abstract common grants tasks

src/Grant/AbstractGrant.php

@@ -12,12 +12,16 @@
 namespace League\OAuth2\Server\Grant;
 
 use League\Event\EmitterInterface;
+use League\Event\Event;
+use League\OAuth2\Server\Entities\AccessTokenEntity;
 use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
+use League\OAuth2\Server\Entities\RefreshTokenEntity;
 use League\OAuth2\Server\Entities\ScopeEntity;
 use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
 use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
 use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
+use League\OAuth2\Server\Utils\SecureKey;
 use Psr\Http\Message\ServerRequestInterface;
 
 /**
@@ -95,6 +99,60 @@ abstract class AbstractGrant implements GrantTypeInterface
         return $this->respondsWith;
     }
 
+    /**
+     * @param \Psr\Http\Message\ServerRequestInterface $request
+     *
+     * @return \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface
+     *
+     * @throws \League\OAuth2\Server\Exception\OAuthServerException
+     */
+    protected function validateClient(ServerRequestInterface $request)
+    {
+        $clientId = $this->getRequestParameter(['client_id', 'PHP_AUTH_USER'], $request);
+        if (is_null($clientId)) {
+            throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
+        }
+
+        $clientSecret = $this->getRequestParameter(['client_secret', 'PHP_AUTH_PW'], $request);
+        if (is_null($clientSecret)) {
+            throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
+        }
+
+        $client = $this->clientRepository->getClientEntity(
+            $clientId,
+            $clientSecret,
+            null,
+            $this->getIdentifier()
+        );
+
+        if (!$client instanceof ClientEntityInterface) {
+            $this->emitter->emit(new Event('client.authentication.failed', $request));
+
+            throw OAuthServerException::invalidClient();
+        }
+
+        return $client;
+    }
+
+    /**
+     * Retrieve request parameter.
+     *
+     * @param string|array                             $parameter
+     * @param \Psr\Http\Message\ServerRequestInterface $request
+     *
+     * @return string|null
+     */
+    protected function getRequestParameter($parameter, ServerRequestInterface $request)
+    {
+        foreach ((array) $parameter as $param) {
+            if (isset($request->getParsedBody()[$param])) {
+                return $request->getParsedBody()[$param];
+            }
+        }
+
+        return null;
+    }
+
     /**
      * @param string                $scopeParamValue      A string containing a delimited set of scope identifiers
      * @param string                $scopeDelimiterString The delimiter between the scopes in the value string
@@ -142,4 +200,57 @@ abstract class AbstractGrant implements GrantTypeInterface
     {
         $this->emitter = $emitter;
     }
+
+    /**
+     * @param \DateInterval                                                   $tokenTTL
+     * @param \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface $client
+     * @param string                                                          $userIdentifier
+     * @param array                                                           $scopes
+     *
+     * @return \League\OAuth2\Server\Entities\AccessTokenEntity
+     */
+    protected function issueAccessToken(
+        \DateInterval $tokenTTL,
+        ClientEntityInterface $client,
+        $userIdentifier,
+        array $scopes = []
+    ) {
+        $accessToken = new AccessTokenEntity();
+        $accessToken->setIdentifier(SecureKey::generate());
+        $accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL));
+        $accessToken->setClient($client);
+        $accessToken->setUserIdentifier($userIdentifier);
+
+        foreach ($scopes as $scope) {
+            $accessToken->addScope($scope);
+        }
+
+        return $accessToken;
+    }
+
+    /**
+     * @param \League\OAuth2\Server\Entities\AccessTokenEntity $accessToken
+     *
+     * @return \League\OAuth2\Server\Entities\RefreshTokenEntity
+     */
+    protected function issueRefreshToken(AccessTokenEntity $accessToken)
+    {
+        $refreshToken = new RefreshTokenEntity();
+        $refreshToken->setIdentifier(SecureKey::generate());
+        $refreshToken->setExpiryDateTime((new \DateTime())->add(new \DateInterval('P1M')));
+        $refreshToken->setAccessToken($accessToken);
+
+        return $refreshToken;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function canRespondToRequest(ServerRequestInterface $request)
+    {
+        return (
+            isset($request->getParsedBody()['grant_type'])
+            && $request->getParsedBody()['grant_type'] === $this->identifier
+        );
+    }
 }

src/Grant/ClientCredentialsGrant.php

@@ -11,13 +11,9 @@
 
 namespace League\OAuth2\Server\Grant;
 
-use DateInterval;
-use League\Event\Event;
-use League\OAuth2\Server\Entities\AccessTokenEntity;
 use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
 use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
-use League\OAuth2\Server\Utils\SecureKey;
 use Psr\Http\Message\ServerRequestInterface;
 
 /**
@@ -38,62 +34,14 @@ class ClientCredentialsGrant extends AbstractGrant
     public function respondToRequest(
         ServerRequestInterface $request,
         ResponseTypeInterface $responseType,
-        DateInterval $accessTokenTTL,
+        \DateInterval $tokenTTL,
         $scopeDelimiter = ' '
     ) {
-        // Get the required params
+        $client = $this->validateClient($request);
-        $clientId = isset($request->getParsedBody()['client_id'])
+        $scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client);
-            ? $request->getParsedBody()['client_id'] // $_POST['client_id']
-            : (isset($request->getServerParams()['PHP_AUTH_USER'])
-                ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
-                : null);
 
-        if (is_null($clientId)) {
+        $accessToken = $this->issueAccessToken($tokenTTL, $client, $client->getIdentifier(), $scopes);
-            throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
-        }
 
-        $clientSecret = isset($request->getParsedBody()['client_secret'])
-            ? $request->getParsedBody()['client_secret'] // $_POST['client_id']
-            : (isset($request->getServerParams()['PHP_AUTH_PW'])
-                ? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER']
-                : null);
-
-        if (is_null($clientSecret)) {
-            throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
-        }
-
-        // Validate client ID and client secret
-        $client = $this->clientRepository->getClientEntity(
-            $clientId,
-            $clientSecret,
-            null,
-            $this->getIdentifier()
-        );
-
-        if (($client instanceof ClientEntityInterface) === false) {
-            $this->emitter->emit(new Event('client.authentication.failed', $request));
-            throw OAuthServerException::invalidClient();
-        }
-
-        // Validate any scopes that are in the request
-        $scopeParam = isset($request->getParsedBody()['scope'])
-            ? $request->getParsedBody()['scope'] // $_POST['scope']
-            : '';
-        $scopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client);
-
-        // Generate an access token
-        $accessToken = new AccessTokenEntity();
-        $accessToken->setIdentifier(SecureKey::generate());
-        $accessToken->setExpiryDateTime((new \DateTime())->add($accessTokenTTL));
-        $accessToken->setClient($client);
-        $accessToken->setUserIdentifier($client->getIdentifier());
-
-        // Associate scopes with the session and access token
-        foreach ($scopes as $scope) {
-            $accessToken->addScope($scope);
-        }
-
-        // Save the token
         $this->accessTokenRepository->persistNewAccessToken($accessToken);
 
         // Inject access token into token type
@@ -101,15 +49,4 @@ class ClientCredentialsGrant extends AbstractGrant
 
         return $responseType;
     }
-
-    /**
-     * @inheritdoc
-     */
-    public function canRespondToRequest(ServerRequestInterface $request)
-    {
-        return (
-            array_key_exists('grant_type', $request->getParsedBody())
-            && $request->getParsedBody()['grant_type'] === 'client_credentials'
-        );
-    }
 }

src/Grant/PasswordGrant.php

@@ -11,12 +11,9 @@
 
 namespace League\OAuth2\Server\Grant;
 
-use DateInterval;
 use League\Event\Event;
-use League\OAuth2\Server\Entities\AccessTokenEntity;
 use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
 use League\OAuth2\Server\Entities\Interfaces\UserEntityInterface;
-use League\OAuth2\Server\Entities\RefreshTokenEntity;
 use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
 use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
@@ -24,7 +21,6 @@ use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
 use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
 use League\OAuth2\Server\Repositories\UserRepositoryInterface;
 use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
-use League\OAuth2\Server\Utils\SecureKey;
 use Psr\Http\Message\ServerRequestInterface;
 
 /**
@@ -32,6 +28,13 @@ use Psr\Http\Message\ServerRequestInterface;
  */
 class PasswordGrant extends AbstractGrant
 {
+    /**
+     * Grant identifier
+     *
+     * @var string
+     */
+    protected $identifier = 'password';
+
     /**
      * @var \League\OAuth2\Server\Repositories\UserRepositoryInterface
      */
@@ -56,9 +59,10 @@ class PasswordGrant extends AbstractGrant
         AccessTokenRepositoryInterface $accessTokenRepository,
         RefreshTokenRepositoryInterface $refreshTokenRepository
     ) {
+        parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
+
         $this->userRepository = $userRepository;
         $this->refreshTokenRepository = $refreshTokenRepository;
-        parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
     }
 
     /**
@@ -67,97 +71,16 @@ class PasswordGrant extends AbstractGrant
     public function respondToRequest(
         ServerRequestInterface $request,
         ResponseTypeInterface $responseType,
-        DateInterval $tokenTTL,
+        \DateInterval $tokenTTL,
         $scopeDelimiter = ' '
     ) {
-        // Get the required params
+        $client = $this->validateClient($request);
-        $clientId = isset($request->getParsedBody()['client_id'])
+        $user   = $this->validateUser($request);
-            ? $request->getParsedBody()['client_id'] // $_POST['client_id']
+        $scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client);
-            : (isset($request->getServerParams()['PHP_AUTH_USER'])
-                ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
-                : null);
 
-        if (is_null($clientId)) {
+        $accessToken = $this->issueAccessToken($tokenTTL, $client, $user->getIdentifier(), $scopes);
-            throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
+        $refreshToken = $this->issueRefreshToken($accessToken);
-        }
 
-        $clientSecret = isset($request->getParsedBody()['client_secret'])
-            ? $request->getParsedBody()['client_secret'] // $_POST['client_id']
-            : (isset($request->getServerParams()['PHP_AUTH_PW'])
-                ? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER']
-                : null);
-
-        if (is_null($clientSecret)) {
-            throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
-        }
-
-        // Validate client ID and client secret
-        $client = $this->clientRepository->getClientEntity(
-            $clientId,
-            $clientSecret,
-            null,
-            $this->getIdentifier()
-        );
-
-        if (($client instanceof ClientEntityInterface) === false) {
-            $this->emitter->emit(new Event('client.authentication.failed', $request));
-            throw OAuthServerException::invalidClient();
-        }
-
-        // Username
-        $username = isset($request->getParsedBody()['username'])
-            ? $request->getParsedBody()['username'] // $_POST['username']
-            : (isset($request->getServerParams()['PHP_AUTH_USER'])
-                ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
-                : null);
-
-        if (is_null($username)) {
-            throw OAuthServerException::invalidRequest('username', null, '`%s` parameter is missing');
-        }
-
-        // Password
-        $password = isset($request->getParsedBody()['password'])
-            ? $request->getParsedBody()['password'] // $_POST['password']
-            : (isset($request->getServerParams()['PHP_AUTH_USER'])
-                ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
-                : null);
-
-        if (is_null($password)) {
-            throw OAuthServerException::invalidRequest('password', null, '`%s` parameter is missing');
-        }
-
-        // Verify user's username and password
-        $userEntity = $this->userRepository->getUserEntityByUserCredentials($username, $password);
-        if (($userEntity instanceof UserEntityInterface) === false) {
-            $this->emitter->emit(new Event('user.authentication.failed', $request));
-            throw OAuthServerException::invalidCredentials();
-        }
-
-        // Validate any scopes that are in the request
-        $scopeParam = isset($request->getParsedBody()['scope'])
-            ? $request->getParsedBody()['scope'] // $_POST['scope']
-            : '';
-        $scopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client);
-
-        // Generate an access token
-        $accessToken = new AccessTokenEntity();
-        $accessToken->setIdentifier(SecureKey::generate());
-        $accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL));
-        $accessToken->setClient($client);
-        $accessToken->setUserIdentifier($userEntity->getIdentifier());
-
-        // Associate scopes with the session and access token
-        foreach ($scopes as $scope) {
-            $accessToken->addScope($scope);
-        }
-
-        // Generate a refresh token
-        $refreshToken = new RefreshTokenEntity();
-        $refreshToken->setIdentifier(SecureKey::generate());
-        $refreshToken->setExpiryDateTime((new \DateTime())->add(new DateInterval('P1M')));
-        $refreshToken->setAccessToken($accessToken);
-
-        // Persist the tokens
         $this->accessTokenRepository->persistNewAccessToken($accessToken);
         $this->refreshTokenRepository->persistNewRefreshToken($refreshToken);
 
@@ -169,13 +92,31 @@ class PasswordGrant extends AbstractGrant
     }
 
     /**
-     * @inheritdoc
+     * @param \Psr\Http\Message\ServerRequestInterface $request
+     *
+     * @return \League\OAuth2\Server\Entities\Interfaces\UserEntityInterface
+     *
+     * @throws \League\OAuth2\Server\Exception\OAuthServerException
      */
-    public function canRespondToRequest(ServerRequestInterface $request)
+    protected function validateUser(ServerRequestInterface $request)
     {
-        return (
+        $username = $this->getRequestParameter(['username', 'PHP_AUTH_USER'], $request);
-            isset($request->getParsedBody()['grant_type'])
+        if (is_null($username)) {
-            && $request->getParsedBody()['grant_type'] === 'password'
+            throw OAuthServerException::invalidRequest('username', null, '`%s` parameter is missing');
-        );
+        }
+
+        $password = $this->getRequestParameter(['password', 'PHP_AUTH_PW'], $request);
+        if (is_null($password)) {
+            throw OAuthServerException::invalidRequest('password', null, '`%s` parameter is missing');
+        }
+
+        $user = $this->userRepository->getUserEntityByUserCredentials($username, $password);
+        if (!$user instanceof UserEntityInterface) {
+            $this->emitter->emit(new Event('user.authentication.failed', $request));
+
+            throw OAuthServerException::invalidCredentials();
+        }
+
+        return $user;
     }
 }

src/Grant/RefreshTokenGrant.php

@@ -11,14 +11,8 @@
 
 namespace League\OAuth2\Server\Grant;
 
-use DateInterval;
+use League\Event\Event;
-use Lcobucci\JWT\Parser;
-use Lcobucci\JWT\Signer\Key;
-use Lcobucci\JWT\Signer\Rsa\Sha256;
-use Lcobucci\JWT\ValidationData;
-use League\OAuth2\Server\Entities\AccessTokenEntity;
 use League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface;
-use League\OAuth2\Server\Entities\RefreshTokenEntity;
 use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
 use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
@@ -26,9 +20,7 @@ use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
 use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
 use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
 use League\OAuth2\Server\Utils\KeyCrypt;
-use League\OAuth2\Server\Utils\SecureKey;
 use Psr\Http\Message\ServerRequestInterface;
-use Symfony\Component\EventDispatcher\Event;
 
 /**
  * Refresh token grant
@@ -36,14 +28,22 @@ use Symfony\Component\EventDispatcher\Event;
 class RefreshTokenGrant extends AbstractGrant
 {
     /**
-     * @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface
+     * Grant identifier
+     *
+     * @var string
      */
-    private $refreshTokenRepository;
+    protected $identifier = 'refresh_token';
+
     /**
      * @var string
      */
     private $pathToPublicKey;
 
+    /**
+     * @var \League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface
+     */
+    private $refreshTokenRepository;
+
     /**
      * @param string                                                             $pathToPublicKey
      * @param \League\OAuth2\Server\Repositories\ClientRepositoryInterface       $clientRepository
@@ -58,9 +58,10 @@ class RefreshTokenGrant extends AbstractGrant
         AccessTokenRepositoryInterface $accessTokenRepository,
         RefreshTokenRepositoryInterface $refreshTokenRepository
     ) {
+        parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
+
         $this->pathToPublicKey = $pathToPublicKey;
         $this->refreshTokenRepository = $refreshTokenRepository;
-        parent::__construct($clientRepository, $scopeRepository, $accessTokenRepository);
     }
 
     /**
@@ -69,113 +70,35 @@ class RefreshTokenGrant extends AbstractGrant
     public function respondToRequest(
         ServerRequestInterface $request,
         ResponseTypeInterface $responseType,
-        DateInterval $tokenTTL,
+        \DateInterval $tokenTTL,
         $scopeDelimiter = ' '
     ) {
-        // Get the required params
+        $client = $this->validateClient($request);
-        $clientId = isset($request->getParsedBody()['client_id'])
+        $oldRefreshToken = $this->validateOldRefreshToken($request, $client->getIdentifier());
-            ? $request->getParsedBody()['client_id'] // $_POST['client_id']
+        $scopes = $this->validateScopes($this->getRequestParameter('scope', $request), $scopeDelimiter, $client);
-            : (isset($request->getServerParams()['PHP_AUTH_USER'])
-                ? $request->getServerParams()['PHP_AUTH_USER'] // $_SERVER['PHP_AUTH_USER']
-                : null);
-
-        if (is_null($clientId)) {
-            throw OAuthServerException::invalidRequest('client_id', null, '`%s` parameter is missing');
-        }
-
-        $clientSecret = isset($request->getParsedBody()['client_secret'])
-            ? $request->getParsedBody()['client_secret'] // $_POST['client_id']
-            : (isset($request->getServerParams()['PHP_AUTH_PW'])
-                ? $request->getServerParams()['PHP_AUTH_PW'] // $_SERVER['PHP_AUTH_USER']
-                : null);
-
-        if (is_null($clientSecret)) {
-            throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
-        }
-
-        $encryptedRefreshToken = isset($request->getParsedBody()['refresh_token'])
-            ? $request->getParsedBody()['refresh_token']
-            : null;
-
-        if ($encryptedRefreshToken === null) {
-            throw OAuthServerException::invalidRequest('refresh_token', null, '`%s` parameter is missing');
-        }
-
-        // Validate client ID and client secret
-        $client = $this->clientRepository->getClientEntity(
-            $clientId,
-            $clientSecret,
-            null,
-            $this->getIdentifier()
-        );
-
-        if (($client instanceof ClientEntityInterface) === false) {
-            $this->emitter->emit(new Event('client.authentication.failed', $request));
-            throw OAuthServerException::invalidClient();
-        }
-
-        // Validate refresh token
-        try {
-            $oldRefreshToken = KeyCrypt::decrypt($encryptedRefreshToken, $this->pathToPublicKey);
-        } catch (\LogicException $e) {
-            throw OAuthServerException::invalidRefreshToken('Cannot parse refresh token: ' . $e->getMessage());
-        }
-
-        $oldRefreshTokenData = json_decode($oldRefreshToken, true);
-        if ($oldRefreshTokenData['client_id'] !== $client->getIdentifier()) {
-            throw OAuthServerException::invalidRefreshToken('Token is not linked to client' . ' got: ' . $client->getIdentifier() . ' expected: '. $oldRefreshTokenData['client_id']);
-        }
-
-        if ($oldRefreshTokenData['expire_time'] < time()) {
-            throw OAuthServerException::invalidRefreshToken('Token has expired');
-        }
-
-        if ($this->refreshTokenRepository->isRefreshTokenRevoked($oldRefreshTokenData['refresh_token_id']) === true) {
-            throw OAuthServerException::invalidRefreshToken('Token has been revoked');
-        }
-
-        // Get and validate any requested scopes
-        $scopeParam = isset($request->getParsedBody()['scope'])
-            ? $request->getParsedBody()['scope'] // $_POST['scope']
-            : '';
-        $requestedScopes = $this->validateScopes($scopeParam, $scopeDelimiter, $client);
 
         // If no new scopes are requested then give the access token the original session scopes
-        if (count($requestedScopes) === 0) {
+        if (count($scopes) === 0) {
-            $newScopes = $oldRefreshTokenData['scopes'];
+            $scopes = $oldRefreshToken['scopes'];
         } else {
             // The OAuth spec says that a refreshed access token can have the original scopes or fewer so ensure
-            //  the request doesn't include any new scopes
+            // the request doesn't include any new scopes
-            foreach ($requestedScopes as $requestedScope) {
+            foreach ($scopes as $scope) {
-                if (in_array($requestedScope->getIdentifier(), $oldRefreshTokenData['scopes']) === false) {
+                if (in_array($scope->getIdentifier(), $oldRefreshToken['scopes']) === false) {
-                    throw OAuthServerException::invalidScope($requestedScope->getIdentifier());
+                    $this->emitter->emit(new Event('scope.selection.failed', $request));
+
+                    throw OAuthServerException::invalidScope($scope->getIdentifier());
                 }
             }
-
-            $newScopes = $requestedScopes;
         }
 
-        // Generate a new access token
+        // Expire old tokens
-        $accessToken = new AccessTokenEntity();
+        $this->accessTokenRepository->revokeAccessToken($oldRefreshToken['access_token_id']);
-        $accessToken->setIdentifier(SecureKey::generate());
+        $this->refreshTokenRepository->revokeRefreshToken($oldRefreshToken['refresh_token_id']);
-        $accessToken->setExpiryDateTime((new \DateTime())->add($tokenTTL));
-        $accessToken->setClient($client);
-        $accessToken->setUserIdentifier($oldRefreshTokenData['user_id']);
-        foreach ($newScopes as $scope) {
-            $accessToken->addScope($scope);
-        }
 
-        // Expire the old tokens and save the new one
+        $accessToken = $this->issueAccessToken($tokenTTL, $client, $oldRefreshToken['user_id'], $scopes);
-        $this->accessTokenRepository->revokeAccessToken($oldRefreshTokenData['access_token_id']);
+        $refreshToken = $this->issueRefreshToken($accessToken);
-        $this->refreshTokenRepository->revokeRefreshToken($oldRefreshTokenData['refresh_token_id']);
 
-        // Generate a new refresh token
-        $refreshToken = new RefreshTokenEntity();
-        $refreshToken->setIdentifier(SecureKey::generate());
-        $refreshToken->setExpiryDateTime((new \DateTime())->add(new DateInterval('P1M')));
-        $refreshToken->setAccessToken($accessToken);
-
-        // Persist the tokens
         $this->accessTokenRepository->persistNewAccessToken($accessToken);
         $this->refreshTokenRepository->persistNewRefreshToken($refreshToken);
 
@@ -187,13 +110,46 @@ class RefreshTokenGrant extends AbstractGrant
     }
 
     /**
-     * @inheritdoc
+     * @param \Psr\Http\Message\ServerRequestInterface $request
+     * @param string                                   $clientId
+     *
+     * @return array
+     *
+     * @throws \League\OAuth2\Server\Exception\OAuthServerException
      */
-    public function canRespondToRequest(ServerRequestInterface $request)
+    protected function validateOldRefreshToken(ServerRequestInterface $request, $clientId)
     {
-        return (
+        $encryptedRefreshToken = $this->getRequestParameter('refresh_token', $request);
-            isset($request->getParsedBody()['grant_type'])
+        if (is_null($encryptedRefreshToken)) {
-            && $request->getParsedBody()['grant_type'] === 'refresh_token'
+            throw OAuthServerException::invalidRequest('refresh_token', null, '`%s` parameter is missing');
-        );
+        }
+
+        // Validate refresh token
+        try {
+            $refreshToken = KeyCrypt::decrypt($encryptedRefreshToken, $this->pathToPublicKey);
+        } catch (\LogicException $e) {
+            throw OAuthServerException::invalidRefreshToken('Cannot parse refresh token: ' . $e->getMessage());
+        }
+
+        $refreshTokenData = json_decode($refreshToken, true);
+        if ($refreshTokenData['client_id'] !== $clientId) {
+            $this->emitter->emit(new Event('refresh_token.client.failed', $request));
+
+            throw OAuthServerException::invalidRefreshToken(
+                'Token is not linked to client,' .
+                ' got: ' . $clientId .
+                ' expected: '. $refreshTokenData['client_id']
+            );
+        }
+
+        if ($refreshTokenData['expire_time'] < time()) {
+            throw OAuthServerException::invalidRefreshToken('Token has expired');
+        }
+
+        if ($this->refreshTokenRepository->isRefreshTokenRevoked($refreshTokenData['refresh_token_id']) === true) {
+            throw OAuthServerException::invalidRefreshToken('Token has been revoked');
+        }
+
+        return $refreshTokenData;
     }
 }