Restoring request.refresh_token at get_original_scopes.

Author: zuzelvp

oauth2_provider/oauth2_validators.py

@@ -332,9 +332,10 @@ def validate_user(self, username, password, client, request, *args, **kwargs):
         return False
 
     def get_original_scopes(self, refresh_token, request, *args, **kwargs):
-        # TODO: since this method is invoked *after* validate_refresh_token, could we avoid this
-        # second query for RefreshToken?
-        rt = RefreshToken.objects.get(token=refresh_token)
+        # Avoid second query for RefreshToken since this method is invoked *after* validate_refresh_token.
+        rt = request.refresh_token
+        # Restore request.refresh_token
+        request.refresh_token = rt.token
         return rt.access_token.scope
 
     def validate_refresh_token(self, refresh_token, client, request, *args, **kwargs):
@@ -345,6 +346,8 @@ def validate_refresh_token(self, refresh_token, client, request, *args, **kwargs
         try:
             rt = RefreshToken.objects.get(token=refresh_token)
             request.user = rt.user
+            # Temporary store RefreshToken instance to be reused by self.get_original_scopes.
+            request.refresh_token = rt
             return rt.application == client
 
         except RefreshToken.DoesNotExist:

oauth2_provider/tests/test_authorization_code.py

@@ -11,6 +11,7 @@
 from ..compat import urlparse, parse_qs, urlencode, get_user_model
 from ..models import get_application_model, Grant, AccessToken
 from ..settings import oauth2_settings
+from ..oauth2_validators import OAuth2Validator
 from ..views import ProtectedResourceView
 
 from .test_utils import TestCaseUtils
@@ -474,6 +475,43 @@ def test_refresh_fail_repeating_requests(self):
         response = self.client.post(reverse('oauth2_provider:token'), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 401)
 
+    def test_refresh_repeating_requests_non_rotating_tokens(self):
+        """
+        Try refreshing an access token with the same refresh token more than once when not rotating tokens.
+        """
+        class NonRotatingOAuth2Validator(OAuth2Validator):
+            def rotate_refresh_token(self, request):
+                return False
+        validator_class = oauth2_settings.OAUTH2_VALIDATOR_CLASS
+        oauth2_settings.OAUTH2_VALIDATOR_CLASS = NonRotatingOAuth2Validator
+
+        self.client.login(username="test_user", password="123456")
+        authorization_code = self.get_auth()
+
+        token_request_data = {
+            'grant_type': 'authorization_code',
+            'code': authorization_code,
+            'redirect_uri': 'http://example.it'
+        }
+        auth_headers = self.get_basic_auth_header(self.application.client_id, self.application.client_secret)
+
+        response = self.client.post(reverse('oauth2_provider:token'), data=token_request_data, **auth_headers)
+        content = json.loads(response.content.decode("utf-8"))
+        self.assertTrue('refresh_token' in content)
+
+        token_request_data = {
+            'grant_type': 'refresh_token',
+            'refresh_token': content['refresh_token'],
+            'scope': content['scope'],
+        }
+        
+        response = self.client.post(reverse('oauth2_provider:token'), data=token_request_data, **auth_headers)
+        self.assertEqual(response.status_code, 200)
+        response = self.client.post(reverse('oauth2_provider:token'), data=token_request_data, **auth_headers)
+        self.assertEqual(response.status_code, 200)
+
+        oauth2_settings.OAUTH2_VALIDATOR_CLASS = validator_class
+
     def test_basic_auth_bad_authcode(self):
         """
         Request an access token using a bad authorization code