{"action":"created","issue":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/282","labels_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/282/labels{/name}","comments_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/282/comments","events_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/282/events","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/282","id":54210353,"number":282,"title":"Refreshed access token (via refresh_token grant) does not get the same scope as original access token","user":{"login":"nazan","id":683005,"avatar_url":"https://avatars.githubusercontent.com/u/683005?v=3","gravatar_id":"","url":"https://api.github.com/users/nazan","html_url":"https://github.com/nazan","followers_url":"https://api.github.com/users/nazan/followers","following_url":"https://api.github.com/users/nazan/following{/other_user}","gists_url":"https://api.github.com/users/nazan/gists{/gist_id}","starred_url":"https://api.github.com/users/nazan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nazan/subscriptions","organizations_url":"https://api.github.com/users/nazan/orgs","repos_url":"https://api.github.com/users/nazan/repos","events_url":"https://api.github.com/users/nazan/events{/privacy}","received_events_url":"https://api.github.com/users/nazan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-13T15:57:52Z","updated_at":"2015-01-20T15:56:42Z","closed_at":null,"body":"In the following method, notice that SessionEntity is never associated with the requested ScopeEntities.\r\n\r\n> League\\OAuth2\\Server\\Grant\\AuthCodeGrant::newAuthorizeRequest(...)\r\n\r\nAlso notice that in the following method, ScopeEntities are associated to SessionEntity but the save() method of SessionEntity is never called (therefore not persisted into database).\r\n\r\n> League\\OAuth2\\Server\\Grant\\AuthCodeGrant::completeFlow()\r\n\r\nHowever in the following method (when using refresh_token grant type), it tries to retrieve ScopeEntities from the SessionEntity which gives an empty array. As a result the new access token (\"REFRESHED\" token) is never re-populated with the scopes from the original access token.\r\n\r\n> League\\OAuth2\\Server\\Grant\\RefreshTokenGrant::completeFlow()\r\n\r\n\r\nNOTE: I do realize that this problem is in League code and not the code in this repo. I wasn't sure where to post this, so I'm posting in both thephpleague/oauth2-server and this repo."},"comment":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/comments/70676682","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/282#issuecomment-70676682","issue_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/282","id":70676682,"user":{"login":"zzal","id":110392,"avatar_url":"https://avatars.githubusercontent.com/u/110392?v=3","gravatar_id":"","url":"https://api.github.com/users/zzal","html_url":"https://github.com/zzal","followers_url":"https://api.github.com/users/zzal/followers","following_url":"https://api.github.com/users/zzal/following{/other_user}","gists_url":"https://api.github.com/users/zzal/gists{/gist_id}","starred_url":"https://api.github.com/users/zzal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zzal/subscriptions","organizations_url":"https://api.github.com/users/zzal/orgs","repos_url":"https://api.github.com/users/zzal/repos","events_url":"https://api.github.com/users/zzal/events{/privacy}","received_events_url":"https://api.github.com/users/zzal/received_events","type":"User","site_admin":false},"created_at":"2015-01-20T15:56:42Z","updated_at":"2015-01-20T15:56:42Z","body":"I would be very interested to know how exactly do you use the refresh token grant mechanism.\r\nI find the docs in the wiki hardly talkative  :\r\nhttps://github.com/lucadegasperi/oauth2-server-laravel/wiki/Implementing-an-Authorization-Server-with-the-Refresh-Token-Grant\r\n>  3. Whenever you request an Access Token using a grant that supports the use of the \r\n> Refresh Token grant, you'll get a Refresh Token together with the Access Token. \r\n> Once the Access Token expires, use the Refresh Token to require a new one.\r\n\r\n??? And? How?"}}