applicake/doorkeeper — pull request #3 by felipeelias (2011-11-30 11:45:06+00:00)
Title: Authorization code must be short lived and single use

According to specs, access grants must be short lived and single use. This means tha after the access token is issued for a specific grant, the grant must be revoked and cannot be used again.

http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-10.5

This commit upgrades all migration files adding 'revoked_at' field and changes the behavior of #accessible?. For a grant be accessible it needs to not be either exipired or revoked.

The error response when the grant is revoked is 'invalid_grant' as specified here:

http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-5.2

I also had to fix an issue when creating the access token, that was issued to the wrong client attribute (uid instead of id)