public function testSuccessfulRequestStripsExtraParameters()
 {
     $server = $this->getTestServer(array('allow_implicit' => true));
     $request = new OAuth2_Request(array('client_id' => 'Test Client ID', 'redirect_uri' => 'http://adobe.com?fake=something', 'response_type' => 'token', 'state' => 'test', 'fake' => 'something'));
     $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
     $this->assertEquals($response->getStatusCode(), 302);
     $this->assertNull($response->getParameter('error'));
     $this->assertNull($response->getParameter('error_description'));
     $location = $response->getHttpHeader('Location');
     $parts = parse_url($location);
     $this->assertFalse(isset($parts['fake']));
     $this->assertArrayHasKey('fragment', $parts);
     parse_str($parts['fragment'], $params);
     $this->assertFalse(isset($parmas['fake']));
     $this->assertArrayHasKey('state', $params);
     $this->assertEquals($params['state'], 'test');
 }
 public function testAddingResponseType()
 {
     $storage = $this->getMock('OAuth2_Storage_Memory');
     $storage->expects($this->any())->method('getClientDetails')->will($this->returnValue(array('client_id' => 'some_client')));
     $storage->expects($this->any())->method('checkRestrictedGrantType')->will($this->returnValue(true));
     // add with the "code" key explicitly set
     $codeType = new OAuth2_ResponseType_AuthorizationCode($storage);
     $server = new OAuth2_Server();
     $server->addStorage($storage);
     $server->addResponseType($codeType);
     $request = new OAuth2_Request(array('response_type' => 'code', 'client_id' => 'some_client', 'redirect_uri' => 'http://example.com', 'state' => 'xyx'));
     $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
     // the response is successful
     $this->assertEquals($response->getStatusCode(), 302);
     $parts = parse_url($response->getHttpHeader('Location'));
     parse_str($parts['query'], $query);
     $this->assertTrue(isset($query['code']));
     $this->assertFalse(isset($query['error']));
     // add with the "code" key not set
     $codeType = new OAuth2_ResponseType_AuthorizationCode($storage);
     $server = new OAuth2_Server(array($storage), array(), array(), array($codeType));
     $request = new OAuth2_Request(array('response_type' => 'code', 'client_id' => 'some_client', 'redirect_uri' => 'http://example.com', 'state' => 'xyx'));
     $server->handleAuthorizeRequest($request, $response = new OAuth2_Response(), true);
     // the response is successful
     $this->assertEquals($response->getStatusCode(), 302);
     $parts = parse_url($response->getHttpHeader('Location'));
     parse_str($parts['query'], $query);
     $this->assertTrue(isset($query['code']));
     $this->assertFalse(isset($query['error']));
 }
 public function testOutOfScopeToken()
 {
     $server = $this->getTestServer();
     $request = OAuth2_Request::createFromGlobals();
     $request->headers['AUTHORIZATION'] = 'Bearer accesstoken-scope';
     $scope = 'outofscope';
     $allow = $server->verifyResourceRequest($request, $response = new OAuth2_Response(), $scope);
     $this->assertFalse($allow);
     $this->assertEquals($response->getStatusCode(), 403);
     $this->assertEquals($response->getParameter('error'), 'insufficient_scope');
     $this->assertEquals($response->getParameter('error_description'), 'The request requires higher privileges than provided by the access token');
     // verify the "scope" has been set in the "WWW-Authenticate" header
     preg_match('/scope="(.*?)"/', $response->getHttpHeader('WWW-Authenticate'), $matches);
     $this->assertEquals(2, count($matches));
     $this->assertEquals($matches[1], 'outofscope');
 }