@Test public void accessToken() throws Exception { when(clientAppService.validateApp("client-id-foo", "client-secret-foo")).thenReturn(true); when(clientAppService.createOauthAccessTokenByGrantCode("code1234", "client-id-foo", "foo: "public feed", "Bearer")); mockMvc.perform(post("/oauth/access-token").param("client_id", "client-id-foo") .param("client_secret", "client-secret-foo") .param("redirect_uri", "foo: .param("grant_type", "authorization_code") .param("code", "code1234")) .andExpect(status().isOk()) .andExpect(jsonPath("$.access_token", is("oauth-token"))) .andExpect(jsonPath("$.token_type", is("Bearer"))) .andExpect(jsonPath("$.scope", is("public feed"))) .andExpect(header().string("Cache-Control", "no-store")) .andExpect(header().string("Pragma", "no-cache")); }
@RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody public Object accessToken(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "client_secret", required = false) String clientSecret, @RequestParam(value = "grant_type", required = false) String grantType, @RequestParam(value = "code", required = false) String code, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { setResponseNoCache(response); if (!GrantType.AUTHORIZATION_CODE.toString().equals(grantType)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.UNSUPPORTED_GRANT_TYPE, "grant_type must be authorization_code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(code)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(clientId)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing client_id", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(redirectUri)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing redirect_uri", DEFAULT_ERROR_URI); } if (!clientAppService.validateApp(clientId, clientSecret)) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_CLIENT, "invalid client", DEFAULT_ERROR_URI); } try { return clientAppService.createOauthAccessTokenByGrantCode(code, clientId, redirectUri); } catch (AccessDeniedException e) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_GRANT, "code is invalid", DEFAULT_ERROR_URI); } }
OauthController { @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody public Object accessToken(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "client_secret", required = false) String clientSecret, @RequestParam(value = "grant_type", required = false) String grantType, @RequestParam(value = "code", required = false) String code, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { setResponseNoCache(response); if (!GrantType.AUTHORIZATION_CODE.toString().equals(grantType)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.UNSUPPORTED_GRANT_TYPE, "grant_type must be authorization_code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(code)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(clientId)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing client_id", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(redirectUri)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing redirect_uri", DEFAULT_ERROR_URI); } if (!clientAppService.validateApp(clientId, clientSecret)) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_CLIENT, "invalid client", DEFAULT_ERROR_URI); } try { return clientAppService.createOauthAccessTokenByGrantCode(code, clientId, redirectUri); } catch (AccessDeniedException e) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_GRANT, "code is invalid", DEFAULT_ERROR_URI); } } }
OauthController { @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody public Object accessToken(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "client_secret", required = false) String clientSecret, @RequestParam(value = "grant_type", required = false) String grantType, @RequestParam(value = "code", required = false) String code, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { setResponseNoCache(response); if (!GrantType.AUTHORIZATION_CODE.toString().equals(grantType)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.UNSUPPORTED_GRANT_TYPE, "grant_type must be authorization_code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(code)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(clientId)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing client_id", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(redirectUri)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing redirect_uri", DEFAULT_ERROR_URI); } if (!clientAppService.validateApp(clientId, clientSecret)) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_CLIENT, "invalid client", DEFAULT_ERROR_URI); } try { return clientAppService.createOauthAccessTokenByGrantCode(code, clientId, redirectUri); } catch (AccessDeniedException e) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_GRANT, "code is invalid", DEFAULT_ERROR_URI); } }  }
OauthController { @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody public Object accessToken(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "client_secret", required = false) String clientSecret, @RequestParam(value = "grant_type", required = false) String grantType, @RequestParam(value = "code", required = false) String code, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { setResponseNoCache(response); if (!GrantType.AUTHORIZATION_CODE.toString().equals(grantType)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.UNSUPPORTED_GRANT_TYPE, "grant_type must be authorization_code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(code)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(clientId)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing client_id", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(redirectUri)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing redirect_uri", DEFAULT_ERROR_URI); } if (!clientAppService.validateApp(clientId, clientSecret)) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_CLIENT, "invalid client", DEFAULT_ERROR_URI); } try { return clientAppService.createOauthAccessTokenByGrantCode(code, clientId, redirectUri); } catch (AccessDeniedException e) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_GRANT, "code is invalid", DEFAULT_ERROR_URI); } }  @RequestMapping(value = "/authorize", method = RequestMethod.GET) Object authorize(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "state", required = false) String state,
      @RequestParam(value = "scope", required = false) String scope,
      @RequestParam(value = "response_type", required = false) String responseType,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri); @RequestMapping(value = "/authorize", method = RequestMethod.POST) Object grantCode(HttpServletResponse response,
      @RequestParam(value = "grantDeny", required = false) Boolean grantDeny,
      @RequestParam(value = "oauthDirectAuthorize") String oauthDirectAuthorize,
      @RequestParam(value = "client_id") String clientId,
      @RequestParam(value = "state") String state,
      @RequestParam(value = "scope") String scope,
      @RequestParam(value = "redirect_uri") String redirectUri); @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody Object accessToken(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "client_secret", required = false) String clientSecret,
      @RequestParam(value = "grant_type", required = false) String grantType,
      @RequestParam(value = "code", required = false) String code,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri); }
OauthController { @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody public Object accessToken(HttpServletResponse response, @RequestParam(value = "client_id", required = false) String clientId, @RequestParam(value = "client_secret", required = false) String clientSecret, @RequestParam(value = "grant_type", required = false) String grantType, @RequestParam(value = "code", required = false) String code, @RequestParam(value = "redirect_uri", required = false) String redirectUri) { setResponseNoCache(response); if (!GrantType.AUTHORIZATION_CODE.toString().equals(grantType)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.UNSUPPORTED_GRANT_TYPE, "grant_type must be authorization_code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(code)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing code", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(clientId)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing client_id", DEFAULT_ERROR_URI); } if (Strings.isNullOrEmpty(redirectUri)) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_REQUEST, "missing redirect_uri", DEFAULT_ERROR_URI); } if (!clientAppService.validateApp(clientId, clientSecret)) { response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_CLIENT, "invalid client", DEFAULT_ERROR_URI); } try { return clientAppService.createOauthAccessTokenByGrantCode(code, clientId, redirectUri); } catch (AccessDeniedException e) { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); return new OauthErrorDto(OauthErrors.TokenResponse.INVALID_GRANT, "code is invalid", DEFAULT_ERROR_URI); } }  @RequestMapping(value = "/authorize", method = RequestMethod.GET) Object authorize(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "state", required = false) String state,
      @RequestParam(value = "scope", required = false) String scope,
      @RequestParam(value = "response_type", required = false) String responseType,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri); @RequestMapping(value = "/authorize", method = RequestMethod.POST) Object grantCode(HttpServletResponse response,
      @RequestParam(value = "grantDeny", required = false) Boolean grantDeny,
      @RequestParam(value = "oauthDirectAuthorize") String oauthDirectAuthorize,
      @RequestParam(value = "client_id") String clientId,
      @RequestParam(value = "state") String state,
      @RequestParam(value = "scope") String scope,
      @RequestParam(value = "redirect_uri") String redirectUri); @RequestMapping(value = "/access-token", method = RequestMethod.POST) @ResponseBody Object accessToken(HttpServletResponse response,
      @RequestParam(value = "client_id", required = false) String clientId,
      @RequestParam(value = "client_secret", required = false) String clientSecret,
      @RequestParam(value = "grant_type", required = false) String grantType,
      @RequestParam(value = "code", required = false) String code,
      @RequestParam(value = "redirect_uri", required = false) String redirectUri);  }