An authorization token is received, but I had to modify the Request class in vendor/bshaffer/oauth2-server-php/ to accept $_REQUEST instead of $_POST.

1 files changed, 5 insertions, 4 deletions

diff --git a/Zotlabs/Module/Authorize.php b/Zotlabs/Module/Authorize.php
index 2c0c9248f..f505b4681 100644
--- a/Zotlabs/Module/Authorize.php
+++ b/Zotlabs/Module/Authorize.php
@@ -79,17 +79,18 @@ class Authorize extends \Zotlabs\Web\Controller {
 			$redirect_uri = $_POST['redirect_uri'] = 'https://fake.example.com';
 		}
 
+		$request = \OAuth2\Request::createFromGlobals();
+		$response = new \OAuth2\Response();
+
 		// If the client is not registered, add to the database
 		if (!$storage->getClientDetails($client_id)) {
 			$client_secret = random_string(16);
 			// Client apps are registered per channel
 			$user_id = local_channel();
-			$storage->setClientDetails($client_id, $client_secret, $redirect_uri, null, null, $user_id);
+			$storage->setClientDetails($client_id, $client_secret, $redirect_uri, 'authorization_code', null, $user_id);
+			$response->setParameter('client_secret', $client_secret);
 		}
 
-		$request = \OAuth2\Request::createFromGlobals();
-		$response = new \OAuth2\Response();
-
 		// validate the authorize request
 		if (!$s->validateAuthorizeRequest($request, $response)) {
 			$response->send();