 {
     public function testNoGrantType()
     {
         // add the test parameters in memory
         $server = $this->getTestServer();
-        $response = $server->handleTokenRequest(OAuth2_Request_TestRequest::createPost());
+        $server->handleTokenRequest(OAuth2_Request_TestRequest::createPost(), $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -20,7 +20,7 @@ class OAuth2_Server_Grant_BasicValidationTest extends PHPUnit_Framework_TestCase
         $request = OAuth2_Request_TestRequest::createPost(array(
             'grant_type' => 'invalid_grant_type', // invalid grant type
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'unsupported_grant_type');
@@ -33,8 +33,9 @@ class OAuth2_Server_Grant_BasicValidationTest extends PHPUnit_Framework_TestCase
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
             'grant_type' => 'authorization_code', // valid grant type
+            'code'       => 'testcode',
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
@@ -47,33 +48,44 @@ class OAuth2_Server_Grant_BasicValidationTest extends PHPUnit_Framework_TestCase
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
             'grant_type' => 'authorization_code', // valid grant type
+            'code'       => 'testcode',
             'client_id' => 'Test Client ID', // valid client id
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
         $this->assertEquals($response->getParameter('error_description'), 'Client credentials were not found in the headers or body');
     }
 
-    public function testInvalidClientCredentials()
+    public function testInvalidClientId()
     {
         // add the test parameters in memory
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
             'grant_type' => 'authorization_code', // valid grant type
-            'client_id' => 'Fake Client ID', // invalid client id
-            'client_secret' => 'Fake Client Secret', // invalid client secret
+            'code'       => 'testcode',
+            'client_id'  => 'Fake Client ID', // invalid client id
+            'client_secret' => 'TestSecret', // valid client secret
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
         $this->assertEquals($response->getParameter('error_description'), 'The client credentials are invalid');
+    }
 
-        // try again with a real client ID, but an invalid secret
-        $request->request['client_id'] = 'Test Client ID'; // valid client id
-        $response = $server->handleTokenRequest($request);
+    public function testInvalidClientSecret()
+    {
+        // add the test parameters in memory
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'authorization_code', // valid grant type
+            'code'       => 'testcode',
+            'client_id'  => 'Test Client ID', // valid client id
+            'client_secret' => 'Fake Client Secret', // invalid client secret
+        ));
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
@@ -90,7 +102,7 @@ class OAuth2_Server_Grant_BasicValidationTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret', // valid client secret
             'code' => 'testcode', // valid authorization code
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertTrue($response instanceof OAuth2_Response);
         $this->assertEquals($response->getStatusCode(), 200);
@@ -101,6 +113,43 @@ class OAuth2_Server_Grant_BasicValidationTest extends PHPUnit_Framework_TestCase
         $this->assertNotNUll($response->getParameter('token_type'));
     }
 
+    public function testValidClientIdScope()
+    {
+        // add the test parameters in memory
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+                'grant_type' => 'authorization_code', // valid grant type
+                'code'       => 'testcode',
+                'client_id' => 'Test Client ID', // valid client id
+                'client_secret' => 'TestSecret', // valid client secret
+                'scope' => 'clientscope1 clientscope2 scope1 scope2 scope3'
+        ));
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 200);
+        $this->assertNull($response->getParameter('error'));
+        $this->assertNull($response->getParameter('error_description'));
+        $this->assertEquals('clientscope1 clientscope2 scope1 scope2 scope3', $response->getParameter('scope'));
+    }
+
+    public function testInvalidClientIdScope()
+    {
+        // add the test parameters in memory
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+                'grant_type' => 'authorization_code', // valid grant type
+                'code'       => 'testcode',
+                'client_id' => 'Test Client ID', // valid client id
+                'client_secret' => 'TestSecret', // valid client secret
+                'scope' => 'clientscope3 scope1'
+        ));
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
     private function getTestServer()
     {
         $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
diff --git a/test/OAuth2/GrantType/AuthorizationCodeTest.php b/test/OAuth2/GrantType/AuthorizationCodeTest.php
index f853c23..5bd5831 100644
--- a/test/OAuth2/GrantType/AuthorizationCodeTest.php
+++ b/test/OAuth2/GrantType/AuthorizationCodeTest.php
@@ -10,7 +10,7 @@ class OAuth2_GrantType_AuthorizationCodeTest extends PHPUnit_Framework_TestCase
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -21,12 +21,12 @@ class OAuth2_GrantType_AuthorizationCodeTest extends PHPUnit_Framework_TestCase
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
-            'grant_type' => 'authorization_code', // valid grant type
-            'client_id' => 'Test Client ID', // valid client id
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
-            'code' => 'InvalidCode', // invalid authorization code
+            'code'          => 'InvalidCode', // invalid authorization code
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -37,27 +37,161 @@ class OAuth2_GrantType_AuthorizationCodeTest extends PHPUnit_Framework_TestCase
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
-            'grant_type' => 'authorization_code', // valid grant type
-            'client_id' => 'Test Client ID', // valid client id
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
-            'code' => 'testcode', // valid code
+            'code'          => 'testcode', // valid code
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 200);
         $this->assertNotNull($response->getParameter('access_token'));
 
         // try to use the same code again
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
         $this->assertEquals($response->getParameter('error_description'), 'Authorization code doesn\'t exist or is invalid for the client');
     }
 
+    public function testExpiredCode()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode-expired', // expired authorization code
+        ));
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_grant');
+        $this->assertEquals($response->getParameter('error_description'), 'The authorization code has expired');
+    }
+
+    public function testValidCode()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode', // valid code
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+    }
+
+    public function testValidCodeNoScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode-with-scope', // valid code
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope1 scope2');
+    }
+
+    public function testValidCodeSameScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode-with-scope', // valid code
+            'scope'         => 'scope2 scope1',
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope2 scope1');
+    }
+
+    public function testValidCodeLessScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode-with-scope', // valid code
+            'scope'         => 'scope1',
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope1');
+    }
+
+    public function testValidCodeDifferentScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode-with-scope', // valid code
+            'scope'         => 'scope3',
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
+    public function testValidCodeInvalidScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'code'          => 'testcode-with-scope', // valid code
+            'scope'         => 'invalid-scope',
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
+    public function testValidClientDifferentCode()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'authorization_code', // valid grant type
+            'client_id'     => 'Test Some Other Client', // valid client id
+            'client_secret' => 'TestSecret3', // valid client secret
+            'code'          => 'testcode', // valid code
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_grant');
+        $this->assertEquals($response->getParameter('error_description'), 'authorization_code doesn\'t exist or is invalid for the client');
+    }
+
     private function getTestServer()
     {
-        $storage = new OAuth2_Storage_Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../config/storage.json'), true));
+        $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
         $server = new OAuth2_Server($storage);
         $server->addGrantType(new OAuth2_GrantType_AuthorizationCode($storage));
 
diff --git a/test/OAuth2/GrantType/ClientCredentialsTest.php b/test/OAuth2/GrantType/ClientCredentialsTest.php
index b184e2d..0fcbe18 100644
--- a/test/OAuth2/GrantType/ClientCredentialsTest.php
+++ b/test/OAuth2/GrantType/ClientCredentialsTest.php
@@ -10,43 +10,59 @@ class OAuth2_GrantType_ClientCredentialsTest extends PHPUnit_Framework_TestCase
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'FakeSecret', // valid client secret
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_client');
         $this->assertEquals($response->getParameter('error_description'), 'The client credentials are invalid');
     }
 
-    public function testValidCredentialsWithScope()
+    public function testValidCredentials()
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
             'grant_type' => 'client_credentials', // valid grant type
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
-            'scope' => 'scope',
         ));
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
 
         $this->assertNotNull($token);
-        $this->assertArrayHasKey('access_token', $token);
         $this->assertArrayHasKey('scope', $token);
-        $this->assertEquals($token['scope'], 'scope');
+        $this->assertNull($token['scope']);
     }
 
-    public function testValidCredentialsNoScope()
+    public function testValidCredentialsWithScope()
     {
         $server = $this->getTestServer();
         $request = OAuth2_Request_TestRequest::createPost(array(
             'grant_type' => 'client_credentials', // valid grant type
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
+            'scope' => 'scope1',
         ));
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
 
         $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
         $this->assertArrayHasKey('scope', $token);
-        $this->assertNull($token['scope']);
+        $this->assertEquals($token['scope'], 'scope1');
+    }
+
+    public function testValidCredentialsInvalidScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'client_credentials', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'scope' => 'invalid-scope',
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
     }
 
     public function testValidCredentialsInHeader()
@@ -56,7 +72,7 @@ class OAuth2_GrantType_ClientCredentialsTest extends PHPUnit_Framework_TestCase
         $headers = array('HTTP_AUTHORIZATION' => 'Basic '.base64_encode('Test Client ID:TestSecret'), 'REQUEST_METHOD' => 'POST');
         $params  = array('grant_type' => 'client_credentials');
         $request = new OAuth2_Request(array(), $params, array(), array(), array(), $headers);
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
 
         $this->assertNotNull($token);
         $this->assertArrayHasKey('access_token', $token);
@@ -66,7 +82,7 @@ class OAuth2_GrantType_ClientCredentialsTest extends PHPUnit_Framework_TestCase
         $headers = array('PHP_AUTH_USER' => 'Test Client ID', 'PHP_AUTH_PW' => 'TestSecret', 'REQUEST_METHOD' => 'POST');
         $params  = array('grant_type' => 'client_credentials');
         $request = new OAuth2_Request(array(), $params, array(), array(), array(), $headers);
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
 
         $this->assertNotNull($token);
         $this->assertArrayHasKey('access_token', $token);
@@ -81,7 +97,7 @@ class OAuth2_GrantType_ClientCredentialsTest extends PHPUnit_Framework_TestCase
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
         ));
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
 
         $this->assertNotNull($token);
         $this->assertArrayHasKey('access_token', $token);
@@ -96,7 +112,7 @@ class OAuth2_GrantType_ClientCredentialsTest extends PHPUnit_Framework_TestCase
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
         ));
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
 
         $this->assertNotNull($token);
         $this->assertArrayHasKey('access_token', $token);
@@ -105,7 +121,7 @@ class OAuth2_GrantType_ClientCredentialsTest extends PHPUnit_Framework_TestCase
 
     private function getTestServer()
     {
-        $storage = new OAuth2_Storage_Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../config/storage.json'), true));
+        $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
         $server = new OAuth2_Server($storage);
         $server->addGrantType(new OAuth2_GrantType_ClientCredentials($storage));
 
diff --git a/test/OAuth2/GrantType/JWTBearerTest.php b/test/OAuth2/GrantType/JWTBearerTest.php
index 4d13145..a50b229 100644
--- a/test/OAuth2/GrantType/JWTBearerTest.php
+++ b/test/OAuth2/GrantType/JWTBearerTest.php
@@ -2,6 +2,29 @@
 
 class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
 {
+    private $privateKey;
+
+    public function setUp()
+    {
+        $this->privateKey = <<<EOD
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQC5/SxVlE8gnpFqCxgl2wjhzY7ucEi00s0kUg3xp7lVEvgLgYcA
+nHiWp+gtSjOFfH2zsvpiWm6Lz5f743j/FEzHIO1owR0p4d9pOaJK07d01+RzoQLO
+IQAgXrr4T1CCWUesncwwPBVCyy2Mw3Nmhmr9MrF8UlvdRKBxriRnlP3qJQIDAQAB
+AoGAVgJJVU4fhYMu1e5JfYAcTGfF+Gf+h3iQm4JCpoUcxMXf5VpB9ztk3K7LRN5y
+kwFuFALpnUAarRcUPs0D8FoP4qBluKksbAtgHkO7bMSH9emN+mH4le4qpFlR7+P1
+3fLE2Y19IBwPwEfClC+TpJvuog6xqUYGPlg6XLq/MxQUB4ECQQDgovP1v+ONSeGS
+R+NgJTR47noTkQT3M2izlce/OG7a+O0yw6BOZjNXqH2wx3DshqMcPUFrTjibIClP
+l/tEQ3ShAkEA0/TdBYDtXpNNjqg0R9GVH2pw7Kh68ne6mZTuj0kCgFYpUF6L6iMm
+zXamIJ51rTDsTyKTAZ1JuAhAsK/M2BbDBQJAKQ5fXEkIA+i+64dsDUR/hKLBeRYG
+PFAPENONQGvGBwt7/s02XV3cgGbxIgAxqWkqIp0neb9AJUoJgtyaNe3GQQJANoL4
+QQ0af0NVJAZgg8QEHTNL3aGrFSbzx8IE5Lb7PLRsJa5bP5lQxnDoYuU+EI/Phr62
+niisp/b/ZDGidkTMXQJBALeRsH1I+LmICAvWXpLKa9Gv0zGCwkuIJLiUbV9c6CVh
+suocCAteQwL5iW2gA4AnYr5OGeHFsEl7NCQcwfPZpJ0=
+-----END RSA PRIVATE KEY-----
+EOD;
+    }
+
     public function testMalformedJWT()
     {
         $server = $this->getTestServer();
@@ -15,8 +38,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
 
         $request->request['assertion'] = $jwt;
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -34,8 +56,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
         $jwt = $this->getJWT() . 'notSupposeToBeHere';
         $request->request['assertion'] = $jwt;
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -53,8 +74,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
         $jwt = $this->getJWT(1234);
         $request->request['assertion'] = $jwt;
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -72,8 +92,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
         $jwt = $this->getJWT('badtimestamp');
         $request->request['assertion'] = $jwt;
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -89,8 +108,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
 
         //Do not pass the assert (JWT)
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -108,8 +126,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
         $jwt = $this->getJWT(null, time() + 10000);
         $request->request['assertion'] = $jwt;
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -127,8 +144,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
         $jwt = $this->getJWT(null, 'notatimestamp');
         $request->request['assertion'] = $jwt;
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -143,8 +159,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
             'assertion' => $this->getJWT(),
         ));
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -159,8 +174,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
             'assertion' => $this->getJWT(null, null, null, 'bad_client_id'),
         ));
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -175,8 +189,7 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
             'assertion' => $this->getJWT(null, null, 'anotheruser@ourdomain,com'),
         ));
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -191,14 +204,75 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
             'assertion' => $this->getJWT(null, null, null, 'Missing Key Cli,nt'),
         ));
 
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
         $this->assertEquals($response->getParameter('error_description'), 'Invalid issuer (iss) or subject (sub) provided');
     }
 
+    public function testValidJwt()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',  // valid grant type
+            'assertion' => $this->getJWT(), // valid assertion
+        ));
+
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+    }
+
+    public function testValidJwtWithScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',  // valid grant type
+            'assertion' => $this->getJWT(null, null, null, 'Test Client ID', 'scope1'), // valid assertion
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope1');
+    }
+
+    public function testValidJwtInvalidScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',  // valid grant type
+            'assertion' => $this->getJWT(null, null, null, 'Test Client ID', 'invalid-scope'), // valid assertion with invalid scope
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
+    public function testJwtUtil()
+    {
+        $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
+        $jwtUtil = new OAuth2_Encryption_JWT();
+        $client_id = 'Test Client ID';
+        $params = $this->getJWTParams(null, null, null, $client_id);
+
+
+        if (version_compare(PHP_VERSION, '5.3.3') <= 0) {
+            $encoded = $jwtUtil->encode($params, 'mysecretkey', 'HS256');
+            $client_id .= ' PHP-5.2';
+        } else {
+            $encoded = $jwtUtil->encode($params, $this->privateKey, 'RS256');
+        }
+
+        $payload = $jwtUtil->decode($encoded, $storage->getClientKey($client_id, "testuser@ourdomain.com"));
+
+        $this->assertEquals($params, $payload);
+    }
+
     /**
      * Generates a JWT
      * @param $exp The expiration date. If the current time is greater than the exp, the JWT is invalid.
@@ -207,83 +281,55 @@ class OAuth2_GrantType_JWTBearerTest extends PHPUnit_Framework_TestCase
      * @param $iss The issuer, usually the client_id.
      * @return string
      */
-    private function getJWT($exp = null, $nbf = null, $sub = null, $iss = 'Test Client ID')
+    private function getJWTParams($exp = null, $nbf = null, $sub = null, $iss = 'Test Client ID', $scope = null)
     {
-        $privateKey = <<<EOD
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC/yMgbkPnOnrXt
-rcbxZVtTUXdYedy28V6Td04F2h6Meh+XAQrpifoxTTF5c3QgcHq9+3ZcQH/tBnSA
-NY+aXa37mo0e325I0v9cR40g/fbZLV0qp+4vVboWYfSlppiDYritM6JAaLEjzmQ0
-OXGgI7gXGUZwHSXNa0DGfHnKo0hJ2PoEcJYLxVDLHcMcZ4rJ9yh3y3hCQQnAfN4U
-dhQg8SJlWr2ziwofyDFOeuai7M0jburTAx7z93JmWn//Q14pLr4855csGKLq5gv8
-dajXopD++2ez6X1Y0W3g9owdwWyFmsHv7BUcD09zBmRDVRm+jD9PPlZc6j1k9sBN
-6rA9VhdTAgMBAAECggEARJi7QmjjgQzxg5bhjpwzQyTjbCkCUgkZS+Oja6JtxM81
-l1xPG+M3MwUqSgeKpMO2k1drKWoEl7H0X5tIxuz0+wZ3rXA7UR7vKYGKMB/GeD2q
-kkRIhHPEQJc+2zUwXeYkqgbK5QDNQ0JiQu+8/YtpIBHxSM6UI9pV6+i/40Pt6kNr
-/v1nGqu2KfwVEJ7O5moFdyLaR6QHFc9hxUxeAdcC6QOEoAp59+8UBkXFe5sK6VNO
-iRBgnAIrppopkDG2XTb2zA1dZFYnUmgeLtL9lDIBv2KOxUCI5KZe5wTaRQzLRVrG
-2DFvE4HrBIl3hAoy/wDhVPkw/mEfk9Y+8lKhdYC5gQKBgQDexfU1z03yV4DA5sxB
-8ZLEiJBkfPPNwhgY85/Thb4Xd4bDq7mPIkqWtIXSrWBKC9+uF3cN3Aq65rU/hZ8k
-n9CqZdkYfGyBburwhTfd/9n/LNXjDDsrmvBqBf2yxOReLKNU+Xp8/Opov/bMrwS5
-BBMCVSnkXqke6GJuUEd+fHI6wQKBgQDcY5ZWxFCn2u8+VTw7rA2465cxDjfVBWOP
-99lI+vzSjeoxqsfnD27yxiVlMlct09X2oF2Z8NRr1Ekb+SFzPoANfqj1B6Knsp0w
-3FivvCABCVPEXtLIdlfibsewtgTs3Kx2IvzS1XL1gN+awHiIut47deAAuZIZWqvm
-skESO+F7EwKBgELOzxjSEKgqwbwX+w2TqtYxtkvMhTkhiiSBe17t7vIOsGWh7EYW
-nJPRk4h44jWSlgQZmWSYpsciRRzFr9JF80gGvzJurgOrBd4XtYdoITI7efFbS6tq
-Dctd/JVOIsZzUJA9ORSerJW5bAQ6QIpTxHegnq2UDdftDQfUH3y5SXCBAoGAI+9h
-DhjIhfYe2G0RezFcs3BGoMsOs39DcrAZD9tM6hAVxa9xFO3hS1iftFZ2/JPz6VjQ
-qk8oc8STfyoqGB5yxsCGUB3Emc937gWfuFfWaBTbQcOsXt9dCSDDEr87IlwBCuo9
-iyseqYUv8I29mZ3OqqdXtQaNGfE84kribVSyOV0CgYAbsee2ZZ1ufzSC5olW9nQh
-5dGELbq4DhlpJg8etWc6GIn87ITOjx4xDSDh75YS8PHDZVjctCWUhgtBzvcYVlpQ
-xZwD+bNYZXcbzzExGIh+YIkfpvY5rqCNRgN84YRYB585949H+rYIXB04Pou5UVuK
-Fnh+zeEVijg18pMvVScrBw==
------END PRIVATE KEY-----
-EOD;
-
         //Since PHP 5.2 does not have OpenSSL support on Travis CI, we will test it using the HS256 algorithm
         //We also provided PHP 5.2 specific data for it in storage.json
-        $newPHP = true;
-
         if (version_compare(PHP_VERSION, '5.3.3') <= 0) {
+            // add "5.2" identifier onto the client name
             $iss .= ' PHP-5.2';
-            $newPHP = false;
-            $privateKey = 'mysecretkey';
         }
 
         if (!$exp) {
             $exp = time() + 1000;
         }
 
-        if(!$sub){
+        if (!$sub) {
             $sub = "testuser@ourdomain.com";
         }
 
         $params = array(
-                    'iss' => $iss,
-                    'exp' => $exp,
-                    'iat' => time(),
-                    'sub' => $sub,
-                    'aud' => 'http://myapp.com/oauth/auth',
-                    'scope' => 'view_friends_list'
-                );
+            'iss' => $iss,
+            'exp' => $exp,
+            'iat' => time(),
+            'sub' => $sub,
+            'aud' => 'http://myapp.com/oauth/auth',
+            'scope' => $scope,
+        );
 
         if ($nbf) {
             $params['nbf'] = $nbf;
         }
 
+        return $params;
+    }
+
+    private function getJWT($exp = null, $nbf = null, $sub = null, $iss = 'Test Client ID', $scope = null)
+    {
+        $params = $this->getJWTParams($exp, $nbf, $sub, $iss, $scope);
+
         $jwtUtil = new OAuth2_Encryption_JWT();
 
-        if ($newPHP){
-            return $jwtUtil->encode($params, $privateKey, 'RS256');
-        }else{
-            return $jwtUtil->encode($params, $privateKey, 'HS256');
+        if (version_compare(PHP_VERSION, '5.3.3') <= 0) {
+            return $jwtUtil->encode($params, 'mysecretkey', 'HS256');
         }
 
+        return $jwtUtil->encode($params, $this->privateKey, 'RS256');
     }
 
     private function getTestServer($audience = 'http://myapp.com/oauth/auth')
     {
-        $storage = new OAuth2_Storage_Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../config/storage.json'), true));
+        $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
         $server = new OAuth2_Server($storage);
         $server->addGrantType(new OAuth2_GrantType_JWTBearer($storage, $audience));
 
diff --git a/test/OAuth2/GrantType/RefreshTokenTest.php b/test/OAuth2/GrantType/RefreshTokenTest.php
index 56af171..e2c818c 100644
--- a/test/OAuth2/GrantType/RefreshTokenTest.php
+++ b/test/OAuth2/GrantType/RefreshTokenTest.php
@@ -14,8 +14,7 @@ class OAuth2_GrantType_RefreshTokenTest extends PHPUnit_Framework_TestCase
             'client_id'  => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret',  // valid client secret
         ));
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -33,8 +32,7 @@ class OAuth2_GrantType_RefreshTokenTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret', // valid client secret
             'refresh_token' => 'fake-token', // invalid refresh token
         ));
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -52,7 +50,7 @@ class OAuth2_GrantType_RefreshTokenTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret', // valid client secret
             'refresh_token' => 'test-refreshtoken', // valid refresh token
         ));
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
         $this->assertTrue(isset($token['refresh_token']), 'refresh token should always refresh');
 
         $refresh_token = $this->storage->getRefreshToken($token['refresh_token']);
@@ -75,16 +73,102 @@ class OAuth2_GrantType_RefreshTokenTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret', // valid client secret
             'refresh_token' => 'test-refreshtoken', // valid refresh token
         ));
-        $token = $server->grantAccessToken($request);
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
         $this->assertFalse(isset($token['refresh_token']), 'refresh token should not be returned');
 
         $used_token = $this->storage->getRefreshToken('test-refreshtoken');
         $this->assertNotNull($used_token, 'the refresh token used is still valid');
     }
 
+    public function testValidRefreshTokenSameScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'refresh_token', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'refresh_token' => 'test-refreshtoken-with-scope', // valid refresh token (with scope)
+            'scope'         => 'scope2 scope1',
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope2 scope1');
+    }
+
+    public function testValidRefreshTokenLessScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'refresh_token', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'refresh_token' => 'test-refreshtoken-with-scope', // valid refresh token (with scope)
+            'scope'         => 'scope1',
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope1');
+    }
+
+    public function testValidRefreshTokenDifferentScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'refresh_token', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'refresh_token' => 'test-refreshtoken-with-scope', // valid refresh token (with scope)
+            'scope'         => 'scope3',
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
+    public function testValidRefreshTokenInvalidScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'refresh_token', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'refresh_token' => 'test-refreshtoken-with-scope', // valid refresh token (with scope)
+            'scope'         => 'invalid-scope',
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
+    public function testValidClientDifferentRefreshToken()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type'    => 'refresh_token', // valid grant type
+            'client_id'     => 'Test Some Other Client', // valid client id
+            'client_secret' => 'TestSecret3', // valid client secret
+            'refresh_token' => 'test-refreshtoken', // valid refresh token
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_grant');
+        $this->assertEquals($response->getParameter('error_description'), 'refresh_token doesn\'t exist or is invalid for the client');
+    }
+
     private function getTestServer()
     {
-        $this->storage = new OAuth2_Storage_Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../config/storage.json'), true));
+        $this->storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
         $server = new OAuth2_Server($this->storage);
 
         return $server;
diff --git a/test/OAuth2/GrantType/UserCredentialsTest.php b/test/OAuth2/GrantType/UserCredentialsTest.php
index 74ad222..ac3234d 100644
--- a/test/OAuth2/GrantType/UserCredentialsTest.php
+++ b/test/OAuth2/GrantType/UserCredentialsTest.php
@@ -11,8 +11,7 @@ class OAuth2_GrantType_UserCredentialsTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret', // valid client secret
             'password' => 'testpass', // valid password
         ));
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -28,8 +27,7 @@ class OAuth2_GrantType_UserCredentialsTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret', // valid client secret
             'username' => 'test-username', // valid username
         ));
-        $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_request');
@@ -46,8 +44,7 @@ class OAuth2_GrantType_UserCredentialsTest extends PHPUnit_Framework_TestCase
             'username' => 'fake-username', // valid username
             'password' => 'testpass', // valid password
         ));
-        $ret = $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
@@ -62,19 +59,71 @@ class OAuth2_GrantType_UserCredentialsTest extends PHPUnit_Framework_TestCase
             'client_id' => 'Test Client ID', // valid client id
             'client_secret' => 'TestSecret', // valid client secret
             'username' => 'test-username', // valid username
-            'password' => 'fakepass', // valid password
+            'password' => 'fakepass', // invalid password
         ));
-        $ret = $server->grantAccessToken($request);
-        $response = $server->getResponse();
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
 
         $this->assertEquals($response->getStatusCode(), 400);
         $this->assertEquals($response->getParameter('error'), 'invalid_grant');
         $this->assertEquals($response->getParameter('error_description'), 'Invalid username and password combination');
     }
 
+    public function testValidCredentials()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'password', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'username' => 'test-username', // valid username
+            'password' => 'testpass', // valid password
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+    }
+
+    public function testValidCredentialsWithScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'password', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'username' => 'test-username', // valid username
+            'password' => 'testpass', // valid password
+            'scope'    => 'scope1', // valid scope
+        ));
+        $token = $server->grantAccessToken($request, new OAuth2_Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('scope', $token);
+        $this->assertEquals($token['scope'], 'scope1');
+    }
+
+    public function testValidCredentialsInvalidScope()
+    {
+        $server = $this->getTestServer();
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'password', // valid grant type
+            'client_id' => 'Test Client ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+            'username' => 'test-username', // valid username
+            'password' => 'testpass', // valid password
+            'scope'         => 'invalid-scope',
+        ));
+        $token = $server->grantAccessToken($request, $response = new OAuth2_Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_scope');
+        $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested.');
+    }
+
     private function getTestServer()
     {
-        $storage = new OAuth2_Storage_Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../config/storage.json'), true));
+        $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
         $server = new OAuth2_Server($storage);
         $server->addGrantType(new OAuth2_GrantType_UserCredentials($storage));
 
diff --git a/test/OAuth2/RequestTest.php b/test/OAuth2/RequestTest.php
index 36c510e..3d8319a 100644
--- a/test/OAuth2/RequestTest.php
+++ b/test/OAuth2/RequestTest.php
@@ -8,11 +8,11 @@ class OAuth2_RequestTest extends PHPUnit_Framework_TestCase
         $server = $this->getTestServer();
 
         // Smoke test for override request class
-        // $response = $server->handleTokenRequest($request);
+        // $server->handleTokenRequest($request, $response = new OAuth2_Response());
         // $this->assertInstanceOf('OAuth2_Response', $response);
-        // $response = $server->handleAuthorizeRequest($request, true);
+        // $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
         // $this->assertInstanceOf('OAuth2_Response', $response);
-        // $response = $server->verifyResourceRequest($request);
+        // $response = $server->verifyResourceRequest($request, $response = new OAuth2_Response());
         // $this->assertTrue(is_bool($response));
 
         /*** make some valid requests ***/
@@ -24,7 +24,7 @@ class OAuth2_RequestTest extends PHPUnit_Framework_TestCase
             'client_secret' => 'TestSecret',
             'code' => 'testcode',
         ));
-        $response = $server->handleTokenRequest($request);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
         $this->assertEquals($response->getStatusCode(), 200);
         $this->assertNull($response->getParameter('error'));
         $this->assertNotNUll($response->getParameter('access_token'));
diff --git a/test/OAuth2/Util/ScopeTest.php b/test/OAuth2/ScopeTest.php
index 36d0c68..36d0c68 100644
--- a/test/OAuth2/Util/ScopeTest.php
+++ b/test/OAuth2/ScopeTest.php
diff --git a/test/OAuth2/ServerTest.php b/test/OAuth2/ServerTest.php
index b83cf7e..7d8e35a 100644
--- a/test/OAuth2/ServerTest.php
+++ b/test/OAuth2/ServerTest.php
@@ -5,7 +5,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
     /**
      * @expectedException LogicException OAuth2_Storage_ClientInterface
      **/
-    public function testGetAuthorizeServerWithNoClientStorageThrowsException()
+    public function testGetAuthorizeControllerWithNoClientStorageThrowsException()
     {
         // must set Client Storage
         $server = new OAuth2_Server();
@@ -15,7 +15,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
     /**
      * @expectedException LogicException OAuth2_Storage_AccessTokenInterface
      **/
-    public function testGetAuthorizeServerWithNoAccessTokenStorageThrowsException()
+    public function testGetAuthorizeControllerWithNoAccessTokenStorageThrowsException()
     {
         // must set AccessToken or AuthorizationCode
         $server = new OAuth2_Server();
@@ -23,7 +23,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $server->getAuthorizeController();
     }
 
-    public function testGetAuthorizeServerWithClientStorageAndAccessTokenResponseType()
+    public function testGetAuthorizeControllerWithClientStorageAndAccessTokenResponseType()
     {
         // must set AccessToken or AuthorizationCode
         $server = new OAuth2_Server();
@@ -33,7 +33,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $this->assertNotNull($server->getAuthorizeController());
     }
 
-    public function testGetAuthorizeServerWithClientStorageAndAuthorizationCodeResponseType()
+    public function testGetAuthorizeControllerWithClientStorageAndAuthorizationCodeResponseType()
     {
         // must set AccessToken or AuthorizationCode
         $server = new OAuth2_Server();
@@ -43,7 +43,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $this->assertNotNull($server->getAuthorizeController());
     }
 
-    public function testGetAuthorizeServerWithClientStorageAndAccessTokenStorage()
+    public function testGetAuthorizeControllerWithClientStorageAndAccessTokenStorage()
     {
         // must set AccessToken or AuthorizationCode
         $server = new OAuth2_Server();
@@ -53,7 +53,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $this->assertNotNull($server->getAuthorizeController());
     }
 
-    public function testGetAuthorizeServerWithClientStorageAndAuthorizationCodeStorage()
+    public function testGetAuthorizeControllerWithClientStorageAndAuthorizationCodeStorage()
     {
         // must set AccessToken or AuthorizationCode
         $server = new OAuth2_Server();
@@ -64,25 +64,35 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
     }
 
     /**
+     * @expectedException LogicException grant_types
+     **/
+    public function testGetTokenControllerWithGrantTypeStorageThrowsException()
+    {
+        $server = new OAuth2_Server();
+        $server->getTokenController();
+    }
+
+    /**
      * @expectedException LogicException OAuth2_Storage_ClientCredentialsInterface
      **/
-    public function testGetGrantServerWithNoClientCredentialsStorageThrowsException()
+    public function testGetTokenControllerWithNoClientCredentialsStorageThrowsException()
     {
         $server = new OAuth2_Server();
+        $server->addStorage($this->getMock('OAuth2_Storage_UserCredentialsInterface'));
         $server->getTokenController();
     }
 
     /**
      * @expectedException LogicException OAuth2_Storage_AccessTokenInterface
      **/
-    public function testGetGrantServerWithNoAccessTokenStorageThrowsException()
+    public function testGetTokenControllerWithNoAccessTokenStorageThrowsException()
     {
         $server = new OAuth2_Server();
         $server->addStorage($this->getMock('OAuth2_Storage_ClientCredentialsInterface'));
         $server->getTokenController();
     }
 
-    public function testGetGrantServerWithAccessTokenAndClientCredentialsStorage()
+    public function testGetTokenControllerWithAccessTokenAndClientCredentialsStorage()
     {
         $server = new OAuth2_Server();
         $server->addStorage($this->getMock('OAuth2_Storage_AccessTokenInterface'));
@@ -90,7 +100,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $server->getTokenController();
     }
 
-    public function testGetGrantServerAccessTokenStorageAndClientCredentialsStorageAndGrantTypes()
+    public function testGetTokenControllerAccessTokenStorageAndClientCredentialsStorageAndGrantTypes()
     {
         $server = new OAuth2_Server();
         $server->addStorage($this->getMock('OAuth2_Storage_AccessTokenInterface'));
@@ -102,13 +112,13 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
     /**
      * @expectedException LogicException OAuth2_Storage_AccessTokenInterface
      **/
-    public function testGetAccessServerWithNoAccessTokenStorageThrowsException()
+    public function testGetResourceControllerWithNoAccessTokenStorageThrowsException()
     {
         $server = new OAuth2_Server();
         $server->getResourceController();
     }
 
-    public function testGetAccessServerWithAccessTokenStorage()
+    public function testGetResourceControllerWithAccessTokenStorage()
     {
         $server = new OAuth2_Server();
         $server->addStorage($this->getMock('OAuth2_Storage_AccessTokenInterface'));
@@ -121,7 +131,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
     public function testAddingStorageWithInvalidClass()
     {
         $server = new OAuth2_Server();
-        $server->addStorage($this->getMock('OAuth2_ScopeInterface'));
+        $server->addStorage(new StdClass());
     }
 
     /**
@@ -173,7 +183,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $storage
           ->expects($this->any())
           ->method('checkRestrictedGrantType')
-          ->will($this->returnValue(TRUE));
+          ->will($this->returnValue(true));
 
         // add with the "code" key explicitly set
         $codeType = new OAuth2_ResponseType_AuthorizationCode($storage);
@@ -181,7 +191,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $server->addStorage($storage);
         $server->addResponseType($codeType);
         $request = new OAuth2_Request(array('response_type' => 'code', 'client_id' => 'some_client', 'redirect_uri' => 'http://example.com'));
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         // the response is successful
         $this->assertEquals($response->getStatusCode(), 302);
@@ -194,7 +204,7 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $codeType = new OAuth2_ResponseType_AuthorizationCode($storage);
         $server = new OAuth2_Server(array($storage), array(), array(), array($codeType));
         $request = new OAuth2_Request(array('response_type' => 'code', 'client_id' => 'some_client', 'redirect_uri' => 'http://example.com'));
-        $response = $server->handleAuthorizeRequest($request, true);
+        $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
 
         // the response is successful
         $this->assertEquals($response->getStatusCode(), 302);
@@ -204,6 +214,30 @@ class OAuth2_ServerTest extends PHPUnit_Framework_TestCase
         $this->assertFalse(isset($query['error']));
     }
 
+    public function testCustomClientAssertionType()
+    {
+        $request = OAuth2_Request_TestRequest::createPost(array(
+            'grant_type' => 'authorization_code',
+            'client_id' =>'Test Client ID',
+            'code' => 'testcode',
+        ));
+        // verify the mock clientAssertionType was called as expected
+        $clientAssertionType = $this->getMock('OAuth2_ClientAssertionTypeInterface', array('validateRequest', 'getClientId'));
+        $clientAssertionType
+            ->expects($this->once())
+            ->method('validateRequest')
+            ->will($this->returnValue(true));
+        $clientAssertionType
+            ->expects($this->once())
+            ->method('getClientId')
+            ->will($this->returnValue('Test Client ID'));
+
+        // create mock storage
+        $storage = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
+        $server = new OAuth2_Server(array($storage), array(), array(), array(), null, null, $clientAssertionType);
+        $server->handleTokenRequest($request, $response = new OAuth2_Response());
+    }
+
     /**
      * @expectedException InvalidArgumentException OAuth2_ResponseType_AuthorizationCodeInterface
      **/
diff --git a/test/OAuth2/StorageTest.php b/test/OAuth2/StorageTest.php
index 0f18cff..26d0886 100644
--- a/test/OAuth2/StorageTest.php
+++ b/test/OAuth2/StorageTest.php
@@ -212,7 +212,7 @@ class OAuth2_StorageTest extends PHPUnit_Framework_TestCase
         $this->assertFalse($storage->checkUserCredentials('fakeusername', 'testpass'));
 
         // invalid username
-        $this->assertFalse($storage->getUser('fakeusername'));
+        $this->assertFalse($storage->getUserDetails('fakeusername'));
 
         // ensure all properties are set
         $user = $storage->getUser('testusername');
@@ -227,15 +227,18 @@ class OAuth2_StorageTest extends PHPUnit_Framework_TestCase
 
     public function provideStorage()
     {
+        $memory = OAuth2_Storage_Bootstrap::getInstance()->getMemoryStorage();
         $mysql = OAuth2_Storage_Bootstrap::getInstance()->getMysqlPdo();
         $sqlite = OAuth2_Storage_Bootstrap::getInstance()->getSqlitePdo();
         $mongo = OAuth2_Storage_Bootstrap::getInstance()->getMongo();
+        $redis = OAuth2_Storage_Bootstrap::getInstance()->getRedisStorage();
 
         // will add multiple storage types later
         return array(
             array($sqlite),
             array($mysql),
-            array($mongo)
+            array($mongo),
+            array($redis)
         );
     }
 }
diff --git a/test/config/storage.json b/test/config/storage.json
index 967991f..439dcd0 100644
--- a/test/config/storage.json
+++ b/test/config/storage.json
@@ -4,8 +4,20 @@
             "client_id": "Test Client ID",
             "user_id": "",
             "redirect_uri": "",
+            "expires": "9999999999"
+        },
+        "testcode-with-scope": {
+            "client_id": "Test Client ID",
+            "user_id": "",
+            "redirect_uri": "",
             "expires": "9999999999",
-            "scope": ""
+            "scope": "scope1 scope2"
+        },
+        "testcode-expired": {
+            "client_id": "Test Client ID",
+            "user_id": "",
+            "redirect_uri": "",
+            "expires": "1356998400"
         }
     },
     "client_credentials" : {
@@ -15,6 +27,13 @@
         "Test Client ID with Redirect Uri": {
             "secret": "TestSecret2",
             "redirect_uri": "http://brentertainment.com"
+        },
+        "Test Client ID with Multiple Redirect Uris": {
+            "secret": "TestSecret2",
+            "redirect_uri": "http://brentertainment.com http://morehazards.com"
+        },
+        "Test Some Other Client": {
+            "secret": "TestSecret3"
         }
     },
     "user_credentials" : {
@@ -27,6 +46,13 @@
             "user_id": "test-username",
             "expires": 99999999900,
             "scope": null
+        },
+        "test-refreshtoken-with-scope": {
+            "refresh_token": "test-refreshtoken",
+            "client_id": "Test Client ID",
+            "user_id": "test-username",
+            "expires": 99999999900,
+            "scope": "scope1 scope2"
         }
     },
     "access_tokens" : {
@@ -48,26 +74,31 @@
             "scope": "testscope"
         }
     },
-    
     "jwt": {
 	    "Test Client ID": {
-	        "key": "-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgzbq1Tyozg6Wn/ugyw\\nng4J2wPOaSJwPWlFFff92K60rQrrCDDUSVeuhC0+Tjn7Lq35gMZrsWazl3oj4KAH BBFZqBPejER0Z/t1wgZka97uooW2BclxUMjL6sFW92BLm2f2Po/SDjKdGRwt0+kd\\nj2MgmdqIDu7KTNLPVS/3zk0Ln+Ett92pbODhUliYHkVFy/ZZtoX66lggLjZXGdBP\\n2pLx/cAR09B0m1QDBvkzGewmF6Hl0gXqKSBQel1vnR8Pp2c8Fjp3sDB65hiStXmf\\na6NpMZBAb4vBp39SyRrbXiNH7GbYoIiBBtgnhVg4zHAG6btsEyAtmVM0aMhn01TK\\nHQIDAQAB\\n-----END PUBLIC KEY-----",
+	        "key": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5/SxVlE8gnpFqCxgl2wjhzY7u\ncEi00s0kUg3xp7lVEvgLgYcAnHiWp+gtSjOFfH2zsvpiWm6Lz5f743j/FEzHIO1o\nwR0p4d9pOaJK07d01+RzoQLOIQAgXrr4T1CCWUesncwwPBVCyy2Mw3Nmhmr9MrF8\nUlvdRKBxriRnlP3qJQIDAQAB\n-----END PUBLIC KEY-----",
 	        "subject": "testuser@ourdomain.com"
 	    },
-	    
 	    "Test Client ID PHP-5.2": {
 	        "key": "mysecretkey",
 	        "subject": "testuser@ourdomain.com"
 	    },
-	    
 	    "Missing Key Client": {
 	        "key": null,
 	        "subject": "testuser@ourdomain.com"
 	    },
-	    
 	    "Missing Key Client PHP-5.2": {
 	        "key": null,
 	        "subject": "testuser@ourdomain.com"
 	    }
-    }
+    },
+    "client_supported_scopes" : {
+        "Test Client ID" : ["clientscope1", "clientscope2"],
+        "Test Client ID 2" : ["clientscope3"]
+    },
+    "supported_scopes" : [
+        "scope1",
+        "scope2",
+        "scope3"
+    ]
 }
\ No newline at end of file
diff --git a/test/lib/OAuth2/Storage/Bootstrap.php b/test/lib/OAuth2/Storage/Bootstrap.php
index 92ea4b6..be02a60 100644
--- a/test/lib/OAuth2/Storage/Bootstrap.php
+++ b/test/lib/OAuth2/Storage/Bootstrap.php
@@ -33,6 +33,11 @@ class OAuth2_Storage_Bootstrap
         return new OAuth2_Storage_Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../../config/storage.json'), true));
     }
 
+    public function getRedisStorage()
+    {
+        return new OAuth2_Storage_Redis(new OAuth2_Storage_MockRedisClient());
+    }
+    
     public function getMysqlPdo()
     {
         if (!$this->mysql) {
diff --git a/test/lib/OAuth2/Storage/MockRedisClient.php b/test/lib/OAuth2/Storage/MockRedisClient.php
new file mode 100644
index 0000000..9ecaa20
--- /dev/null
+++ b/test/lib/OAuth2/Storage/MockRedisClient.php
@@ -0,0 +1,63 @@
+<?php
+class OAuth2_Storage_MockRedisClient
+{
+    public function __construct()
+    {
+        $data = array(
+            'oauth_clients:oauth_test_client' => array(
+                'client_id' => 'oauth_test_client',
+                'client_secret' => "testpass",
+                'redirect_uri' => '',
+            ),
+            'oauth_access_tokens:testtoken' => array(
+                'access_token' => 'testtoken',
+                'client_id' => "Some Client",
+                'user_id' => '',
+                'expires' => 0,
+                'scope' => ''
+            ),
+            'oauth_authorization_codes:testcode' => array(
+                'client_id' => "Some Client",
+                'authorization_code' => 'testcode',
+                'user_id' => '',
+                'redirect_uri' => '',
+                'expires' => 0,
+                'scope' => ''
+            ),
+            'oauth_users:testuser' => array(
+                'username' => 'testuser',
+                'password' => "password",
+                'first_name' => '',
+                'last_name' => ''
+            )
+        );
+        foreach ( $data as $name => $val ) {
+            $data[$name] = json_encode($val);
+        }
+        $this->data = $data;
+    }
+
+    function get($key)
+    {
+        return isset($this->data[$key]) ? $this->data[$key] : null;
+    }
+
+    function set ($key, $value)
+    {
+        $this->data[$key] = $value;
+        return true;
+    }
+
+    function setex($key, $expires, $value) 
+    {
+        
+        $this->data[$key] = $value;
+        return true;
+    }
+
+    function expire($key) 
+    {
+        unset($this->data[$key]);
+        return true;
+    }
+}