add client check for code and refresh token lookup

Author: divoxx

authorization_code_grant_type.go

@@ -69,7 +69,7 @@ func (gt AuthorizationCodeGrantType) TokenHandler(c *Client, ew *EncoderResponse
 		return
 	}
 
-	auth, err := gt.persistence.GetAuthorizationByCode(code)
+	auth, err := gt.persistence.GetAuthorizationByCode(c, code)
 	if err != nil {
 		log.Println("couldn't find authorization for code:", err)
 		ew.Encode(ErrInvalidGrant)

backend.go

@@ -33,9 +33,9 @@ type PersistenceBackend interface {
 	//*
 	// Authorization persistence
 	//*
-	GetAuthorizationByCode(code string) (*Authorization, error)
+	GetAuthorizationByCode(c *Client, code string) (*Authorization, error)
+	GetAuthorizationByRefreshToken(c *Client, refreshToken string) (*Authorization, error)
 	GetAuthorizationByAccessToken(accessToken string) (*Authorization, error)
-	GetAuthorizationByRefreshToken(refreshToken string) (*Authorization, error)
 	SaveAuthorization(a *Authorization) error
 
 	//*

in_memory_persistence.go

@@ -61,33 +61,33 @@ func (b *InMemoryPersistence) SaveAuthorization(a *Authorization) error {
 }
 
 // GetAuthorizationByCode takes a code and look it up
-func (b *InMemoryPersistence) GetAuthorizationByCode(code string) (*Authorization, error) {
+func (b *InMemoryPersistence) GetAuthorizationByCode(c *Client, code string) (*Authorization, error) {
 	for _, a := range b.authorizations {
-		if a.Code == code {
+		if a.Client == c && a.Code == code {
 			return a, nil
 		}
 	}
 
 	return nil, ErrNotFound
 }
 
-// GetAuthorizationByAccessToken takes an access token and returns the authorization
+// GetAuthorizationByRefreshToken takes an access token and returns the authorization
 // it represents, if exists.
-func (b *InMemoryPersistence) GetAuthorizationByAccessToken(accessToken string) (*Authorization, error) {
+func (b *InMemoryPersistence) GetAuthorizationByRefreshToken(c *Client, refreshToken string) (*Authorization, error) {
 	for _, a := range b.authorizations {
-		if a.AccessToken == accessToken {
+		if a.Client == c && a.RefreshToken == refreshToken {
 			return a, nil
 		}
 	}
 
 	return nil, ErrNotFound
 }
 
-// GetAuthorizationByRefreshToken takes an access token and returns the authorization
+// GetAuthorizationByAccessToken takes an access token and returns the authorization
 // it represents, if exists.
-func (b *InMemoryPersistence) GetAuthorizationByRefreshToken(refreshToken string) (*Authorization, error) {
+func (b *InMemoryPersistence) GetAuthorizationByAccessToken(accessToken string) (*Authorization, error) {
 	for _, a := range b.authorizations {
-		if a.RefreshToken == refreshToken {
+		if a.AccessToken == accessToken {
 			return a, nil
 		}
 	}

refresh_token_grant_type.go

@@ -52,7 +52,7 @@ func (gt RefreshTokenGrantType) TokenHandler(c *Client, ew *EncoderResponseWrite
 		return
 	}
 
-	auth, err := gt.persistence.GetAuthorizationByRefreshToken(refreshToken)
+	auth, err := gt.persistence.GetAuthorizationByRefreshToken(c, refreshToken)
 	if err != nil {
 		log.Println("invalid refresh token:", refreshToken)
 		ew.Encode(ErrInvalidGrant)