CVE-2020-15222: Insufficient Verification of Data Authenticity (CWE-345)
value: In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.
CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 8.1
Published: 2020-09-24T17:15Z
Repository: https://github.com/ory/fosite
Language: Go
Files changed: client_authentication.go, client_authentication_test.go, client_manager.go, errors.go, go.mod, go.sum, handler/oauth2/flow_refresh.go, internal/access_request.go, internal/access_response.go, internal/access_token_storage.go, internal/access_token_strategy.go, internal/authorize_code_storage.go, internal/authorize_code_strategy.go, internal/authorize_handler.go, internal/authorize_request.go, internal/authorize_response.go, internal/client.go, internal/hash.go, internal/id_token_strategy.go, internal/introspector.go, internal/oauth2_client_storage.go, internal/oauth2_owner_storage.go, internal/oauth2_revoke_storage.go, internal/oauth2_storage.go, internal/oauth2_strategy.go, internal/openid_id_token_storage.go, internal/pkce_storage_strategy.go, internal/refresh_token_strategy.go, internal/request.go, internal/revoke_handler.go, internal/storage.go, internal/token_handler.go, internal/transactional.go, storage/memory.go
Commit date: 2020-03-29 11:27:31 +0200
Commit message: Merge pull request from GHSA-v3q9-2p3m-7g43

* u

* u
Diff: diff --git a/client_authentication.go b/client_authentication.go
index 27f2ef0..22480fa 100644
--- a/client_authentication.go
+++ b/client_authentication.go
@@ -22,13 +22,15 @@
 package fosite
 
 import (
 	"context"
 	"crypto/rsa"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/url"
+	"time"
 
 	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/pkg/errors"
 	jose "gopkg.in/square/go-jose.v2"
 )
@@ -140,18 +142,40 @@ func (f *Fosite) AuthenticateClient(ctx context.Context, r *http.Request, form u
 		claims, ok := token.Claims.(*jwt.MapClaims)
 		if !ok {
 			return nil, errors.WithStack(ErrInvalidClient.WithHint("Unable to type assert claims from request parameter \"client_assertion\".").WithDebugf(`Got claims of type %T but expected type "*jwt.MapClaims".`, token.Claims))
 		}
 
+		var jti string
 		if !claims.VerifyIssuer(clientID, true) {
 			return nil, errors.WithStack(ErrInvalidClient.WithHint("Claim \"iss\" from \"client_assertion\" must match the \"client_id\" of the OAuth 2.0 Client."))
 		} else if f.TokenURL == "" {
 			return nil, errors.WithStack(ErrMisconfiguration.WithHint("The authorization server's token endpoint URL has not been set."))
 		} else if sub, ok := (*claims)["sub"].(string); !ok || sub != clientID {
 			return nil, errors.WithStack(ErrInvalidClient.WithHint("Claim \"sub\" from \"client_assertion\" must match the \"client_id\" of the OAuth 2.0 Client."))
-		} else if jti, ok := (*claims)["jti"].(string); !ok || len(jti) == 0 {
+		} else if jti, ok = (*claims)["jti"].(string); !ok || len(jti) == 0 {
 			return nil, errors.WithStack(ErrInvalidClient.WithHint("Claim \"jti\" from \"client_assertion\" must be set but is not."))
+		} else if f.Store.ClientAssertionJWTValid(context.Background(), jti) != nil {
+			return nil, errors.WithStack(ErrJTIKnown.WithHint("Claim \"jti\" from \"client_assertion\" MUST only be used once."))
+		}
+
+		// type conversion according to jwt.MapClaims.VerifyExpiresAt
+		var expiry int64
+		err = nil
+		switch exp := (*claims)["exp"].(type) {
+		case float64:
+			expiry = int64(exp)
+		case json.Number:
+			expiry, err = exp.Int64()
+		default:
+			err = ErrInvalidClient.WithHint("Unable to type assert the expiry time from claims. This should not happen as we validate the expiry time already earlier with token.Claims.Valid()")
+		}
+
+		if err != nil {
+			return nil, errors.WithStack(err)
+		}
+		if err := f.Store.SetClientAssertionJWT(context.Background(), jti, time.Unix(expiry, 0)); err != nil {
+			return nil, err
 		}
 
 		if auds, ok := (*claims)["aud"].([]interface{}); !ok {
 			if !claims.VerifyAudience(f.TokenURL, true) {
 				return nil, errors.WithStack(ErrInvalidClient.WithHintf("Claim \"audience\" from \"client_assertion\" must match the authorization server's token endpoint \"%s\".", f.TokenURL))
diff --git a/client_authentication_test.go b/client_authentication_test.go
index 7c17f33..d079138 100644
--- a/client_authentication_test.go
+++ b/client_authentication_test.go
@@ -212,11 +212,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should pass with proper assertion when JWKs are set within the client and client_id is not set in the request",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r: new(http.Request),
@@ -224,11 +224,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because token auth method is not private_key_jwt",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "client_secret_jwt"},
 			form: url.Values{"client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -237,11 +237,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should pass with proper assertion when JWKs are set within the client and client_id is not set in the request (aud is array)",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": []string{"token-url-2", "token-url"},
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r: new(http.Request),
@@ -249,11 +249,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because audience (array) does not match token url",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": []string{"token-url-1", "token-url-2"},
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -262,11 +262,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should pass with proper assertion when JWKs are set within the client",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r: new(http.Request),
@@ -274,11 +274,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because JWT algorithm is HS256",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateHSAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -287,11 +287,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because JWT algorithm is none",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateNoneAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -300,11 +300,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should pass with proper assertion when JWKs URI is set",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeysURI: ts.URL, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r: new(http.Request),
@@ -312,11 +312,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because client_assertion sub does not match client",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "not-bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -325,11 +325,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because client_assertion iss does not match client",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "not-bar",
 				"jti": "12345",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -338,11 +338,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because client_assertion jti is not set",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"aud": "token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
 			expectErr: ErrInvalidClient,
@@ -350,11 +350,11 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			d:      "should fail because client_assertion aud is not set",
 			client: &DefaultOpenIDConnectClient{DefaultClient: &DefaultClient{ID: "bar", Secret: barSecret}, JSONWebKeys: jwks, TokenEndpointAuthMethod: "private_key_jwt"},
 			form: url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
 				"sub": "bar",
-				"exp": time.Now().Add(time.Hour),
+				"exp": time.Now().Add(time.Hour).Unix(),
 				"iss": "bar",
 				"jti": "12345",
 				"aud": "not-token-url",
 			}, key, "kid-foo")}, "client_assertion_type": []string{at}},
 			r:         new(http.Request),
@@ -383,5 +383,55 @@ func TestAuthenticateClient(t *testing.T) {
 			require.NoError(t, err)
 			assert.EqualValues(t, tc.client, c)
 		})
 	}
 }
+
+func TestAuthenticateClientTwice(t *testing.T) {
+	const at = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+
+	key := internal.MustRSAKey()
+	client := &DefaultOpenIDConnectClient{
+		DefaultClient: &DefaultClient{
+			ID:     "bar",
+			Secret: []byte("secret"),
+		},
+		JSONWebKeys: &jose.JSONWebKeySet{
+			Keys: []jose.JSONWebKey{
+				{
+					KeyID: "kid-foo",
+					Use:   "sig",
+					Key:   &key.PublicKey,
+				},
+			},
+		},
+		TokenEndpointAuthMethod: "private_key_jwt",
+	}
+	store := storage.NewMemoryStore()
+	store.Clients[client.ID] = client
+
+	hasher := &BCrypt{WorkFactor: 6}
+	f := &Fosite{
+		JWKSFetcherStrategy: NewDefaultJWKSFetcherStrategy(),
+		Store:               store,
+		Hasher:              hasher,
+		TokenURL:            "token-url",
+	}
+
+	formValues := url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
+		"sub": "bar",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iss": "bar",
+		"jti": "12345",
+		"aud": "token-url",
+	}, key, "kid-foo")}, "client_assertion_type": []string{at}}
+
+	c, err := f.AuthenticateClient(nil, new(http.Request), formValues)
+	require.NoError(t, err, "%#v", err)
+	assert.Equal(t, client, c)
+
+	// replay the request and expect it to fail
+	c, err = f.AuthenticateClient(nil, new(http.Request), formValues)
+	require.Error(t, err)
+	assert.EqualError(t, err, ErrJTIKnown.Error())
+	assert.Nil(t, c)
+}
diff --git a/client_manager.go b/client_manager.go
index ed63a30..d5f4817 100644
--- a/client_manager.go
+++ b/client_manager.go
@@ -19,13 +19,24 @@
  *
  */
 
 package fosite
 
-import "context"
+import (
+	"context"
+	"time"
+)
 
 // ClientManager defines the (persistent) manager interface for clients.
 type ClientManager interface {
 	// GetClient loads the client by its ID or returns an error
 	// if the client does not exist or another error occurred.
 	GetClient(ctx context.Context, id string) (Client, error)
+	// ClientAssertionJWTValid returns an error if the JTI is
+	// known or the DB check failed and nil if the JTI is not known.
+	ClientAssertionJWTValid(ctx context.Context, jti string) error
+	// SetClientAssertionJWT marks a JTI as known for the given
+	// expiry time. Before inserting the new JTI, it will clean
+	// up any existing JTIs that have expired as those tokens can
+	// not be replayed due to the expiry.
+	SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error
 }
diff --git a/errors.go b/errors.go
index 98e6ab1..9c26d99 100644
--- a/errors.go
+++ b/errors.go
@@ -204,10 +204,15 @@ var (
 	ErrInvalidRequestObject = &RFC6749Error{
 		Description: "The request parameter contains an invalid Request Object. ",
 		Name:        errInvalidRequestObject,
 		Code:        http.StatusBadRequest,
 	}
+	ErrJTIKnown = &RFC6749Error{
+		Description: "The jti was already used.",
+		Name:        errJTIKnownName,
+		Code:        http.StatusBadRequest,
+	}
 )
 
 const (
 	errInvalidRequestURI            = "invalid_request_uri"
 	errInvalidRequestObject         = "invalid_request_object"
@@ -240,10 +245,11 @@ const (
 	errUnknownErrorName             = "error"
 	errRevokationClientMismatchName = "revokation_client_mismatch"
 	errRequestNotSupportedName      = "request_not_supported"
 	errRequestURINotSupportedName   = "request_uri_not_supported"
 	errRegistrationNotSupportedName = "registration_not_supported"
+	errJTIKnownName                 = "jti_known"
 )
 
 func ErrorToRFC6749Error(err error) *RFC6749Error {
 	if e, ok := err.(*RFC6749Error); ok {
 		return e
diff --git a/go.mod b/go.mod
index 5d4d355..81a0a64 100644
--- a/go.mod
+++ b/go.mod
@@ -3,11 +3,11 @@ module github.com/ory/fosite
 require (
 	github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/elazarl/goproxy v0.0.0-20181003060214-f58a169a71a5 // indirect
-	github.com/golang/mock v1.1.1
+	github.com/golang/mock v1.4.3
 	github.com/gopherjs/gopherjs v0.0.0-20181004151105-1babbf986f6f // indirect
 	github.com/gorilla/context v1.1.1 // indirect
 	github.com/gorilla/mux v1.6.2
 	github.com/jtolds/gls v4.2.1+incompatible // indirect
 	github.com/magiconair/properties v1.8.0
@@ -20,14 +20,12 @@ require (
 	github.com/pkg/errors v0.8.0
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d // indirect
 	github.com/smartystreets/goconvey v0.0.0-20180222194500-ef6db91d284a // indirect
 	github.com/stretchr/testify v1.2.2
-	golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4
-	golang.org/x/net v0.0.0-20181005035420-146acd28ed58 // indirect
+	golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
 	golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced
-	golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f // indirect
 	google.golang.org/appengine v1.2.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.1.9
 )
 
 go 1.13
diff --git a/go.sum b/go.sum
index 03426cb..bcf6f3c 100644
--- a/go.sum
+++ b/go.sum
@@ -6,10 +6,12 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumC
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/elazarl/goproxy v0.0.0-20181003060214-f58a169a71a5 h1:LCoguo7Zd0MByKMbQbTvcZw7HiBcbvew+MOcwsJVwrY=
 github.com/elazarl/goproxy v0.0.0-20181003060214-f58a169a71a5/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/golang/mock v1.1.1 h1:G5FRp8JnTd7RQH5kemVNlMeyXQAztQ3mOWV95KxsXH8=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.4.3 h1:GV+pQPG/EUUbkh47niozDcADz6go/dUwhVzdUQHIVRw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/uuid v1.0.0 h1:b4Gk+7WdP/d3HZH8EJsZpvV7EtDOgaZLtnaNGIu1adA=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181004151105-1babbf986f6f h1:JJ2EP5vV3LAD2U1CxQtD7PTOO15Y96kXmKDz7TjxGHs=
@@ -44,17 +46,28 @@ github.com/smartystreets/goconvey v0.0.0-20180222194500-ef6db91d284a h1:JSvGDIbm
 github.com/smartystreets/goconvey v0.0.0-20180222194500-ef6db91d284a/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
 github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4 h1:Vk3wNqEZwyGyei9yq5ekj7frek2u7HUfffJ1/opblzc=
 golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181005035420-146acd28ed58 h1:otZG8yDCO4LVps5+9bxOeNiCvgmOyt96J3roHTYs7oE=
 golang.org/x/net v0.0.0-20181005035420-146acd28ed58/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced h1:4oqSq7eft7MdPKBGQK11X9WYUxmj6ZLgGTqYIbY1kyw=
 golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262 h1:qsl9y/CJx34tuA7QCPNp86JNJe4spst6Ff8MjvPUdPg=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 google.golang.org/appengine v1.2.0 h1:S0iUepdCWODXRvtE+gcRDd15L+k+k1AiHlMiMjefH24=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 gopkg.in/square/go-jose.v2 v2.1.9 h1:YCFbL5T2gbmC2sMG12s1x2PAlTK5TZNte3hjZEIcCAg=
 gopkg.in/square/go-jose.v2 v2.1.9/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/handler/oauth2/flow_refresh.go b/handler/oauth2/flow_refresh.go
index b5d91c7..33a2967 100644
--- a/handler/oauth2/flow_refresh.go
+++ b/handler/oauth2/flow_refresh.go
@@ -25,13 +25,14 @@ import (
 	"context"
 	"fmt"
 	"strings"
 	"time"
 
+	"github.com/pkg/errors"
+
 	"github.com/ory/fosite"
 	"github.com/ory/fosite/storage"
-	"github.com/pkg/errors"
 )
 
 type RefreshTokenGrantHandler struct {
 	AccessTokenStrategy    AccessTokenStrategy
 	RefreshTokenStrategy   RefreshTokenStrategy
diff --git a/internal/access_request.go b/internal/access_request.go
index e8b2397..db31726 100644
--- a/internal/access_request.go
+++ b/internal/access_request.go
@@ -37,214 +37,252 @@ func (m *MockAccessRequester) EXPECT() *MockAccessRequesterMockRecorder {
 	return m.recorder
 }
 
 // AppendRequestedScope mocks base method
 func (m *MockAccessRequester) AppendRequestedScope(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "AppendRequestedScope", arg0)
 }
 
 // AppendRequestedScope indicates an expected call of AppendRequestedScope
 func (mr *MockAccessRequesterMockRecorder) AppendRequestedScope(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AppendRequestedScope", reflect.TypeOf((*MockAccessRequester)(nil).AppendRequestedScope), arg0)
 }
 
 // GetClient mocks base method
 func (m *MockAccessRequester) GetClient() fosite.Client {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetClient")
 	ret0, _ := ret[0].(fosite.Client)
 	return ret0
 }
 
 // GetClient indicates an expected call of GetClient
 func (mr *MockAccessRequesterMockRecorder) GetClient() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClient", reflect.TypeOf((*MockAccessRequester)(nil).GetClient))
 }
 
 // GetGrantTypes mocks base method
 func (m *MockAccessRequester) GetGrantTypes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantTypes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantTypes indicates an expected call of GetGrantTypes
 func (mr *MockAccessRequesterMockRecorder) GetGrantTypes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantTypes", reflect.TypeOf((*MockAccessRequester)(nil).GetGrantTypes))
 }
 
 // GetGrantedAudience mocks base method
 func (m *MockAccessRequester) GetGrantedAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantedAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantedAudience indicates an expected call of GetGrantedAudience
 func (mr *MockAccessRequesterMockRecorder) GetGrantedAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantedAudience", reflect.TypeOf((*MockAccessRequester)(nil).GetGrantedAudience))
 }
 
 // GetGrantedScopes mocks base method
 func (m *MockAccessRequester) GetGrantedScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantedScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantedScopes indicates an expected call of GetGrantedScopes
 func (mr *MockAccessRequesterMockRecorder) GetGrantedScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantedScopes", reflect.TypeOf((*MockAccessRequester)(nil).GetGrantedScopes))
 }
 
 // GetID mocks base method
 func (m *MockAccessRequester) GetID() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetID")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetID indicates an expected call of GetID
 func (mr *MockAccessRequesterMockRecorder) GetID() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetID", reflect.TypeOf((*MockAccessRequester)(nil).GetID))
 }
 
 // GetRequestForm mocks base method
 func (m *MockAccessRequester) GetRequestForm() url.Values {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestForm")
 	ret0, _ := ret[0].(url.Values)
 	return ret0
 }
 
 // GetRequestForm indicates an expected call of GetRequestForm
 func (mr *MockAccessRequesterMockRecorder) GetRequestForm() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestForm", reflect.TypeOf((*MockAccessRequester)(nil).GetRequestForm))
 }
 
 // GetRequestedAt mocks base method
 func (m *MockAccessRequester) GetRequestedAt() time.Time {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedAt")
 	ret0, _ := ret[0].(time.Time)
 	return ret0
 }
 
 // GetRequestedAt indicates an expected call of GetRequestedAt
 func (mr *MockAccessRequesterMockRecorder) GetRequestedAt() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedAt", reflect.TypeOf((*MockAccessRequester)(nil).GetRequestedAt))
 }
 
 // GetRequestedAudience mocks base method
 func (m *MockAccessRequester) GetRequestedAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetRequestedAudience indicates an expected call of GetRequestedAudience
 func (mr *MockAccessRequesterMockRecorder) GetRequestedAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedAudience", reflect.TypeOf((*MockAccessRequester)(nil).GetRequestedAudience))
 }
 
 // GetRequestedScopes mocks base method
 func (m *MockAccessRequester) GetRequestedScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetRequestedScopes indicates an expected call of GetRequestedScopes
 func (mr *MockAccessRequesterMockRecorder) GetRequestedScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedScopes", reflect.TypeOf((*MockAccessRequester)(nil).GetRequestedScopes))
 }
 
 // GetSession mocks base method
 func (m *MockAccessRequester) GetSession() fosite.Session {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetSession")
 	ret0, _ := ret[0].(fosite.Session)
 	return ret0
 }
 
 // GetSession indicates an expected call of GetSession
 func (mr *MockAccessRequesterMockRecorder) GetSession() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSession", reflect.TypeOf((*MockAccessRequester)(nil).GetSession))
 }
 
 // GrantAudience mocks base method
 func (m *MockAccessRequester) GrantAudience(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "GrantAudience", arg0)
 }
 
 // GrantAudience indicates an expected call of GrantAudience
 func (mr *MockAccessRequesterMockRecorder) GrantAudience(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantAudience", reflect.TypeOf((*MockAccessRequester)(nil).GrantAudience), arg0)
 }
 
 // GrantScope mocks base method
 func (m *MockAccessRequester) GrantScope(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "GrantScope", arg0)
 }
 
 // GrantScope indicates an expected call of GrantScope
 func (mr *MockAccessRequesterMockRecorder) GrantScope(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantScope", reflect.TypeOf((*MockAccessRequester)(nil).GrantScope), arg0)
 }
 
 // Merge mocks base method
 func (m *MockAccessRequester) Merge(arg0 fosite.Requester) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "Merge", arg0)
 }
 
 // Merge indicates an expected call of Merge
 func (mr *MockAccessRequesterMockRecorder) Merge(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Merge", reflect.TypeOf((*MockAccessRequester)(nil).Merge), arg0)
 }
 
 // Sanitize mocks base method
 func (m *MockAccessRequester) Sanitize(arg0 []string) fosite.Requester {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Sanitize", arg0)
 	ret0, _ := ret[0].(fosite.Requester)
 	return ret0
 }
 
 // Sanitize indicates an expected call of Sanitize
 func (mr *MockAccessRequesterMockRecorder) Sanitize(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Sanitize", reflect.TypeOf((*MockAccessRequester)(nil).Sanitize), arg0)
 }
 
 // SetID mocks base method
 func (m *MockAccessRequester) SetID(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetID", arg0)
 }
 
 // SetID indicates an expected call of SetID
 func (mr *MockAccessRequesterMockRecorder) SetID(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetID", reflect.TypeOf((*MockAccessRequester)(nil).SetID), arg0)
 }
 
 // SetRequestedAudience mocks base method
 func (m *MockAccessRequester) SetRequestedAudience(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetRequestedAudience", arg0)
 }
 
 // SetRequestedAudience indicates an expected call of SetRequestedAudience
 func (mr *MockAccessRequesterMockRecorder) SetRequestedAudience(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRequestedAudience", reflect.TypeOf((*MockAccessRequester)(nil).SetRequestedAudience), arg0)
 }
 
 // SetRequestedScopes mocks base method
 func (m *MockAccessRequester) SetRequestedScopes(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetRequestedScopes", arg0)
 }
 
 // SetRequestedScopes indicates an expected call of SetRequestedScopes
 func (mr *MockAccessRequesterMockRecorder) SetRequestedScopes(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRequestedScopes", reflect.TypeOf((*MockAccessRequester)(nil).SetRequestedScopes), arg0)
 }
 
 // SetSession mocks base method
 func (m *MockAccessRequester) SetSession(arg0 fosite.Session) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetSession", arg0)
 }
 
 // SetSession indicates an expected call of SetSession
 func (mr *MockAccessRequesterMockRecorder) SetSession(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetSession", reflect.TypeOf((*MockAccessRequester)(nil).SetSession), arg0)
 }
diff --git a/internal/access_response.go b/internal/access_response.go
index f258b05..f1fd113 100644
--- a/internal/access_response.go
+++ b/internal/access_response.go
@@ -36,100 +36,118 @@ func (m *MockAccessResponder) EXPECT() *MockAccessResponderMockRecorder {
 	return m.recorder
 }
 
 // GetAccessToken mocks base method
 func (m *MockAccessResponder) GetAccessToken() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccessToken")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetAccessToken indicates an expected call of GetAccessToken
 func (mr *MockAccessResponderMockRecorder) GetAccessToken() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccessToken", reflect.TypeOf((*MockAccessResponder)(nil).GetAccessToken))
 }
 
 // GetExtra mocks base method
 func (m *MockAccessResponder) GetExtra(arg0 string) interface{} {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetExtra", arg0)
 	ret0, _ := ret[0].(interface{})
 	return ret0
 }
 
 // GetExtra indicates an expected call of GetExtra
 func (mr *MockAccessResponderMockRecorder) GetExtra(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExtra", reflect.TypeOf((*MockAccessResponder)(nil).GetExtra), arg0)
 }
 
 // GetTokenType mocks base method
 func (m *MockAccessResponder) GetTokenType() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetTokenType")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetTokenType indicates an expected call of GetTokenType
 func (mr *MockAccessResponderMockRecorder) GetTokenType() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTokenType", reflect.TypeOf((*MockAccessResponder)(nil).GetTokenType))
 }
 
 // SetAccessToken mocks base method
 func (m *MockAccessResponder) SetAccessToken(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetAccessToken", arg0)
 }
 
 // SetAccessToken indicates an expected call of SetAccessToken
 func (mr *MockAccessResponderMockRecorder) SetAccessToken(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetAccessToken", reflect.TypeOf((*MockAccessResponder)(nil).SetAccessToken), arg0)
 }
 
 // SetExpiresIn mocks base method
 func (m *MockAccessResponder) SetExpiresIn(arg0 time.Duration) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetExpiresIn", arg0)
 }
 
 // SetExpiresIn indicates an expected call of SetExpiresIn
 func (mr *MockAccessResponderMockRecorder) SetExpiresIn(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetExpiresIn", reflect.TypeOf((*MockAccessResponder)(nil).SetExpiresIn), arg0)
 }
 
 // SetExtra mocks base method
 func (m *MockAccessResponder) SetExtra(arg0 string, arg1 interface{}) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetExtra", arg0, arg1)
 }
 
 // SetExtra indicates an expected call of SetExtra
 func (mr *MockAccessResponderMockRecorder) SetExtra(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetExtra", reflect.TypeOf((*MockAccessResponder)(nil).SetExtra), arg0, arg1)
 }
 
 // SetScopes mocks base method
 func (m *MockAccessResponder) SetScopes(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetScopes", arg0)
 }
 
 // SetScopes indicates an expected call of SetScopes
 func (mr *MockAccessResponderMockRecorder) SetScopes(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetScopes", reflect.TypeOf((*MockAccessResponder)(nil).SetScopes), arg0)
 }
 
 // SetTokenType mocks base method
 func (m *MockAccessResponder) SetTokenType(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetTokenType", arg0)
 }
 
 // SetTokenType indicates an expected call of SetTokenType
 func (mr *MockAccessResponderMockRecorder) SetTokenType(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetTokenType", reflect.TypeOf((*MockAccessResponder)(nil).SetTokenType), arg0)
 }
 
 // ToMap mocks base method
 func (m *MockAccessResponder) ToMap() map[string]interface{} {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ToMap")
 	ret0, _ := ret[0].(map[string]interface{})
 	return ret0
 }
 
 // ToMap indicates an expected call of ToMap
 func (mr *MockAccessResponderMockRecorder) ToMap() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ToMap", reflect.TypeOf((*MockAccessResponder)(nil).ToMap))
 }
diff --git a/internal/access_token_storage.go b/internal/access_token_storage.go
index 0e91a82..749ba7f 100644
--- a/internal/access_token_storage.go
+++ b/internal/access_token_storage.go
@@ -36,39 +36,45 @@ func (m *MockAccessTokenStorage) EXPECT() *MockAccessTokenStorageMockRecorder {
 	return m.recorder
 }
 
 // CreateAccessTokenSession mocks base method
 func (m *MockAccessTokenStorage) CreateAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAccessTokenSession indicates an expected call of CreateAccessTokenSession
 func (mr *MockAccessTokenStorageMockRecorder) CreateAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessTokenSession", reflect.TypeOf((*MockAccessTokenStorage)(nil).CreateAccessTokenSession), arg0, arg1, arg2)
 }
 
 // DeleteAccessTokenSession mocks base method
 func (m *MockAccessTokenStorage) DeleteAccessTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteAccessTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteAccessTokenSession indicates an expected call of DeleteAccessTokenSession
 func (mr *MockAccessTokenStorageMockRecorder) DeleteAccessTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccessTokenSession", reflect.TypeOf((*MockAccessTokenStorage)(nil).DeleteAccessTokenSession), arg0, arg1)
 }
 
 // GetAccessTokenSession mocks base method
 func (m *MockAccessTokenStorage) GetAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccessTokenSession indicates an expected call of GetAccessTokenSession
 func (mr *MockAccessTokenStorageMockRecorder) GetAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccessTokenSession", reflect.TypeOf((*MockAccessTokenStorage)(nil).GetAccessTokenSession), arg0, arg1, arg2)
 }
diff --git a/internal/access_token_strategy.go b/internal/access_token_strategy.go
index 3cdba07..f53c1d7 100644
--- a/internal/access_token_strategy.go
+++ b/internal/access_token_strategy.go
@@ -36,40 +36,46 @@ func (m *MockAccessTokenStrategy) EXPECT() *MockAccessTokenStrategyMockRecorder
 	return m.recorder
 }
 
 // AccessTokenSignature mocks base method
 func (m *MockAccessTokenStrategy) AccessTokenSignature(arg0 string) string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "AccessTokenSignature", arg0)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // AccessTokenSignature indicates an expected call of AccessTokenSignature
 func (mr *MockAccessTokenStrategyMockRecorder) AccessTokenSignature(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AccessTokenSignature", reflect.TypeOf((*MockAccessTokenStrategy)(nil).AccessTokenSignature), arg0)
 }
 
 // GenerateAccessToken mocks base method
 func (m *MockAccessTokenStrategy) GenerateAccessToken(arg0 context.Context, arg1 fosite.Requester) (string, string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateAccessToken", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(string)
 	ret2, _ := ret[2].(error)
 	return ret0, ret1, ret2
 }
 
 // GenerateAccessToken indicates an expected call of GenerateAccessToken
 func (mr *MockAccessTokenStrategyMockRecorder) GenerateAccessToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateAccessToken", reflect.TypeOf((*MockAccessTokenStrategy)(nil).GenerateAccessToken), arg0, arg1)
 }
 
 // ValidateAccessToken mocks base method
 func (m *MockAccessTokenStrategy) ValidateAccessToken(arg0 context.Context, arg1 fosite.Requester, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ValidateAccessToken", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateAccessToken indicates an expected call of ValidateAccessToken
 func (mr *MockAccessTokenStrategyMockRecorder) ValidateAccessToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateAccessToken", reflect.TypeOf((*MockAccessTokenStrategy)(nil).ValidateAccessToken), arg0, arg1, arg2)
 }
diff --git a/internal/authorize_code_storage.go b/internal/authorize_code_storage.go
index 80afbba..2fa8d4f 100644
--- a/internal/authorize_code_storage.go
+++ b/internal/authorize_code_storage.go
@@ -36,39 +36,45 @@ func (m *MockAuthorizeCodeStorage) EXPECT() *MockAuthorizeCodeStorageMockRecorde
 	return m.recorder
 }
 
 // CreateAuthorizeCodeSession mocks base method
 func (m *MockAuthorizeCodeStorage) CreateAuthorizeCodeSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAuthorizeCodeSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAuthorizeCodeSession indicates an expected call of CreateAuthorizeCodeSession
 func (mr *MockAuthorizeCodeStorageMockRecorder) CreateAuthorizeCodeSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAuthorizeCodeSession", reflect.TypeOf((*MockAuthorizeCodeStorage)(nil).CreateAuthorizeCodeSession), arg0, arg1, arg2)
 }
 
 // GetAuthorizeCodeSession mocks base method
 func (m *MockAuthorizeCodeStorage) GetAuthorizeCodeSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAuthorizeCodeSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAuthorizeCodeSession indicates an expected call of GetAuthorizeCodeSession
 func (mr *MockAuthorizeCodeStorageMockRecorder) GetAuthorizeCodeSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAuthorizeCodeSession", reflect.TypeOf((*MockAuthorizeCodeStorage)(nil).GetAuthorizeCodeSession), arg0, arg1, arg2)
 }
 
 // InvalidateAuthorizeCodeSession mocks base method
 func (m *MockAuthorizeCodeStorage) InvalidateAuthorizeCodeSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "InvalidateAuthorizeCodeSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // InvalidateAuthorizeCodeSession indicates an expected call of InvalidateAuthorizeCodeSession
 func (mr *MockAuthorizeCodeStorageMockRecorder) InvalidateAuthorizeCodeSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InvalidateAuthorizeCodeSession", reflect.TypeOf((*MockAuthorizeCodeStorage)(nil).InvalidateAuthorizeCodeSession), arg0, arg1)
 }
diff --git a/internal/authorize_code_strategy.go b/internal/authorize_code_strategy.go
index f7244ff..cbd406b 100644
--- a/internal/authorize_code_strategy.go
+++ b/internal/authorize_code_strategy.go
@@ -36,40 +36,46 @@ func (m *MockAuthorizeCodeStrategy) EXPECT() *MockAuthorizeCodeStrategyMockRecor
 	return m.recorder
 }
 
 // AuthorizeCodeSignature mocks base method
 func (m *MockAuthorizeCodeStrategy) AuthorizeCodeSignature(arg0 string) string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "AuthorizeCodeSignature", arg0)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // AuthorizeCodeSignature indicates an expected call of AuthorizeCodeSignature
 func (mr *MockAuthorizeCodeStrategyMockRecorder) AuthorizeCodeSignature(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthorizeCodeSignature", reflect.TypeOf((*MockAuthorizeCodeStrategy)(nil).AuthorizeCodeSignature), arg0)
 }
 
 // GenerateAuthorizeCode mocks base method
 func (m *MockAuthorizeCodeStrategy) GenerateAuthorizeCode(arg0 context.Context, arg1 fosite.Requester) (string, string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateAuthorizeCode", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(string)
 	ret2, _ := ret[2].(error)
 	return ret0, ret1, ret2
 }
 
 // GenerateAuthorizeCode indicates an expected call of GenerateAuthorizeCode
 func (mr *MockAuthorizeCodeStrategyMockRecorder) GenerateAuthorizeCode(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateAuthorizeCode", reflect.TypeOf((*MockAuthorizeCodeStrategy)(nil).GenerateAuthorizeCode), arg0, arg1)
 }
 
 // ValidateAuthorizeCode mocks base method
 func (m *MockAuthorizeCodeStrategy) ValidateAuthorizeCode(arg0 context.Context, arg1 fosite.Requester, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ValidateAuthorizeCode", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateAuthorizeCode indicates an expected call of ValidateAuthorizeCode
 func (mr *MockAuthorizeCodeStrategyMockRecorder) ValidateAuthorizeCode(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateAuthorizeCode", reflect.TypeOf((*MockAuthorizeCodeStrategy)(nil).ValidateAuthorizeCode), arg0, arg1, arg2)
 }
diff --git a/internal/authorize_handler.go b/internal/authorize_handler.go
index 15b8368..330997e 100644
--- a/internal/authorize_handler.go
+++ b/internal/authorize_handler.go
@@ -36,14 +36,16 @@ func (m *MockAuthorizeEndpointHandler) EXPECT() *MockAuthorizeEndpointHandlerMoc
 	return m.recorder
 }
 
 // HandleAuthorizeEndpointRequest mocks base method
 func (m *MockAuthorizeEndpointHandler) HandleAuthorizeEndpointRequest(arg0 context.Context, arg1 fosite.AuthorizeRequester, arg2 fosite.AuthorizeResponder) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "HandleAuthorizeEndpointRequest", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // HandleAuthorizeEndpointRequest indicates an expected call of HandleAuthorizeEndpointRequest
 func (mr *MockAuthorizeEndpointHandlerMockRecorder) HandleAuthorizeEndpointRequest(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleAuthorizeEndpointRequest", reflect.TypeOf((*MockAuthorizeEndpointHandler)(nil).HandleAuthorizeEndpointRequest), arg0, arg1, arg2)
 }
diff --git a/internal/authorize_request.go b/internal/authorize_request.go
index 87925e8..ee88913 100644
--- a/internal/authorize_request.go
+++ b/internal/authorize_request.go
@@ -37,272 +37,320 @@ func (m *MockAuthorizeRequester) EXPECT() *MockAuthorizeRequesterMockRecorder {
 	return m.recorder
 }
 
 // AppendRequestedScope mocks base method
 func (m *MockAuthorizeRequester) AppendRequestedScope(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "AppendRequestedScope", arg0)
 }
 
 // AppendRequestedScope indicates an expected call of AppendRequestedScope
 func (mr *MockAuthorizeRequesterMockRecorder) AppendRequestedScope(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AppendRequestedScope", reflect.TypeOf((*MockAuthorizeRequester)(nil).AppendRequestedScope), arg0)
 }
 
 // DidHandleAllResponseTypes mocks base method
 func (m *MockAuthorizeRequester) DidHandleAllResponseTypes() bool {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DidHandleAllResponseTypes")
 	ret0, _ := ret[0].(bool)
 	return ret0
 }
 
 // DidHandleAllResponseTypes indicates an expected call of DidHandleAllResponseTypes
 func (mr *MockAuthorizeRequesterMockRecorder) DidHandleAllResponseTypes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DidHandleAllResponseTypes", reflect.TypeOf((*MockAuthorizeRequester)(nil).DidHandleAllResponseTypes))
 }
 
 // GetClient mocks base method
 func (m *MockAuthorizeRequester) GetClient() fosite.Client {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetClient")
 	ret0, _ := ret[0].(fosite.Client)
 	return ret0
 }
 
 // GetClient indicates an expected call of GetClient
 func (mr *MockAuthorizeRequesterMockRecorder) GetClient() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClient", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetClient))
 }
 
 // GetGrantedAudience mocks base method
 func (m *MockAuthorizeRequester) GetGrantedAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantedAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantedAudience indicates an expected call of GetGrantedAudience
 func (mr *MockAuthorizeRequesterMockRecorder) GetGrantedAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantedAudience", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetGrantedAudience))
 }
 
 // GetGrantedScopes mocks base method
 func (m *MockAuthorizeRequester) GetGrantedScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantedScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantedScopes indicates an expected call of GetGrantedScopes
 func (mr *MockAuthorizeRequesterMockRecorder) GetGrantedScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantedScopes", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetGrantedScopes))
 }
 
 // GetID mocks base method
 func (m *MockAuthorizeRequester) GetID() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetID")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetID indicates an expected call of GetID
 func (mr *MockAuthorizeRequesterMockRecorder) GetID() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetID", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetID))
 }
 
 // GetRedirectURI mocks base method
 func (m *MockAuthorizeRequester) GetRedirectURI() *url.URL {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRedirectURI")
 	ret0, _ := ret[0].(*url.URL)
 	return ret0
 }
 
 // GetRedirectURI indicates an expected call of GetRedirectURI
 func (mr *MockAuthorizeRequesterMockRecorder) GetRedirectURI() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRedirectURI", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetRedirectURI))
 }
 
 // GetRequestForm mocks base method
 func (m *MockAuthorizeRequester) GetRequestForm() url.Values {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestForm")
 	ret0, _ := ret[0].(url.Values)
 	return ret0
 }
 
 // GetRequestForm indicates an expected call of GetRequestForm
 func (mr *MockAuthorizeRequesterMockRecorder) GetRequestForm() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestForm", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetRequestForm))
 }
 
 // GetRequestedAt mocks base method
 func (m *MockAuthorizeRequester) GetRequestedAt() time.Time {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedAt")
 	ret0, _ := ret[0].(time.Time)
 	return ret0
 }
 
 // GetRequestedAt indicates an expected call of GetRequestedAt
 func (mr *MockAuthorizeRequesterMockRecorder) GetRequestedAt() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedAt", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetRequestedAt))
 }
 
 // GetRequestedAudience mocks base method
 func (m *MockAuthorizeRequester) GetRequestedAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetRequestedAudience indicates an expected call of GetRequestedAudience
 func (mr *MockAuthorizeRequesterMockRecorder) GetRequestedAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedAudience", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetRequestedAudience))
 }
 
 // GetRequestedScopes mocks base method
 func (m *MockAuthorizeRequester) GetRequestedScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetRequestedScopes indicates an expected call of GetRequestedScopes
 func (mr *MockAuthorizeRequesterMockRecorder) GetRequestedScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedScopes", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetRequestedScopes))
 }
 
 // GetResponseTypes mocks base method
 func (m *MockAuthorizeRequester) GetResponseTypes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetResponseTypes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetResponseTypes indicates an expected call of GetResponseTypes
 func (mr *MockAuthorizeRequesterMockRecorder) GetResponseTypes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetResponseTypes", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetResponseTypes))
 }
 
 // GetSession mocks base method
 func (m *MockAuthorizeRequester) GetSession() fosite.Session {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetSession")
 	ret0, _ := ret[0].(fosite.Session)
 	return ret0
 }
 
 // GetSession indicates an expected call of GetSession
 func (mr *MockAuthorizeRequesterMockRecorder) GetSession() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSession", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetSession))
 }
 
 // GetState mocks base method
 func (m *MockAuthorizeRequester) GetState() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetState")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetState indicates an expected call of GetState
 func (mr *MockAuthorizeRequesterMockRecorder) GetState() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetState", reflect.TypeOf((*MockAuthorizeRequester)(nil).GetState))
 }
 
 // GrantAudience mocks base method
 func (m *MockAuthorizeRequester) GrantAudience(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "GrantAudience", arg0)
 }
 
 // GrantAudience indicates an expected call of GrantAudience
 func (mr *MockAuthorizeRequesterMockRecorder) GrantAudience(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantAudience", reflect.TypeOf((*MockAuthorizeRequester)(nil).GrantAudience), arg0)
 }
 
 // GrantScope mocks base method
 func (m *MockAuthorizeRequester) GrantScope(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "GrantScope", arg0)
 }
 
 // GrantScope indicates an expected call of GrantScope
 func (mr *MockAuthorizeRequesterMockRecorder) GrantScope(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantScope", reflect.TypeOf((*MockAuthorizeRequester)(nil).GrantScope), arg0)
 }
 
 // IsRedirectURIValid mocks base method
 func (m *MockAuthorizeRequester) IsRedirectURIValid() bool {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "IsRedirectURIValid")
 	ret0, _ := ret[0].(bool)
 	return ret0
 }
 
 // IsRedirectURIValid indicates an expected call of IsRedirectURIValid
 func (mr *MockAuthorizeRequesterMockRecorder) IsRedirectURIValid() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsRedirectURIValid", reflect.TypeOf((*MockAuthorizeRequester)(nil).IsRedirectURIValid))
 }
 
 // Merge mocks base method
 func (m *MockAuthorizeRequester) Merge(arg0 fosite.Requester) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "Merge", arg0)
 }
 
 // Merge indicates an expected call of Merge
 func (mr *MockAuthorizeRequesterMockRecorder) Merge(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Merge", reflect.TypeOf((*MockAuthorizeRequester)(nil).Merge), arg0)
 }
 
 // Sanitize mocks base method
 func (m *MockAuthorizeRequester) Sanitize(arg0 []string) fosite.Requester {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Sanitize", arg0)
 	ret0, _ := ret[0].(fosite.Requester)
 	return ret0
 }
 
 // Sanitize indicates an expected call of Sanitize
 func (mr *MockAuthorizeRequesterMockRecorder) Sanitize(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Sanitize", reflect.TypeOf((*MockAuthorizeRequester)(nil).Sanitize), arg0)
 }
 
 // SetID mocks base method
 func (m *MockAuthorizeRequester) SetID(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetID", arg0)
 }
 
 // SetID indicates an expected call of SetID
 func (mr *MockAuthorizeRequesterMockRecorder) SetID(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetID", reflect.TypeOf((*MockAuthorizeRequester)(nil).SetID), arg0)
 }
 
 // SetRequestedAudience mocks base method
 func (m *MockAuthorizeRequester) SetRequestedAudience(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetRequestedAudience", arg0)
 }
 
 // SetRequestedAudience indicates an expected call of SetRequestedAudience
 func (mr *MockAuthorizeRequesterMockRecorder) SetRequestedAudience(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRequestedAudience", reflect.TypeOf((*MockAuthorizeRequester)(nil).SetRequestedAudience), arg0)
 }
 
 // SetRequestedScopes mocks base method
 func (m *MockAuthorizeRequester) SetRequestedScopes(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetRequestedScopes", arg0)
 }
 
 // SetRequestedScopes indicates an expected call of SetRequestedScopes
 func (mr *MockAuthorizeRequesterMockRecorder) SetRequestedScopes(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRequestedScopes", reflect.TypeOf((*MockAuthorizeRequester)(nil).SetRequestedScopes), arg0)
 }
 
 // SetResponseTypeHandled mocks base method
 func (m *MockAuthorizeRequester) SetResponseTypeHandled(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetResponseTypeHandled", arg0)
 }
 
 // SetResponseTypeHandled indicates an expected call of SetResponseTypeHandled
 func (mr *MockAuthorizeRequesterMockRecorder) SetResponseTypeHandled(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetResponseTypeHandled", reflect.TypeOf((*MockAuthorizeRequester)(nil).SetResponseTypeHandled), arg0)
 }
 
 // SetSession mocks base method
 func (m *MockAuthorizeRequester) SetSession(arg0 fosite.Session) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetSession", arg0)
 }
 
 // SetSession indicates an expected call of SetSession
 func (mr *MockAuthorizeRequesterMockRecorder) SetSession(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetSession", reflect.TypeOf((*MockAuthorizeRequester)(nil).SetSession), arg0)
 }
diff --git a/internal/authorize_response.go b/internal/authorize_response.go
index 1f88977..6cde26f 100644
--- a/internal/authorize_response.go
+++ b/internal/authorize_response.go
@@ -35,80 +35,94 @@ func (m *MockAuthorizeResponder) EXPECT() *MockAuthorizeResponderMockRecorder {
 	return m.recorder
 }
 
 // AddFragment mocks base method
 func (m *MockAuthorizeResponder) AddFragment(arg0, arg1 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "AddFragment", arg0, arg1)
 }
 
 // AddFragment indicates an expected call of AddFragment
 func (mr *MockAuthorizeResponderMockRecorder) AddFragment(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddFragment", reflect.TypeOf((*MockAuthorizeResponder)(nil).AddFragment), arg0, arg1)
 }
 
 // AddHeader mocks base method
 func (m *MockAuthorizeResponder) AddHeader(arg0, arg1 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "AddHeader", arg0, arg1)
 }
 
 // AddHeader indicates an expected call of AddHeader
 func (mr *MockAuthorizeResponderMockRecorder) AddHeader(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddHeader", reflect.TypeOf((*MockAuthorizeResponder)(nil).AddHeader), arg0, arg1)
 }
 
 // AddQuery mocks base method
 func (m *MockAuthorizeResponder) AddQuery(arg0, arg1 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "AddQuery", arg0, arg1)
 }
 
 // AddQuery indicates an expected call of AddQuery
 func (mr *MockAuthorizeResponderMockRecorder) AddQuery(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddQuery", reflect.TypeOf((*MockAuthorizeResponder)(nil).AddQuery), arg0, arg1)
 }
 
 // GetCode mocks base method
 func (m *MockAuthorizeResponder) GetCode() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetCode")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetCode indicates an expected call of GetCode
 func (mr *MockAuthorizeResponderMockRecorder) GetCode() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCode", reflect.TypeOf((*MockAuthorizeResponder)(nil).GetCode))
 }
 
 // GetFragment mocks base method
 func (m *MockAuthorizeResponder) GetFragment() url.Values {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetFragment")
 	ret0, _ := ret[0].(url.Values)
 	return ret0
 }
 
 // GetFragment indicates an expected call of GetFragment
 func (mr *MockAuthorizeResponderMockRecorder) GetFragment() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetFragment", reflect.TypeOf((*MockAuthorizeResponder)(nil).GetFragment))
 }
 
 // GetHeader mocks base method
 func (m *MockAuthorizeResponder) GetHeader() http.Header {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetHeader")
 	ret0, _ := ret[0].(http.Header)
 	return ret0
 }
 
 // GetHeader indicates an expected call of GetHeader
 func (mr *MockAuthorizeResponderMockRecorder) GetHeader() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetHeader", reflect.TypeOf((*MockAuthorizeResponder)(nil).GetHeader))
 }
 
 // GetQuery mocks base method
 func (m *MockAuthorizeResponder) GetQuery() url.Values {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetQuery")
 	ret0, _ := ret[0].(url.Values)
 	return ret0
 }
 
 // GetQuery indicates an expected call of GetQuery
 func (mr *MockAuthorizeResponderMockRecorder) GetQuery() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetQuery", reflect.TypeOf((*MockAuthorizeResponder)(nil).GetQuery))
 }
diff --git a/internal/client.go b/internal/client.go
index 7e1c517..73f7210 100644
--- a/internal/client.go
+++ b/internal/client.go
@@ -35,98 +35,114 @@ func (m *MockClient) EXPECT() *MockClientMockRecorder {
 	return m.recorder
 }
 
 // GetAudience mocks base method
 func (m *MockClient) GetAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetAudience indicates an expected call of GetAudience
 func (mr *MockClientMockRecorder) GetAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAudience", reflect.TypeOf((*MockClient)(nil).GetAudience))
 }
 
 // GetGrantTypes mocks base method
 func (m *MockClient) GetGrantTypes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantTypes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantTypes indicates an expected call of GetGrantTypes
 func (mr *MockClientMockRecorder) GetGrantTypes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantTypes", reflect.TypeOf((*MockClient)(nil).GetGrantTypes))
 }
 
 // GetHashedSecret mocks base method
 func (m *MockClient) GetHashedSecret() []byte {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetHashedSecret")
 	ret0, _ := ret[0].([]byte)
 	return ret0
 }
 
 // GetHashedSecret indicates an expected call of GetHashedSecret
 func (mr *MockClientMockRecorder) GetHashedSecret() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetHashedSecret", reflect.TypeOf((*MockClient)(nil).GetHashedSecret))
 }
 
 // GetID mocks base method
 func (m *MockClient) GetID() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetID")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetID indicates an expected call of GetID
 func (mr *MockClientMockRecorder) GetID() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetID", reflect.TypeOf((*MockClient)(nil).GetID))
 }
 
 // GetRedirectURIs mocks base method
 func (m *MockClient) GetRedirectURIs() []string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRedirectURIs")
 	ret0, _ := ret[0].([]string)
 	return ret0
 }
 
 // GetRedirectURIs indicates an expected call of GetRedirectURIs
 func (mr *MockClientMockRecorder) GetRedirectURIs() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRedirectURIs", reflect.TypeOf((*MockClient)(nil).GetRedirectURIs))
 }
 
 // GetResponseTypes mocks base method
 func (m *MockClient) GetResponseTypes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetResponseTypes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetResponseTypes indicates an expected call of GetResponseTypes
 func (mr *MockClientMockRecorder) GetResponseTypes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetResponseTypes", reflect.TypeOf((*MockClient)(nil).GetResponseTypes))
 }
 
 // GetScopes mocks base method
 func (m *MockClient) GetScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetScopes indicates an expected call of GetScopes
 func (mr *MockClientMockRecorder) GetScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetScopes", reflect.TypeOf((*MockClient)(nil).GetScopes))
 }
 
 // IsPublic mocks base method
 func (m *MockClient) IsPublic() bool {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "IsPublic")
 	ret0, _ := ret[0].(bool)
 	return ret0
 }
 
 // IsPublic indicates an expected call of IsPublic
 func (mr *MockClientMockRecorder) IsPublic() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsPublic", reflect.TypeOf((*MockClient)(nil).IsPublic))
 }
diff --git a/internal/hash.go b/internal/hash.go
index db60d9b..7c627f7 100644
--- a/internal/hash.go
+++ b/internal/hash.go
@@ -34,27 +34,31 @@ func (m *MockHasher) EXPECT() *MockHasherMockRecorder {
 	return m.recorder
 }
 
 // Compare mocks base method
 func (m *MockHasher) Compare(arg0 context.Context, arg1, arg2 []byte) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Compare", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // Compare indicates an expected call of Compare
 func (mr *MockHasherMockRecorder) Compare(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Compare", reflect.TypeOf((*MockHasher)(nil).Compare), arg0, arg1, arg2)
 }
 
 // Hash mocks base method
 func (m *MockHasher) Hash(arg0 context.Context, arg1 []byte) ([]byte, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Hash", arg0, arg1)
 	ret0, _ := ret[0].([]byte)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // Hash indicates an expected call of Hash
 func (mr *MockHasherMockRecorder) Hash(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Hash", reflect.TypeOf((*MockHasher)(nil).Hash), arg0, arg1)
 }
diff --git a/internal/id_token_strategy.go b/internal/id_token_strategy.go
index 1921e47..52c68cb 100644
--- a/internal/id_token_strategy.go
+++ b/internal/id_token_strategy.go
@@ -36,15 +36,17 @@ func (m *MockOpenIDConnectTokenStrategy) EXPECT() *MockOpenIDConnectTokenStrateg
 	return m.recorder
 }
 
 // GenerateIDToken mocks base method
 func (m *MockOpenIDConnectTokenStrategy) GenerateIDToken(arg0 context.Context, arg1 fosite.Requester) (string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateIDToken", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GenerateIDToken indicates an expected call of GenerateIDToken
 func (mr *MockOpenIDConnectTokenStrategyMockRecorder) GenerateIDToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateIDToken", reflect.TypeOf((*MockOpenIDConnectTokenStrategy)(nil).GenerateIDToken), arg0, arg1)
 }
diff --git a/internal/introspector.go b/internal/introspector.go
index c98aca3..2a821e0 100644
--- a/internal/introspector.go
+++ b/internal/introspector.go
@@ -36,15 +36,17 @@ func (m *MockTokenIntrospector) EXPECT() *MockTokenIntrospectorMockRecorder {
 	return m.recorder
 }
 
 // IntrospectToken mocks base method
 func (m *MockTokenIntrospector) IntrospectToken(arg0 context.Context, arg1 string, arg2 fosite.TokenType, arg3 fosite.AccessRequester, arg4 []string) (fosite.TokenType, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "IntrospectToken", arg0, arg1, arg2, arg3, arg4)
 	ret0, _ := ret[0].(fosite.TokenType)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // IntrospectToken indicates an expected call of IntrospectToken
 func (mr *MockTokenIntrospectorMockRecorder) IntrospectToken(arg0, arg1, arg2, arg3, arg4 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IntrospectToken", reflect.TypeOf((*MockTokenIntrospector)(nil).IntrospectToken), arg0, arg1, arg2, arg3, arg4)
 }
diff --git a/internal/oauth2_client_storage.go b/internal/oauth2_client_storage.go
index 0749a7e..6b494a9 100644
--- a/internal/oauth2_client_storage.go
+++ b/internal/oauth2_client_storage.go
@@ -36,39 +36,45 @@ func (m *MockClientCredentialsGrantStorage) EXPECT() *MockClientCredentialsGrant
 	return m.recorder
 }
 
 // CreateAccessTokenSession mocks base method
 func (m *MockClientCredentialsGrantStorage) CreateAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAccessTokenSession indicates an expected call of CreateAccessTokenSession
 func (mr *MockClientCredentialsGrantStorageMockRecorder) CreateAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessTokenSession", reflect.TypeOf((*MockClientCredentialsGrantStorage)(nil).CreateAccessTokenSession), arg0, arg1, arg2)
 }
 
 // DeleteAccessTokenSession mocks base method
 func (m *MockClientCredentialsGrantStorage) DeleteAccessTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteAccessTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteAccessTokenSession indicates an expected call of DeleteAccessTokenSession
 func (mr *MockClientCredentialsGrantStorageMockRecorder) DeleteAccessTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccessTokenSession", reflect.TypeOf((*MockClientCredentialsGrantStorage)(nil).DeleteAccessTokenSession), arg0, arg1)
 }
 
 // GetAccessTokenSession mocks base method
 func (m *MockClientCredentialsGrantStorage) GetAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccessTokenSession indicates an expected call of GetAccessTokenSession
 func (mr *MockClientCredentialsGrantStorageMockRecorder) GetAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccessTokenSession", reflect.TypeOf((*MockClientCredentialsGrantStorage)(nil).GetAccessTokenSession), arg0, arg1, arg2)
 }
diff --git a/internal/oauth2_owner_storage.go b/internal/oauth2_owner_storage.go
index 10473d8..12f2037 100644
--- a/internal/oauth2_owner_storage.go
+++ b/internal/oauth2_owner_storage.go
@@ -36,88 +36,102 @@ func (m *MockResourceOwnerPasswordCredentialsGrantStorage) EXPECT() *MockResourc
 	return m.recorder
 }
 
 // Authenticate mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) Authenticate(arg0 context.Context, arg1, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Authenticate", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // Authenticate indicates an expected call of Authenticate
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) Authenticate(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Authenticate", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).Authenticate), arg0, arg1, arg2)
 }
 
 // CreateAccessTokenSession mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) CreateAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAccessTokenSession indicates an expected call of CreateAccessTokenSession
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) CreateAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessTokenSession", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).CreateAccessTokenSession), arg0, arg1, arg2)
 }
 
 // CreateRefreshTokenSession mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) CreateRefreshTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateRefreshTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateRefreshTokenSession indicates an expected call of CreateRefreshTokenSession
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) CreateRefreshTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateRefreshTokenSession", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).CreateRefreshTokenSession), arg0, arg1, arg2)
 }
 
 // DeleteAccessTokenSession mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) DeleteAccessTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteAccessTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteAccessTokenSession indicates an expected call of DeleteAccessTokenSession
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) DeleteAccessTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccessTokenSession", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).DeleteAccessTokenSession), arg0, arg1)
 }
 
 // DeleteRefreshTokenSession mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) DeleteRefreshTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteRefreshTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteRefreshTokenSession indicates an expected call of DeleteRefreshTokenSession
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) DeleteRefreshTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteRefreshTokenSession", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).DeleteRefreshTokenSession), arg0, arg1)
 }
 
 // GetAccessTokenSession mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) GetAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccessTokenSession indicates an expected call of GetAccessTokenSession
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) GetAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccessTokenSession", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).GetAccessTokenSession), arg0, arg1, arg2)
 }
 
 // GetRefreshTokenSession mocks base method
 func (m *MockResourceOwnerPasswordCredentialsGrantStorage) GetRefreshTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRefreshTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetRefreshTokenSession indicates an expected call of GetRefreshTokenSession
 func (mr *MockResourceOwnerPasswordCredentialsGrantStorageMockRecorder) GetRefreshTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRefreshTokenSession", reflect.TypeOf((*MockResourceOwnerPasswordCredentialsGrantStorage)(nil).GetRefreshTokenSession), arg0, arg1, arg2)
 }
diff --git a/internal/oauth2_revoke_storage.go b/internal/oauth2_revoke_storage.go
index ca4caa0..07fb8a8 100644
--- a/internal/oauth2_revoke_storage.go
+++ b/internal/oauth2_revoke_storage.go
@@ -36,100 +36,116 @@ func (m *MockTokenRevocationStorage) EXPECT() *MockTokenRevocationStorageMockRec
 	return m.recorder
 }
 
 // CreateAccessTokenSession mocks base method
 func (m *MockTokenRevocationStorage) CreateAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAccessTokenSession indicates an expected call of CreateAccessTokenSession
 func (mr *MockTokenRevocationStorageMockRecorder) CreateAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessTokenSession", reflect.TypeOf((*MockTokenRevocationStorage)(nil).CreateAccessTokenSession), arg0, arg1, arg2)
 }
 
 // CreateRefreshTokenSession mocks base method
 func (m *MockTokenRevocationStorage) CreateRefreshTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateRefreshTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateRefreshTokenSession indicates an expected call of CreateRefreshTokenSession
 func (mr *MockTokenRevocationStorageMockRecorder) CreateRefreshTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateRefreshTokenSession", reflect.TypeOf((*MockTokenRevocationStorage)(nil).CreateRefreshTokenSession), arg0, arg1, arg2)
 }
 
 // DeleteAccessTokenSession mocks base method
 func (m *MockTokenRevocationStorage) DeleteAccessTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteAccessTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteAccessTokenSession indicates an expected call of DeleteAccessTokenSession
 func (mr *MockTokenRevocationStorageMockRecorder) DeleteAccessTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccessTokenSession", reflect.TypeOf((*MockTokenRevocationStorage)(nil).DeleteAccessTokenSession), arg0, arg1)
 }
 
 // DeleteRefreshTokenSession mocks base method
 func (m *MockTokenRevocationStorage) DeleteRefreshTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteRefreshTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteRefreshTokenSession indicates an expected call of DeleteRefreshTokenSession
 func (mr *MockTokenRevocationStorageMockRecorder) DeleteRefreshTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteRefreshTokenSession", reflect.TypeOf((*MockTokenRevocationStorage)(nil).DeleteRefreshTokenSession), arg0, arg1)
 }
 
 // GetAccessTokenSession mocks base method
 func (m *MockTokenRevocationStorage) GetAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccessTokenSession indicates an expected call of GetAccessTokenSession
 func (mr *MockTokenRevocationStorageMockRecorder) GetAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccessTokenSession", reflect.TypeOf((*MockTokenRevocationStorage)(nil).GetAccessTokenSession), arg0, arg1, arg2)
 }
 
 // GetRefreshTokenSession mocks base method
 func (m *MockTokenRevocationStorage) GetRefreshTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRefreshTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetRefreshTokenSession indicates an expected call of GetRefreshTokenSession
 func (mr *MockTokenRevocationStorageMockRecorder) GetRefreshTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRefreshTokenSession", reflect.TypeOf((*MockTokenRevocationStorage)(nil).GetRefreshTokenSession), arg0, arg1, arg2)
 }
 
 // RevokeAccessToken mocks base method
 func (m *MockTokenRevocationStorage) RevokeAccessToken(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "RevokeAccessToken", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RevokeAccessToken indicates an expected call of RevokeAccessToken
 func (mr *MockTokenRevocationStorageMockRecorder) RevokeAccessToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeAccessToken", reflect.TypeOf((*MockTokenRevocationStorage)(nil).RevokeAccessToken), arg0, arg1)
 }
 
 // RevokeRefreshToken mocks base method
 func (m *MockTokenRevocationStorage) RevokeRefreshToken(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "RevokeRefreshToken", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RevokeRefreshToken indicates an expected call of RevokeRefreshToken
 func (mr *MockTokenRevocationStorageMockRecorder) RevokeRefreshToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeRefreshToken", reflect.TypeOf((*MockTokenRevocationStorage)(nil).RevokeRefreshToken), arg0, arg1)
 }
diff --git a/internal/oauth2_storage.go b/internal/oauth2_storage.go
index d651576..f694c61 100644
--- a/internal/oauth2_storage.go
+++ b/internal/oauth2_storage.go
@@ -36,113 +36,131 @@ func (m *MockCoreStorage) EXPECT() *MockCoreStorageMockRecorder {
 	return m.recorder
 }
 
 // CreateAccessTokenSession mocks base method
 func (m *MockCoreStorage) CreateAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAccessTokenSession indicates an expected call of CreateAccessTokenSession
 func (mr *MockCoreStorageMockRecorder) CreateAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessTokenSession", reflect.TypeOf((*MockCoreStorage)(nil).CreateAccessTokenSession), arg0, arg1, arg2)
 }
 
 // CreateAuthorizeCodeSession mocks base method
 func (m *MockCoreStorage) CreateAuthorizeCodeSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateAuthorizeCodeSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateAuthorizeCodeSession indicates an expected call of CreateAuthorizeCodeSession
 func (mr *MockCoreStorageMockRecorder) CreateAuthorizeCodeSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAuthorizeCodeSession", reflect.TypeOf((*MockCoreStorage)(nil).CreateAuthorizeCodeSession), arg0, arg1, arg2)
 }
 
 // CreateRefreshTokenSession mocks base method
 func (m *MockCoreStorage) CreateRefreshTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateRefreshTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateRefreshTokenSession indicates an expected call of CreateRefreshTokenSession
 func (mr *MockCoreStorageMockRecorder) CreateRefreshTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateRefreshTokenSession", reflect.TypeOf((*MockCoreStorage)(nil).CreateRefreshTokenSession), arg0, arg1, arg2)
 }
 
 // DeleteAccessTokenSession mocks base method
 func (m *MockCoreStorage) DeleteAccessTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteAccessTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteAccessTokenSession indicates an expected call of DeleteAccessTokenSession
 func (mr *MockCoreStorageMockRecorder) DeleteAccessTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccessTokenSession", reflect.TypeOf((*MockCoreStorage)(nil).DeleteAccessTokenSession), arg0, arg1)
 }
 
 // DeleteRefreshTokenSession mocks base method
 func (m *MockCoreStorage) DeleteRefreshTokenSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteRefreshTokenSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteRefreshTokenSession indicates an expected call of DeleteRefreshTokenSession
 func (mr *MockCoreStorageMockRecorder) DeleteRefreshTokenSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteRefreshTokenSession", reflect.TypeOf((*MockCoreStorage)(nil).DeleteRefreshTokenSession), arg0, arg1)
 }
 
 // GetAccessTokenSession mocks base method
 func (m *MockCoreStorage) GetAccessTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAccessTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccessTokenSession indicates an expected call of GetAccessTokenSession
 func (mr *MockCoreStorageMockRecorder) GetAccessTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccessTokenSession", reflect.TypeOf((*MockCoreStorage)(nil).GetAccessTokenSession), arg0, arg1, arg2)
 }
 
 // GetAuthorizeCodeSession mocks base method
 func (m *MockCoreStorage) GetAuthorizeCodeSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAuthorizeCodeSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAuthorizeCodeSession indicates an expected call of GetAuthorizeCodeSession
 func (mr *MockCoreStorageMockRecorder) GetAuthorizeCodeSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAuthorizeCodeSession", reflect.TypeOf((*MockCoreStorage)(nil).GetAuthorizeCodeSession), arg0, arg1, arg2)
 }
 
 // GetRefreshTokenSession mocks base method
 func (m *MockCoreStorage) GetRefreshTokenSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRefreshTokenSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetRefreshTokenSession indicates an expected call of GetRefreshTokenSession
 func (mr *MockCoreStorageMockRecorder) GetRefreshTokenSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRefreshTokenSession", reflect.TypeOf((*MockCoreStorage)(nil).GetRefreshTokenSession), arg0, arg1, arg2)
 }
 
 // InvalidateAuthorizeCodeSession mocks base method
 func (m *MockCoreStorage) InvalidateAuthorizeCodeSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "InvalidateAuthorizeCodeSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // InvalidateAuthorizeCodeSession indicates an expected call of InvalidateAuthorizeCodeSession
 func (mr *MockCoreStorageMockRecorder) InvalidateAuthorizeCodeSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InvalidateAuthorizeCodeSession", reflect.TypeOf((*MockCoreStorage)(nil).InvalidateAuthorizeCodeSession), arg0, arg1)
 }
diff --git a/internal/oauth2_strategy.go b/internal/oauth2_strategy.go
index 9b712e8..dc37099 100644
--- a/internal/oauth2_strategy.go
+++ b/internal/oauth2_strategy.go
@@ -36,116 +36,134 @@ func (m *MockCoreStrategy) EXPECT() *MockCoreStrategyMockRecorder {
 	return m.recorder
 }
 
 // AccessTokenSignature mocks base method
 func (m *MockCoreStrategy) AccessTokenSignature(arg0 string) string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "AccessTokenSignature", arg0)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // AccessTokenSignature indicates an expected call of AccessTokenSignature
 func (mr *MockCoreStrategyMockRecorder) AccessTokenSignature(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AccessTokenSignature", reflect.TypeOf((*MockCoreStrategy)(nil).AccessTokenSignature), arg0)
 }
 
 // AuthorizeCodeSignature mocks base method
 func (m *MockCoreStrategy) AuthorizeCodeSignature(arg0 string) string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "AuthorizeCodeSignature", arg0)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // AuthorizeCodeSignature indicates an expected call of AuthorizeCodeSignature
 func (mr *MockCoreStrategyMockRecorder) AuthorizeCodeSignature(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthorizeCodeSignature", reflect.TypeOf((*MockCoreStrategy)(nil).AuthorizeCodeSignature), arg0)
 }
 
 // GenerateAccessToken mocks base method
 func (m *MockCoreStrategy) GenerateAccessToken(arg0 context.Context, arg1 fosite.Requester) (string, string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateAccessToken", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(string)
 	ret2, _ := ret[2].(error)
 	return ret0, ret1, ret2
 }
 
 // GenerateAccessToken indicates an expected call of GenerateAccessToken
 func (mr *MockCoreStrategyMockRecorder) GenerateAccessToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateAccessToken", reflect.TypeOf((*MockCoreStrategy)(nil).GenerateAccessToken), arg0, arg1)
 }
 
 // GenerateAuthorizeCode mocks base method
 func (m *MockCoreStrategy) GenerateAuthorizeCode(arg0 context.Context, arg1 fosite.Requester) (string, string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateAuthorizeCode", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(string)
 	ret2, _ := ret[2].(error)
 	return ret0, ret1, ret2
 }
 
 // GenerateAuthorizeCode indicates an expected call of GenerateAuthorizeCode
 func (mr *MockCoreStrategyMockRecorder) GenerateAuthorizeCode(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateAuthorizeCode", reflect.TypeOf((*MockCoreStrategy)(nil).GenerateAuthorizeCode), arg0, arg1)
 }
 
 // GenerateRefreshToken mocks base method
 func (m *MockCoreStrategy) GenerateRefreshToken(arg0 context.Context, arg1 fosite.Requester) (string, string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateRefreshToken", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(string)
 	ret2, _ := ret[2].(error)
 	return ret0, ret1, ret2
 }
 
 // GenerateRefreshToken indicates an expected call of GenerateRefreshToken
 func (mr *MockCoreStrategyMockRecorder) GenerateRefreshToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateRefreshToken", reflect.TypeOf((*MockCoreStrategy)(nil).GenerateRefreshToken), arg0, arg1)
 }
 
 // RefreshTokenSignature mocks base method
 func (m *MockCoreStrategy) RefreshTokenSignature(arg0 string) string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "RefreshTokenSignature", arg0)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // RefreshTokenSignature indicates an expected call of RefreshTokenSignature
 func (mr *MockCoreStrategyMockRecorder) RefreshTokenSignature(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RefreshTokenSignature", reflect.TypeOf((*MockCoreStrategy)(nil).RefreshTokenSignature), arg0)
 }
 
 // ValidateAccessToken mocks base method
 func (m *MockCoreStrategy) ValidateAccessToken(arg0 context.Context, arg1 fosite.Requester, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ValidateAccessToken", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateAccessToken indicates an expected call of ValidateAccessToken
 func (mr *MockCoreStrategyMockRecorder) ValidateAccessToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateAccessToken", reflect.TypeOf((*MockCoreStrategy)(nil).ValidateAccessToken), arg0, arg1, arg2)
 }
 
 // ValidateAuthorizeCode mocks base method
 func (m *MockCoreStrategy) ValidateAuthorizeCode(arg0 context.Context, arg1 fosite.Requester, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ValidateAuthorizeCode", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateAuthorizeCode indicates an expected call of ValidateAuthorizeCode
 func (mr *MockCoreStrategyMockRecorder) ValidateAuthorizeCode(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateAuthorizeCode", reflect.TypeOf((*MockCoreStrategy)(nil).ValidateAuthorizeCode), arg0, arg1, arg2)
 }
 
 // ValidateRefreshToken mocks base method
 func (m *MockCoreStrategy) ValidateRefreshToken(arg0 context.Context, arg1 fosite.Requester, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ValidateRefreshToken", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateRefreshToken indicates an expected call of ValidateRefreshToken
 func (mr *MockCoreStrategyMockRecorder) ValidateRefreshToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateRefreshToken", reflect.TypeOf((*MockCoreStrategy)(nil).ValidateRefreshToken), arg0, arg1, arg2)
 }
diff --git a/internal/openid_id_token_storage.go b/internal/openid_id_token_storage.go
index 9bf5b24..e331fd3 100644
--- a/internal/openid_id_token_storage.go
+++ b/internal/openid_id_token_storage.go
@@ -36,39 +36,45 @@ func (m *MockOpenIDConnectRequestStorage) EXPECT() *MockOpenIDConnectRequestStor
 	return m.recorder
 }
 
 // CreateOpenIDConnectSession mocks base method
 func (m *MockOpenIDConnectRequestStorage) CreateOpenIDConnectSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateOpenIDConnectSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreateOpenIDConnectSession indicates an expected call of CreateOpenIDConnectSession
 func (mr *MockOpenIDConnectRequestStorageMockRecorder) CreateOpenIDConnectSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateOpenIDConnectSession", reflect.TypeOf((*MockOpenIDConnectRequestStorage)(nil).CreateOpenIDConnectSession), arg0, arg1, arg2)
 }
 
 // DeleteOpenIDConnectSession mocks base method
 func (m *MockOpenIDConnectRequestStorage) DeleteOpenIDConnectSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeleteOpenIDConnectSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeleteOpenIDConnectSession indicates an expected call of DeleteOpenIDConnectSession
 func (mr *MockOpenIDConnectRequestStorageMockRecorder) DeleteOpenIDConnectSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOpenIDConnectSession", reflect.TypeOf((*MockOpenIDConnectRequestStorage)(nil).DeleteOpenIDConnectSession), arg0, arg1)
 }
 
 // GetOpenIDConnectSession mocks base method
 func (m *MockOpenIDConnectRequestStorage) GetOpenIDConnectSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetOpenIDConnectSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetOpenIDConnectSession indicates an expected call of GetOpenIDConnectSession
 func (mr *MockOpenIDConnectRequestStorageMockRecorder) GetOpenIDConnectSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOpenIDConnectSession", reflect.TypeOf((*MockOpenIDConnectRequestStorage)(nil).GetOpenIDConnectSession), arg0, arg1, arg2)
 }
diff --git a/internal/pkce_storage_strategy.go b/internal/pkce_storage_strategy.go
index 2f86043..fa8b4f9 100644
--- a/internal/pkce_storage_strategy.go
+++ b/internal/pkce_storage_strategy.go
@@ -36,39 +36,45 @@ func (m *MockPKCERequestStorage) EXPECT() *MockPKCERequestStorageMockRecorder {
 	return m.recorder
 }
 
 // CreatePKCERequestSession mocks base method
 func (m *MockPKCERequestStorage) CreatePKCERequestSession(arg0 context.Context, arg1 string, arg2 fosite.Requester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreatePKCERequestSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // CreatePKCERequestSession indicates an expected call of CreatePKCERequestSession
 func (mr *MockPKCERequestStorageMockRecorder) CreatePKCERequestSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreatePKCERequestSession", reflect.TypeOf((*MockPKCERequestStorage)(nil).CreatePKCERequestSession), arg0, arg1, arg2)
 }
 
 // DeletePKCERequestSession mocks base method
 func (m *MockPKCERequestStorage) DeletePKCERequestSession(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "DeletePKCERequestSession", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // DeletePKCERequestSession indicates an expected call of DeletePKCERequestSession
 func (mr *MockPKCERequestStorageMockRecorder) DeletePKCERequestSession(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePKCERequestSession", reflect.TypeOf((*MockPKCERequestStorage)(nil).DeletePKCERequestSession), arg0, arg1)
 }
 
 // GetPKCERequestSession mocks base method
 func (m *MockPKCERequestStorage) GetPKCERequestSession(arg0 context.Context, arg1 string, arg2 fosite.Session) (fosite.Requester, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPKCERequestSession", arg0, arg1, arg2)
 	ret0, _ := ret[0].(fosite.Requester)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPKCERequestSession indicates an expected call of GetPKCERequestSession
 func (mr *MockPKCERequestStorageMockRecorder) GetPKCERequestSession(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPKCERequestSession", reflect.TypeOf((*MockPKCERequestStorage)(nil).GetPKCERequestSession), arg0, arg1, arg2)
 }
diff --git a/internal/refresh_token_strategy.go b/internal/refresh_token_strategy.go
index 6100de5..2b4cb82 100644
--- a/internal/refresh_token_strategy.go
+++ b/internal/refresh_token_strategy.go
@@ -36,40 +36,46 @@ func (m *MockRefreshTokenStrategy) EXPECT() *MockRefreshTokenStrategyMockRecorde
 	return m.recorder
 }
 
 // GenerateRefreshToken mocks base method
 func (m *MockRefreshTokenStrategy) GenerateRefreshToken(arg0 context.Context, arg1 fosite.Requester) (string, string, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GenerateRefreshToken", arg0, arg1)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(string)
 	ret2, _ := ret[2].(error)
 	return ret0, ret1, ret2
 }
 
 // GenerateRefreshToken indicates an expected call of GenerateRefreshToken
 func (mr *MockRefreshTokenStrategyMockRecorder) GenerateRefreshToken(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateRefreshToken", reflect.TypeOf((*MockRefreshTokenStrategy)(nil).GenerateRefreshToken), arg0, arg1)
 }
 
 // RefreshTokenSignature mocks base method
 func (m *MockRefreshTokenStrategy) RefreshTokenSignature(arg0 string) string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "RefreshTokenSignature", arg0)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // RefreshTokenSignature indicates an expected call of RefreshTokenSignature
 func (mr *MockRefreshTokenStrategyMockRecorder) RefreshTokenSignature(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RefreshTokenSignature", reflect.TypeOf((*MockRefreshTokenStrategy)(nil).RefreshTokenSignature), arg0)
 }
 
 // ValidateRefreshToken mocks base method
 func (m *MockRefreshTokenStrategy) ValidateRefreshToken(arg0 context.Context, arg1 fosite.Requester, arg2 string) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ValidateRefreshToken", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // ValidateRefreshToken indicates an expected call of ValidateRefreshToken
 func (mr *MockRefreshTokenStrategyMockRecorder) ValidateRefreshToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateRefreshToken", reflect.TypeOf((*MockRefreshTokenStrategy)(nil).ValidateRefreshToken), arg0, arg1, arg2)
 }
diff --git a/internal/request.go b/internal/request.go
index 9946e15..b3091b0 100644
--- a/internal/request.go
+++ b/internal/request.go
@@ -37,202 +37,238 @@ func (m *MockRequester) EXPECT() *MockRequesterMockRecorder {
 	return m.recorder
 }
 
 // AppendRequestedScope mocks base method
 func (m *MockRequester) AppendRequestedScope(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "AppendRequestedScope", arg0)
 }
 
 // AppendRequestedScope indicates an expected call of AppendRequestedScope
 func (mr *MockRequesterMockRecorder) AppendRequestedScope(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AppendRequestedScope", reflect.TypeOf((*MockRequester)(nil).AppendRequestedScope), arg0)
 }
 
 // GetClient mocks base method
 func (m *MockRequester) GetClient() fosite.Client {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetClient")
 	ret0, _ := ret[0].(fosite.Client)
 	return ret0
 }
 
 // GetClient indicates an expected call of GetClient
 func (mr *MockRequesterMockRecorder) GetClient() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClient", reflect.TypeOf((*MockRequester)(nil).GetClient))
 }
 
 // GetGrantedAudience mocks base method
 func (m *MockRequester) GetGrantedAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantedAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantedAudience indicates an expected call of GetGrantedAudience
 func (mr *MockRequesterMockRecorder) GetGrantedAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantedAudience", reflect.TypeOf((*MockRequester)(nil).GetGrantedAudience))
 }
 
 // GetGrantedScopes mocks base method
 func (m *MockRequester) GetGrantedScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetGrantedScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetGrantedScopes indicates an expected call of GetGrantedScopes
 func (mr *MockRequesterMockRecorder) GetGrantedScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGrantedScopes", reflect.TypeOf((*MockRequester)(nil).GetGrantedScopes))
 }
 
 // GetID mocks base method
 func (m *MockRequester) GetID() string {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetID")
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // GetID indicates an expected call of GetID
 func (mr *MockRequesterMockRecorder) GetID() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetID", reflect.TypeOf((*MockRequester)(nil).GetID))
 }
 
 // GetRequestForm mocks base method
 func (m *MockRequester) GetRequestForm() url.Values {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestForm")
 	ret0, _ := ret[0].(url.Values)
 	return ret0
 }
 
 // GetRequestForm indicates an expected call of GetRequestForm
 func (mr *MockRequesterMockRecorder) GetRequestForm() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestForm", reflect.TypeOf((*MockRequester)(nil).GetRequestForm))
 }
 
 // GetRequestedAt mocks base method
 func (m *MockRequester) GetRequestedAt() time.Time {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedAt")
 	ret0, _ := ret[0].(time.Time)
 	return ret0
 }
 
 // GetRequestedAt indicates an expected call of GetRequestedAt
 func (mr *MockRequesterMockRecorder) GetRequestedAt() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedAt", reflect.TypeOf((*MockRequester)(nil).GetRequestedAt))
 }
 
 // GetRequestedAudience mocks base method
 func (m *MockRequester) GetRequestedAudience() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedAudience")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetRequestedAudience indicates an expected call of GetRequestedAudience
 func (mr *MockRequesterMockRecorder) GetRequestedAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedAudience", reflect.TypeOf((*MockRequester)(nil).GetRequestedAudience))
 }
 
 // GetRequestedScopes mocks base method
 func (m *MockRequester) GetRequestedScopes() fosite.Arguments {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetRequestedScopes")
 	ret0, _ := ret[0].(fosite.Arguments)
 	return ret0
 }
 
 // GetRequestedScopes indicates an expected call of GetRequestedScopes
 func (mr *MockRequesterMockRecorder) GetRequestedScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRequestedScopes", reflect.TypeOf((*MockRequester)(nil).GetRequestedScopes))
 }
 
 // GetSession mocks base method
 func (m *MockRequester) GetSession() fosite.Session {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetSession")
 	ret0, _ := ret[0].(fosite.Session)
 	return ret0
 }
 
 // GetSession indicates an expected call of GetSession
 func (mr *MockRequesterMockRecorder) GetSession() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSession", reflect.TypeOf((*MockRequester)(nil).GetSession))
 }
 
 // GrantAudience mocks base method
 func (m *MockRequester) GrantAudience(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "GrantAudience", arg0)
 }
 
 // GrantAudience indicates an expected call of GrantAudience
 func (mr *MockRequesterMockRecorder) GrantAudience(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantAudience", reflect.TypeOf((*MockRequester)(nil).GrantAudience), arg0)
 }
 
 // GrantScope mocks base method
 func (m *MockRequester) GrantScope(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "GrantScope", arg0)
 }
 
 // GrantScope indicates an expected call of GrantScope
 func (mr *MockRequesterMockRecorder) GrantScope(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantScope", reflect.TypeOf((*MockRequester)(nil).GrantScope), arg0)
 }
 
 // Merge mocks base method
 func (m *MockRequester) Merge(arg0 fosite.Requester) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "Merge", arg0)
 }
 
 // Merge indicates an expected call of Merge
 func (mr *MockRequesterMockRecorder) Merge(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Merge", reflect.TypeOf((*MockRequester)(nil).Merge), arg0)
 }
 
 // Sanitize mocks base method
 func (m *MockRequester) Sanitize(arg0 []string) fosite.Requester {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Sanitize", arg0)
 	ret0, _ := ret[0].(fosite.Requester)
 	return ret0
 }
 
 // Sanitize indicates an expected call of Sanitize
 func (mr *MockRequesterMockRecorder) Sanitize(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Sanitize", reflect.TypeOf((*MockRequester)(nil).Sanitize), arg0)
 }
 
 // SetID mocks base method
 func (m *MockRequester) SetID(arg0 string) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetID", arg0)
 }
 
 // SetID indicates an expected call of SetID
 func (mr *MockRequesterMockRecorder) SetID(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetID", reflect.TypeOf((*MockRequester)(nil).SetID), arg0)
 }
 
 // SetRequestedAudience mocks base method
 func (m *MockRequester) SetRequestedAudience(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetRequestedAudience", arg0)
 }
 
 // SetRequestedAudience indicates an expected call of SetRequestedAudience
 func (mr *MockRequesterMockRecorder) SetRequestedAudience(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRequestedAudience", reflect.TypeOf((*MockRequester)(nil).SetRequestedAudience), arg0)
 }
 
 // SetRequestedScopes mocks base method
 func (m *MockRequester) SetRequestedScopes(arg0 fosite.Arguments) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetRequestedScopes", arg0)
 }
 
 // SetRequestedScopes indicates an expected call of SetRequestedScopes
 func (mr *MockRequesterMockRecorder) SetRequestedScopes(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRequestedScopes", reflect.TypeOf((*MockRequester)(nil).SetRequestedScopes), arg0)
 }
 
 // SetSession mocks base method
 func (m *MockRequester) SetSession(arg0 fosite.Session) {
+	m.ctrl.T.Helper()
 	m.ctrl.Call(m, "SetSession", arg0)
 }
 
 // SetSession indicates an expected call of SetSession
 func (mr *MockRequesterMockRecorder) SetSession(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetSession", reflect.TypeOf((*MockRequester)(nil).SetSession), arg0)
 }
diff --git a/internal/revoke_handler.go b/internal/revoke_handler.go
index 820b7f7..96a1d26 100644
--- a/internal/revoke_handler.go
+++ b/internal/revoke_handler.go
@@ -36,14 +36,16 @@ func (m *MockRevocationHandler) EXPECT() *MockRevocationHandlerMockRecorder {
 	return m.recorder
 }
 
 // RevokeToken mocks base method
 func (m *MockRevocationHandler) RevokeToken(arg0 context.Context, arg1 string, arg2 fosite.TokenType, arg3 fosite.Client) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "RevokeToken", arg0, arg1, arg2, arg3)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RevokeToken indicates an expected call of RevokeToken
 func (mr *MockRevocationHandlerMockRecorder) RevokeToken(arg0, arg1, arg2, arg3 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeToken", reflect.TypeOf((*MockRevocationHandler)(nil).RevokeToken), arg0, arg1, arg2, arg3)
 }
diff --git a/internal/storage.go b/internal/storage.go
index b599b80..f49c7f2 100644
--- a/internal/storage.go
+++ b/internal/storage.go
@@ -5,10 +5,11 @@
 package internal
 
 import (
 	context "context"
 	reflect "reflect"
+	time "time"
 
 	gomock "github.com/golang/mock/gomock"
 
 	fosite "github.com/ory/fosite"
 )
@@ -34,17 +35,47 @@ func NewMockStorage(ctrl *gomock.Controller) *MockStorage {
 // EXPECT returns an object that allows the caller to indicate expected use
 func (m *MockStorage) EXPECT() *MockStorageMockRecorder {
 	return m.recorder
 }
 
+// ClientAssertionJWTValid mocks base method
+func (m *MockStorage) ClientAssertionJWTValid(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClientAssertionJWTValid", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ClientAssertionJWTValid indicates an expected call of ClientAssertionJWTValid
+func (mr *MockStorageMockRecorder) ClientAssertionJWTValid(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClientAssertionJWTValid", reflect.TypeOf((*MockStorage)(nil).ClientAssertionJWTValid), arg0, arg1)
+}
+
 // GetClient mocks base method
 func (m *MockStorage) GetClient(arg0 context.Context, arg1 string) (fosite.Client, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetClient", arg0, arg1)
 	ret0, _ := ret[0].(fosite.Client)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetClient indicates an expected call of GetClient
 func (mr *MockStorageMockRecorder) GetClient(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClient", reflect.TypeOf((*MockStorage)(nil).GetClient), arg0, arg1)
 }
+
+// SetClientAssertionJWT mocks base method
+func (m *MockStorage) SetClientAssertionJWT(arg0 context.Context, arg1 string, arg2 time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetClientAssertionJWT", arg0, arg1, arg2)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetClientAssertionJWT indicates an expected call of SetClientAssertionJWT
+func (mr *MockStorageMockRecorder) SetClientAssertionJWT(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetClientAssertionJWT", reflect.TypeOf((*MockStorage)(nil).SetClientAssertionJWT), arg0, arg1, arg2)
+}
diff --git a/internal/token_handler.go b/internal/token_handler.go
index d6692f2..a0626da 100644
--- a/internal/token_handler.go
+++ b/internal/token_handler.go
@@ -36,26 +36,30 @@ func (m *MockTokenEndpointHandler) EXPECT() *MockTokenEndpointHandlerMockRecorde
 	return m.recorder
 }
 
 // HandleTokenEndpointRequest mocks base method
 func (m *MockTokenEndpointHandler) HandleTokenEndpointRequest(arg0 context.Context, arg1 fosite.AccessRequester) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "HandleTokenEndpointRequest", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // HandleTokenEndpointRequest indicates an expected call of HandleTokenEndpointRequest
 func (mr *MockTokenEndpointHandlerMockRecorder) HandleTokenEndpointRequest(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleTokenEndpointRequest", reflect.TypeOf((*MockTokenEndpointHandler)(nil).HandleTokenEndpointRequest), arg0, arg1)
 }
 
 // PopulateTokenEndpointResponse mocks base method
 func (m *MockTokenEndpointHandler) PopulateTokenEndpointResponse(arg0 context.Context, arg1 fosite.AccessRequester, arg2 fosite.AccessResponder) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "PopulateTokenEndpointResponse", arg0, arg1, arg2)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // PopulateTokenEndpointResponse indicates an expected call of PopulateTokenEndpointResponse
 func (mr *MockTokenEndpointHandlerMockRecorder) PopulateTokenEndpointResponse(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PopulateTokenEndpointResponse", reflect.TypeOf((*MockTokenEndpointHandler)(nil).PopulateTokenEndpointResponse), arg0, arg1, arg2)
 }
diff --git a/internal/transactional.go b/internal/transactional.go
index b2c7a9c..142502f 100644
--- a/internal/transactional.go
+++ b/internal/transactional.go
@@ -34,39 +34,45 @@ func (m *MockTransactional) EXPECT() *MockTransactionalMockRecorder {
 	return m.recorder
 }
 
 // BeginTX mocks base method
 func (m *MockTransactional) BeginTX(arg0 context.Context) (context.Context, error) {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "BeginTX", arg0)
 	ret0, _ := ret[0].(context.Context)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // BeginTX indicates an expected call of BeginTX
 func (mr *MockTransactionalMockRecorder) BeginTX(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BeginTX", reflect.TypeOf((*MockTransactional)(nil).BeginTX), arg0)
 }
 
 // Commit mocks base method
 func (m *MockTransactional) Commit(arg0 context.Context) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Commit", arg0)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // Commit indicates an expected call of Commit
 func (mr *MockTransactionalMockRecorder) Commit(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Commit", reflect.TypeOf((*MockTransactional)(nil).Commit), arg0)
 }
 
 // Rollback mocks base method
 func (m *MockTransactional) Rollback(arg0 context.Context) error {
+	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Rollback", arg0)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // Rollback indicates an expected call of Rollback
 func (mr *MockTransactionalMockRecorder) Rollback(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Rollback", reflect.TypeOf((*MockTransactional)(nil).Rollback), arg0)
 }
diff --git a/storage/memory.go b/storage/memory.go
index 4d72d74..326cd28 100644
--- a/storage/memory.go
+++ b/storage/memory.go
@@ -21,10 +21,11 @@
 
 package storage
 
 import (
 	"context"
+	"time"
 
 	"github.com/pkg/errors"
 
 	"github.com/ory/fosite"
 )
@@ -33,18 +34,19 @@ type MemoryUserRelation struct {
 	Username string
 	Password string
 }
 
 type MemoryStore struct {
-	Clients        map[string]fosite.Client
-	AuthorizeCodes map[string]StoreAuthorizeCode
-	IDSessions     map[string]fosite.Requester
-	AccessTokens   map[string]fosite.Requester
-	Implicit       map[string]fosite.Requester
-	RefreshTokens  map[string]fosite.Requester
-	PKCES          map[string]fosite.Requester
-	Users          map[string]MemoryUserRelation
+	Clients         map[string]fosite.Client
+	AuthorizeCodes  map[string]StoreAuthorizeCode
+	IDSessions      map[string]fosite.Requester
+	AccessTokens    map[string]fosite.Requester
+	Implicit        map[string]fosite.Requester
+	RefreshTokens   map[string]fosite.Requester
+	PKCES           map[string]fosite.Requester
+	Users           map[string]MemoryUserRelation
+	BlacklistedJTIs map[string]time.Time
 	// In-memory request ID to token signatures
 	AccessTokenRequestIDs  map[string]string
 	RefreshTokenRequestIDs map[string]string
 }
 
@@ -58,10 +60,11 @@ func NewMemoryStore() *MemoryStore {
 		RefreshTokens:          make(map[string]fosite.Requester),
 		PKCES:                  make(map[string]fosite.Requester),
 		Users:                  make(map[string]MemoryUserRelation),
 		AccessTokenRequestIDs:  make(map[string]string),
 		RefreshTokenRequestIDs: make(map[string]string),
+		BlacklistedJTIs:        make(map[string]time.Time),
 	}
 }
 
 type StoreAuthorizeCode struct {
 	active bool
@@ -131,10 +134,34 @@ func (s *MemoryStore) GetClient(_ context.Context, id string) (fosite.Client, er
 		return nil, fosite.ErrNotFound
 	}
 	return cl, nil
 }
 
+func (s *MemoryStore) ClientAssertionJWTValid(_ context.Context, jti string) error {
+	if exp, exists := s.BlacklistedJTIs[jti]; exists && exp.After(time.Now()) {
+		return fosite.ErrJTIKnown
+	}
+
+	return nil
+}
+
+func (s *MemoryStore) SetClientAssertionJWT(_ context.Context, jti string, exp time.Time) error {
+	// delete expired jtis
+	for j, e := range s.BlacklistedJTIs {
+		if e.Before(time.Now()) {
+			delete(s.BlacklistedJTIs, j)
+		}
+	}
+
+	if _, exists := s.BlacklistedJTIs[jti]; exists {
+		return fosite.ErrJTIKnown
+	}
+
+	s.BlacklistedJTIs[jti] = exp
+	return nil
+}
+
 func (s *MemoryStore) CreateAuthorizeCodeSession(_ context.Context, code string, req fosite.Requester) error {
 	s.AuthorizeCodes[code] = StoreAuthorizeCode{active: true, Requester: req}
 	return nil
 }
 

Vulnerable code: 		} else if jti, ok := (*claims)["jti"].(string); !ok || len(jti) == 0 {
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
				"exp": time.Now().Add(time.Hour),
import "context"
	github.com/golang/mock v1.1.1
	golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4
	golang.org/x/net v0.0.0-20181005035420-146acd28ed58 // indirect
	golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f // indirect
	"github.com/pkg/errors"
	Clients        map[string]fosite.Client
	AuthorizeCodes map[string]StoreAuthorizeCode
	IDSessions     map[string]fosite.Requester
	AccessTokens   map[string]fosite.Requester
	Implicit       map[string]fosite.Requester
	RefreshTokens  map[string]fosite.Requester
	PKCES          map[string]fosite.Requester
	Users          map[string]MemoryUserRelation
Fixed code: 	"encoding/json"
	"time"
		var jti string
		} else if jti, ok = (*claims)["jti"].(string); !ok || len(jti) == 0 {
		} else if f.Store.ClientAssertionJWTValid(context.Background(), jti) != nil {
			return nil, errors.WithStack(ErrJTIKnown.WithHint("Claim \"jti\" from \"client_assertion\" MUST only be used once."))
		}

		// type conversion according to jwt.MapClaims.VerifyExpiresAt
		var expiry int64
		err = nil
		switch exp := (*claims)["exp"].(type) {
		case float64:
			expiry = int64(exp)
		case json.Number:
			expiry, err = exp.Int64()
		default:
			err = ErrInvalidClient.WithHint("Unable to type assert the expiry time from claims. This should not happen as we validate the expiry time already earlier with token.Claims.Valid()")
		}

		if err != nil {
			return nil, errors.WithStack(err)
		}
		if err := f.Store.SetClientAssertionJWT(context.Background(), jti, time.Unix(expiry, 0)); err != nil {
			return nil, err
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),
				"exp": time.Now().Add(time.Hour).Unix(),

func TestAuthenticateClientTwice(t *testing.T) {
	const at = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"

	key := internal.MustRSAKey()
	client := &DefaultOpenIDConnectClient{
		DefaultClient: &DefaultClient{
			ID:     "bar",
			Secret: []byte("secret"),
		},
		JSONWebKeys: &jose.JSONWebKeySet{
			Keys: []jose.JSONWebKey{
				{
					KeyID: "kid-foo",
					Use:   "sig",
					Key:   &key.PublicKey,
				},
			},
		},
		TokenEndpointAuthMethod: "private_key_jwt",
	}
	store := storage.NewMemoryStore()
	store.Clients[client.ID] = client

	hasher := &BCrypt{WorkFactor: 6}
	f := &Fosite{
		JWKSFetcherStrategy: NewDefaultJWKSFetcherStrategy(),
		Store:               store,
		Hasher:              hasher,
		TokenURL:            "token-url",
	}

	formValues := url.Values{"client_id": []string{"bar"}, "client_assertion": {mustGenerateAssertion(t, jwt.MapClaims{
		"sub": "bar",
		"exp": time.Now().Add(time.Hour).Unix(),
		"iss": "bar",
		"jti": "12345",
		"aud": "token-url",
	}, key, "kid-foo")}, "client_assertion_type": []string{at}}

	c, err := f.AuthenticateClient(nil, new(http.Request), formValues)
	require.NoError(t, err, "%#v", err)
	assert.Equal(t, client, c)

	// replay the request and expect it to fail
	c, err = f.AuthenticateClient(nil, new(http.Request), formValues)
	require.Error(t, err)
	assert.EqualError(t, err, ErrJTIKnown.Error())
	assert.Nil(t, c)
}
import (
	"context"
	"time"
)
	// ClientAssertionJWTValid returns an error if the JTI is
	// known or the DB check failed and nil if the JTI is not known.
	ClientAssertionJWTValid(ctx context.Context, jti string) error
	// SetClientAssertionJWT marks a JTI as known for the given
	// expiry time. Before inserting the new JTI, it will clean
	// up any existing JTIs that have expired as those tokens can
	// not be replayed due to the expiry.
	SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error
	ErrJTIKnown = &RFC6749Error{
		Description: "The jti was already used.",
		Name:        errJTIKnownName,
		Code:        http.StatusBadRequest,
	}
	errJTIKnownName                 = "jti_known"
	github.com/golang/mock v1.4.3
	golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
github.com/golang/mock v1.4.3 h1:GV+pQPG/EUUbkh47niozDcADz6go/dUwhVzdUQHIVRw=
github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628=
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/tools v0.0.0-20190425150028-36563e24a262 h1:qsl9y/CJx34tuA7QCPNp86JNJe4spst6Ff8MjvPUdPg=
golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
	"github.com/pkg/errors"

	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	time "time"
// ClientAssertionJWTValid mocks base method
func (m *MockStorage) ClientAssertionJWTValid(arg0 context.Context, arg1 string) error {
	m.ctrl.T.Helper()
	ret := m.ctrl.Call(m, "ClientAssertionJWTValid", arg0, arg1)
	ret0, _ := ret[0].(error)
	return ret0
}

// ClientAssertionJWTValid indicates an expected call of ClientAssertionJWTValid
func (mr *MockStorageMockRecorder) ClientAssertionJWTValid(arg0, arg1 interface{}) *gomock.Call {
	mr.mock.ctrl.T.Helper()
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClientAssertionJWTValid", reflect.TypeOf((*MockStorage)(nil).ClientAssertionJWTValid), arg0, arg1)
}

	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()

// SetClientAssertionJWT mocks base method
func (m *MockStorage) SetClientAssertionJWT(arg0 context.Context, arg1 string, arg2 time.Time) error {
	m.ctrl.T.Helper()
	ret := m.ctrl.Call(m, "SetClientAssertionJWT", arg0, arg1, arg2)
	ret0, _ := ret[0].(error)
	return ret0
}

// SetClientAssertionJWT indicates an expected call of SetClientAssertionJWT
func (mr *MockStorageMockRecorder) SetClientAssertionJWT(arg0, arg1, arg2 interface{}) *gomock.Call {
	mr.mock.ctrl.T.Helper()
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetClientAssertionJWT", reflect.TypeOf((*MockStorage)(nil).SetClientAssertionJWT), arg0, arg1, arg2)
}
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	m.ctrl.T.Helper()
	mr.mock.ctrl.T.Helper()
	"time"
	Clients         map[string]fosite.Client
	AuthorizeCodes  map[string]StoreAuthorizeCode
	IDSessions      map[string]fosite.Requester
	AccessTokens    map[string]fosite.Requester
	Implicit        map[string]fosite.Requester
	RefreshTokens   map[string]fosite.Requester
	PKCES           map[string]fosite.Requester
	Users           map[string]MemoryUserRelation
	BlacklistedJTIs map[string]time.Time
		BlacklistedJTIs:        make(map[string]time.Time),
func (s *MemoryStore) ClientAssertionJWTValid(_ context.Context, jti string) error {
	if exp, exists := s.BlacklistedJTIs[jti]; exists && exp.After(time.Now()) {
		return fosite.ErrJTIKnown
	}

	return nil
}

func (s *MemoryStore) SetClientAssertionJWT(_ context.Context, jti string, exp time.Time) error {
	// delete expired jtis
	for j, e := range s.BlacklistedJTIs {
		if e.Before(time.Now()) {
			delete(s.BlacklistedJTIs, j)
		}
	}

	if _, exists := s.BlacklistedJTIs[jti]; exists {
		return fosite.ErrJTIKnown
	}

	s.BlacklistedJTIs[jti] = exp
	return nil
}