ObjectiveCMIS/Common/CMISOAuthAuthenticationProvider.m - chemistry-objectivecmis - Git at Google

 /*
   Licensed to the Apache Software Foundation (ASF) under one
   or more contributor license agreements.  See the NOTICE file
   distributed with this work for additional information
   regarding copyright ownership.  The ASF licenses this file
   to you under the Apache License, Version 2.0 (the
   "License"); you may not use this file except in compliance
   with the License.  You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing,
   software distributed under the License is distributed on an
   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   KIND, either express or implied.  See the License for the
   specific language governing permissions and limitations
   under the License.
  */

 #import "CMISOAuthAuthenticationProvider.h"
 #import "CMISOAuthToken.h"
 #import "CMISLog.h"
 #import "CMISBindingSession.h"
 #import "CMISErrors.h"
 #import "CMISHttpResponse.h"
 #import "CMISHttpRequest.h"
 #import "CMISURLUtil.h"
 #import "CMISDictionaryUtil.h"
 #import "CMISDefaultNetworkProvider.h"
 #import "CMISOAuthHttpRequest.h"
 #import "CMISOAuthHttpResponse.h"

 @interface CMISOAuthAuthenticationProvider ()

 @property (nonatomic, strong, readwrite) CMISOAuthToken *token;
 @property (nonatomic, strong) NSNumber *defaultTokenLifetime;

 @property (nonatomic, weak) CMISBindingSession *session;

 @property (nonatomic, strong) NSOperationQueue *operationQueue;

 @end

 @interface CMISOAuthFetchOperation : NSOperation {
     BOOL executing;
     BOOL finished;
 }

 @property (nonatomic, weak) CMISOAuthAuthenticationProvider *authProvider;
 @property (nonatomic, weak) NSThread *originalThread;
 @property (nonatomic, copy) void (^operationCompletionBlock)(NSString *accessToken, NSError *error);

 - (instancetype)initWithOAuthProvider:(CMISOAuthAuthenticationProvider *)authProvider completionBlock:(void(^)(NSString *accessToken, NSError *error))completionBlock;
 - (void)completeOperation;

 @end

 @implementation CMISOAuthAuthenticationProvider

 - (instancetype)init
 {
     self = [super init];
     if (self) {
         self.defaultTokenLifetime = [NSNumber numberWithInt:3600];

         self.operationQueue = [[NSOperationQueue alloc] init];
         /* We need a serial queue as we need to make sure that only one thread at a time requests or refreshes the token
          * We cannot use a NSLock object to synchronize or else we would run into a deadlock because of the asynchronous call to the server */
         [self.operationQueue setMaxConcurrentOperationCount:1];
         if ([self.operationQueue respondsToSelector:@selector(setQualityOfService:)]) {
             // Supported since iOS8
             [self.operationQueue setQualityOfService:NSQualityOfServiceBackground];
         }
     }
     return self;
 }

 - (void)setSession:(CMISBindingSession *)session
 {
     _session = session;

     if (self.token == nil) {
         // get predefined access token
         NSString *accessToken = nil;
         if ([[self.session objectForKey:kCMISSessionParameterOAuthAccessToken] isKindOfClass:NSString.class]) {
             accessToken = (NSString *)[self.session objectForKey:kCMISSessionParameterOAuthAccessToken];
         }

         // get predefined refresh token
         NSString *refreshToken = nil;
         if ([[self.session objectForKey:kCMISSessionParameterOAuthRefreshToken] isKindOfClass:NSString.class]) {
             refreshToken = (NSString *)[self.session objectForKey:kCMISSessionParameterOAuthRefreshToken];
         }

         // get predefined expiration timestamp
         NSNumber *expirationTimestamp = [NSNumber numberWithInt:0];
         if ([[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp] isKindOfClass:NSString.class]) {
             expirationTimestamp = [NSNumber numberWithLongLong:[[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp] longLongValue]];
         } else if ([[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp] isKindOfClass:NSNumber.class]) {
             expirationTimestamp = (NSNumber *)[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp];
         }

         // get default token lifetime
         if ([[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime] isKindOfClass:NSString.class]) {
             self.defaultTokenLifetime = [NSNumber numberWithLongLong:[[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime] longLongValue]];
         } else if ([[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime] isKindOfClass:NSNumber.class]) {
             self.defaultTokenLifetime = (NSNumber *)[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime];
         }

         self.token = [[CMISOAuthToken alloc] initWithAccessToken:accessToken refreshToken:refreshToken expirationTimestamp:expirationTimestamp];
     }
 }

 - (void)asyncHttpHeadersToApply:(void(^)(NSDictionary *headers, NSError *cmisError))completionBlock
 {
     CMISOAuthFetchOperation *oAuthFetchOperation = [[CMISOAuthFetchOperation alloc] initWithOAuthProvider:self completionBlock:^(NSString *accessToken, NSError *error) {
         if (error) {
             completionBlock(nil, error);
         } else {
             NSMutableDictionary *headers = [[super httpHeadersToApply] mutableCopy]; //TODO check if httpHeadersToApply should be called
             if(!headers) {
                 headers = [NSMutableDictionary new];
             }

             [headers setObject:[NSSet setWithObject:[NSString stringWithFormat:@"Bearer %@", accessToken]] forKey:@"Authorization"];

             completionBlock(headers, nil);
         }
     }];

     [self.operationQueue addOperation:oAuthFetchOperation];
 }


 @end

 @implementation CMISOAuthFetchOperation

 - (instancetype)initWithOAuthProvider:(CMISOAuthAuthenticationProvider *)authProvider completionBlock:(void (^)(NSString *, NSError *))completionBlock
 {
     self = [super init];
     if (self) {
         self.authProvider = authProvider;
         self.operationCompletionBlock = completionBlock;
         self.originalThread = [NSThread currentThread];
     }
     return self;
 }

 - (void)main
 {
     // do not invoke super!

     if (self.isCancelled) {
         NSError *error = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeCancelled detailedDescription:@"Could not get token as CMISOAuthFetchOperation was cancelled"];
         [self performSelector:@selector(executeCompletionBlockError:) onThread:self.originalThread withObject:error waitUntilDone:NO];
     } else {
         [self accessTokenWithCompletionBlock:^(NSError *error) {
             // call the completion block on the original thread
             if (self.originalThread) {
                 if (error) {
                     [self performSelector:@selector(executeCompletionBlockError:) onThread:self.originalThread withObject:error waitUntilDone:NO];
                 } else {
                     [self performSelector:@selector(executeCompletionBlockAccessToken:) onThread:self.originalThread withObject:self.authProvider.token.accessToken waitUntilDone:NO];
                 }
             }
         }];
     }
 }

 - (void)accessTokenWithCompletionBlock:(void(^)(NSError *error))completionBlock
 {
     void (^continueWithUpdatedToken)(NSError*) = ^(NSError *error) {

         [self.authProvider.delegate cmisOAuthAuthenticationProvider:self.authProvider didUpdateToken:self.authProvider.token withError:error];

         completionBlock(error);
     };

     if (!self.authProvider.token.accessToken) {
         if (!self.authProvider.token.refreshToken) {
             [self requestToken:continueWithUpdatedToken];
         } else {
             [self refreshToken:continueWithUpdatedToken];
         }
     } else if ([self.authProvider.token isExpired]) {
         [self refreshToken:continueWithUpdatedToken];
     } else { // we already have a valid token
         completionBlock(nil);
     }
 }

 - (void)requestToken:(void(^)(NSError *error))completionBlock
 {
     if ([CMISLog sharedInstance].logLevel == CMISLogLevelDebug) {
         CMISLogDebug(@"Requesting new OAuth access token.");
     }

     [self makeRequestIsRefresh:NO completionBlock:^(NSError *error) {
         if ([CMISLog sharedInstance].logLevel == CMISLogLevelTrace) {
             CMISLogTrace(@"%@", [self.authProvider.token description]);
         }

         completionBlock(error);
     }];
 }

 - (void)refreshToken:(void(^)(NSError *error))completionBlock
 {
     if ([CMISLog sharedInstance].logLevel == CMISLogLevelDebug) {
         CMISLogDebug(@"Refreshing OAuth access token.");
     }

     [self makeRequestIsRefresh:YES completionBlock:^(NSError *error) {
         if ([CMISLog sharedInstance].logLevel == CMISLogLevelTrace) {
             CMISLogTrace(@"%@", [self.authProvider.token description]);
         }

         completionBlock(error);
     }];
 }

 - (void)makeRequestIsRefresh:(BOOL)isRefresh completionBlock:(void(^)(NSError *error))completionBlock
 {
     id tokenEndpoint = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthTokenEndpoint];
     if (![tokenEndpoint isKindOfClass:NSString.class]) {
         completionBlock([CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Token endpoint not set!"]);
     }

     if (isRefresh && !self.authProvider.token.refreshToken) {
         completionBlock([CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"No refresh token!"]);
     }

     NSDictionary *headers = @{@"Content-Type" : @"application/x-www-form-urlencoded; charset=UTF-8"};

     NSMutableData *requestBody = [NSMutableData new];
     // compile request
     if (isRefresh) {
         [self appendString:@"grant_type=refresh_token" toData:requestBody];

         [self appendString:@"&refresh_token=" toData:requestBody];
         [self appendString:[CMISURLUtil encodeUrlParameterValue:self.authProvider.token.refreshToken] toData:requestBody];
     } else {
         [self appendString:@"grant_type=authorization_code" toData:requestBody];

         id code = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthCode];
         if (code) {
             [self appendString:@"&code=" toData:requestBody];
             [self appendString:[CMISURLUtil encodeUrlParameterValue:[code description]] toData:requestBody];
         }

         id redirectUri = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthRedirectUri];
         if (redirectUri) {
             [self appendString:@"&redirect_uri=" toData:requestBody];
             [self appendString:[CMISURLUtil encodeUrlParameterValue:[redirectUri description]] toData:requestBody];
         }
     }

     id clientId = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthClientId];
     if (clientId) {
         [self appendString:@"&client_id=" toData:requestBody];
         [self appendString:[CMISURLUtil encodeUrlParameterValue:[clientId description]] toData:requestBody];
     }

     id clientSecret = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthClientSecret];
     if (clientSecret) {
         [self appendString:@"&client_secret=" toData:requestBody];
         [self appendString:[CMISURLUtil encodeUrlParameterValue:[clientSecret description]] toData:requestBody];
     }

     if ([CMISLog sharedInstance].logLevel == CMISLogLevelTrace) {
         CMISLogTrace(@"Request body: %@", [[NSString alloc] initWithData:requestBody encoding:NSUTF8StringEncoding]);
     }

     // request token
     __weak typeof(self) weakSelf = self;
     [self invoke:[NSURL URLWithString:(NSString *)tokenEndpoint]
       httpMethod:HTTP_POST
          session:self.authProvider.session
             body:requestBody
          headers:headers
      cmisRequest:nil
  completionBlock:^(CMISHttpResponse *httpResponse, NSError *error) {
      NSError *cmisError = nil;
      if (error) {
          completionBlock(error);
      } else {
          // parse response
          NSDictionary *jsonDictionary = [CMISOAuthHttpResponse parseResponse:httpResponse error:&cmisError];

          if(cmisError) { // there was an error parsing the response
              completionBlock(cmisError);
          } else {
              id tokenType = [jsonDictionary cmis_objectForKeyNotNull:@"token_type"];
              if (![tokenType isKindOfClass:NSString.class] || [@"bearer" caseInsensitiveCompare:(NSString *) tokenType] != NSOrderedSame) {
                  cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:[NSString stringWithFormat:@"Unsupported OAuth token type: %@", tokenType]];
                  completionBlock(cmisError);
                  return;
              }

              id jsonAccessToken = [jsonDictionary cmis_objectForKeyNotNull:@"access_token"];
              if (![jsonAccessToken isKindOfClass:NSString.class]) {
                  cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Invalid OAuth access_token!"];
                  completionBlock(cmisError);
                  return;

              }

              id jsonRefreshToken = [jsonDictionary cmis_objectForKeyNotNull:@"refresh_token"];
              if (jsonRefreshToken && ![jsonRefreshToken isKindOfClass:NSString.class]) {
                  cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Invalid OAuth refresh_token!"];
                  completionBlock(cmisError);
                  return;
              }

              NSNumber *expiresIn = weakSelf.authProvider.defaultTokenLifetime;
              id jsonExpiresIn = [jsonDictionary cmis_objectForKeyNotNull:@"expires_in"];
              if (jsonExpiresIn) {
                  if ([jsonExpiresIn isKindOfClass:NSNumber.class]) {
                      expiresIn = (NSNumber *)jsonExpiresIn;
                  } else if ([jsonExpiresIn isKindOfClass:NSString.class]) {
                      expiresIn = [NSNumber numberWithLongLong:[(NSString *)jsonExpiresIn longLongValue]];
                  } else {
                      cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Invalid OAuth expires_in value!"];
                      completionBlock(cmisError);
                      return;
                  }
              }

              if ([expiresIn longLongValue] <= 0) {
                  expiresIn = self.authProvider.defaultTokenLifetime;
              }

              weakSelf.authProvider.token = [[CMISOAuthToken alloc] initWithAccessToken:jsonAccessToken refreshToken:jsonRefreshToken expirationTimestamp:[NSNumber numberWithLongLong:([expiresIn longLongValue] * 1000 + [[NSDate date] timeIntervalSince1970] * 1000)]]; // seconds to milliseconds
              completionBlock(nil); // success
          }
      }
  }];
 }

 - (void)invoke:(NSURL *)url httpMethod:(CMISHttpRequestMethod)httpRequestMethod session:(CMISBindingSession *)session body:(NSData *)body headers:(NSDictionary *)headers cmisRequest:(CMISRequest *)cmisRequest completionBlock:(void (^)(CMISHttpResponse *, NSError *))completionBlock
 {
     NSMutableURLRequest *urlRequest = [CMISDefaultNetworkProvider createRequestForUrl:url
                                                                            httpMethod:httpRequestMethod
                                                                               session:session];
     if (!cmisRequest.isCancelled) {
         CMISHttpRequest* request = [CMISOAuthHttpRequest startRequest:urlRequest
                                                            httpMethod:httpRequestMethod
                                                           requestBody:body
                                                               headers:headers
                                                               session:session
                                                       completionBlock:completionBlock];
         if (request) {
             cmisRequest.httpRequest = request;
         }
     } else {
         if (completionBlock) {
             completionBlock(nil, [CMISErrors createCMISErrorWithCode:kCMISErrorCodeCancelled
                                                  detailedDescription:@"Request was cancelled"]);
         }
     }
 }

 - (void)appendString:(NSString *)string toData:(NSMutableData *)data
 {
     [data appendData:[string dataUsingEncoding:NSUTF8StringEncoding]];
 }

 - (BOOL)isConcurrent {
     return NO;
 }

 - (BOOL)isExecuting {
     return executing;
 }

 - (BOOL)isFinished {
     return finished;
 }

 - (void)completeOperation {
     [self willChangeValueForKey:@"isFinished"];
     [self willChangeValueForKey:@"isExecuting"];

     executing = NO;
     finished = YES;

     [self didChangeValueForKey:@"isExecuting"];
     [self didChangeValueForKey:@"isFinished"];
 }

 - (void)executeCompletionBlockAccessToken:(NSString *)accessToken {
     [self executeCompletionBlockAccessToken:accessToken error:nil];
 }

 - (void)executeCompletionBlockError:(NSError *)error {
     [self executeCompletionBlockAccessToken:nil error:error];
 }

 - (void)executeCompletionBlockAccessToken:(NSString *)accessToken error:(NSError *)error {
     if (self.operationCompletionBlock) {
         void (^completionBlock)(NSString *accessToken, NSError *error);
         completionBlock = self.operationCompletionBlock;
         self.operationCompletionBlock = nil; // Prevent multiple execution if method on this request gets called inside completion block
         completionBlock(accessToken, error);
     }
     [self completeOperation];
 }

 @end
	/*
	Licensed to the Apache Software Foundation (ASF) under one
	or more contributor license agreements. See the NOTICE file
	distributed with this work for additional information
	regarding copyright ownership. The ASF licenses this file
	to you under the Apache License, Version 2.0 (the
	"License"); you may not use this file except in compliance
	with the License. You may obtain a copy of the License at

	http://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing,
	software distributed under the License is distributed on an
	"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	KIND, either express or implied. See the License for the
	specific language governing permissions and limitations
	under the License.
	*/

	#import "CMISOAuthAuthenticationProvider.h"
	#import "CMISOAuthToken.h"
	#import "CMISLog.h"
	#import "CMISBindingSession.h"
	#import "CMISErrors.h"
	#import "CMISHttpResponse.h"
	#import "CMISHttpRequest.h"
	#import "CMISURLUtil.h"
	#import "CMISDictionaryUtil.h"
	#import "CMISDefaultNetworkProvider.h"
	#import "CMISOAuthHttpRequest.h"
	#import "CMISOAuthHttpResponse.h"

	@interface CMISOAuthAuthenticationProvider ()

	@property (nonatomic, strong, readwrite) CMISOAuthToken *token;
	@property (nonatomic, strong) NSNumber *defaultTokenLifetime;

	@property (nonatomic, weak) CMISBindingSession *session;

	@property (nonatomic, strong) NSOperationQueue *operationQueue;

	@end

	@interface CMISOAuthFetchOperation : NSOperation {
	BOOL executing;
	BOOL finished;
	}

	@property (nonatomic, weak) CMISOAuthAuthenticationProvider *authProvider;
	@property (nonatomic, weak) NSThread *originalThread;
	@property (nonatomic, copy) void (^operationCompletionBlock)(NSString accessToken, NSError error);

	- (instancetype)initWithOAuthProvider:(CMISOAuthAuthenticationProvider )authProvider completionBlock:(void(^)(NSString accessToken, NSError *error))completionBlock;
	- (void)completeOperation;

	@end

	@implementation CMISOAuthAuthenticationProvider

	- (instancetype)init
	{
	self = [super init];
	if (self) {
	self.defaultTokenLifetime = [NSNumber numberWithInt:3600];

	self.operationQueue = [[NSOperationQueue alloc] init];
	/* We need a serial queue as we need to make sure that only one thread at a time requests or refreshes the token
	* We cannot use a NSLock object to synchronize or else we would run into a deadlock because of the asynchronous call to the server */
	[self.operationQueue setMaxConcurrentOperationCount:1];
	if ([self.operationQueue respondsToSelector:@selector(setQualityOfService:)]) {
	// Supported since iOS8
	[self.operationQueue setQualityOfService:NSQualityOfServiceBackground];
	}
	}
	return self;
	}

	- (void)setSession:(CMISBindingSession *)session
	{
	_session = session;

	if (self.token == nil) {
	// get predefined access token
	NSString *accessToken = nil;
	if ([[self.session objectForKey:kCMISSessionParameterOAuthAccessToken] isKindOfClass:NSString.class]) {
	accessToken = (NSString *)[self.session objectForKey:kCMISSessionParameterOAuthAccessToken];
	}

	// get predefined refresh token
	NSString *refreshToken = nil;
	if ([[self.session objectForKey:kCMISSessionParameterOAuthRefreshToken] isKindOfClass:NSString.class]) {
	refreshToken = (NSString *)[self.session objectForKey:kCMISSessionParameterOAuthRefreshToken];
	}

	// get predefined expiration timestamp
	NSNumber *expirationTimestamp = [NSNumber numberWithInt:0];
	if ([[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp] isKindOfClass:NSString.class]) {
	expirationTimestamp = [NSNumber numberWithLongLong:[[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp] longLongValue]];
	} else if ([[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp] isKindOfClass:NSNumber.class]) {
	expirationTimestamp = (NSNumber *)[self.session objectForKey:kCMISSessionParameterOAuthExpirationTimestamp];
	}

	// get default token lifetime
	if ([[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime] isKindOfClass:NSString.class]) {
	self.defaultTokenLifetime = [NSNumber numberWithLongLong:[[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime] longLongValue]];
	} else if ([[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime] isKindOfClass:NSNumber.class]) {
	self.defaultTokenLifetime = (NSNumber *)[self.session objectForKey:kCMISSessionParameterOAuthDefaultTokenLifetime];
	}

	self.token = [[CMISOAuthToken alloc] initWithAccessToken:accessToken refreshToken:refreshToken expirationTimestamp:expirationTimestamp];
	}
	}

	- (void)asyncHttpHeadersToApply:(void(^)(NSDictionary headers, NSError cmisError))completionBlock
	{
	CMISOAuthFetchOperation oAuthFetchOperation = [[CMISOAuthFetchOperation alloc] initWithOAuthProvider:self completionBlock:^(NSString accessToken, NSError *error) {
	if (error) {
	completionBlock(nil, error);
	} else {
	NSMutableDictionary *headers = [[super httpHeadersToApply] mutableCopy]; //TODO check if httpHeadersToApply should be called
	if(!headers) {
	headers = [NSMutableDictionary new];
	}

	[headers setObject:[NSSet setWithObject:[NSString stringWithFormat:@"Bearer %@", accessToken]] forKey:@"Authorization"];

	completionBlock(headers, nil);
	}
	}];

	[self.operationQueue addOperation:oAuthFetchOperation];
	}


	@end

	@implementation CMISOAuthFetchOperation

	- (instancetype)initWithOAuthProvider:(CMISOAuthAuthenticationProvider )authProvider completionBlock:(void (^)(NSString , NSError *))completionBlock
	{
	self = [super init];
	if (self) {
	self.authProvider = authProvider;
	self.operationCompletionBlock = completionBlock;
	self.originalThread = [NSThread currentThread];
	}
	return self;
	}

	- (void)main
	{
	// do not invoke super!

	if (self.isCancelled) {
	NSError *error = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeCancelled detailedDescription:@"Could not get token as CMISOAuthFetchOperation was cancelled"];
	[self performSelector:@selector(executeCompletionBlockError:) onThread:self.originalThread withObject:error waitUntilDone:NO];
	} else {
	[self accessTokenWithCompletionBlock:^(NSError *error) {
	// call the completion block on the original thread
	if (self.originalThread) {
	if (error) {
	[self performSelector:@selector(executeCompletionBlockError:) onThread:self.originalThread withObject:error waitUntilDone:NO];
	} else {
	[self performSelector:@selector(executeCompletionBlockAccessToken:) onThread:self.originalThread withObject:self.authProvider.token.accessToken waitUntilDone:NO];
	}
	}
	}];
	}
	}

	- (void)accessTokenWithCompletionBlock:(void(^)(NSError *error))completionBlock
	{
	void (^continueWithUpdatedToken)(NSError) = ^(NSError error) {

	[self.authProvider.delegate cmisOAuthAuthenticationProvider:self.authProvider didUpdateToken:self.authProvider.token withError:error];

	completionBlock(error);
	};

	if (!self.authProvider.token.accessToken) {
	if (!self.authProvider.token.refreshToken) {
	[self requestToken:continueWithUpdatedToken];
	} else {
	[self refreshToken:continueWithUpdatedToken];
	}
	} else if ([self.authProvider.token isExpired]) {
	[self refreshToken:continueWithUpdatedToken];
	} else { // we already have a valid token
	completionBlock(nil);
	}
	}

	- (void)requestToken:(void(^)(NSError *error))completionBlock
	{
	if ([CMISLog sharedInstance].logLevel == CMISLogLevelDebug) {
	CMISLogDebug(@"Requesting new OAuth access token.");
	}

	[self makeRequestIsRefresh:NO completionBlock:^(NSError *error) {
	if ([CMISLog sharedInstance].logLevel == CMISLogLevelTrace) {
	CMISLogTrace(@"%@", [self.authProvider.token description]);
	}

	completionBlock(error);
	}];
	}

	- (void)refreshToken:(void(^)(NSError *error))completionBlock
	{
	if ([CMISLog sharedInstance].logLevel == CMISLogLevelDebug) {
	CMISLogDebug(@"Refreshing OAuth access token.");
	}

	[self makeRequestIsRefresh:YES completionBlock:^(NSError *error) {
	if ([CMISLog sharedInstance].logLevel == CMISLogLevelTrace) {
	CMISLogTrace(@"%@", [self.authProvider.token description]);
	}

	completionBlock(error);
	}];
	}

	- (void)makeRequestIsRefresh:(BOOL)isRefresh completionBlock:(void(^)(NSError *error))completionBlock
	{
	id tokenEndpoint = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthTokenEndpoint];
	if (![tokenEndpoint isKindOfClass:NSString.class]) {
	completionBlock([CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Token endpoint not set!"]);
	}

	if (isRefresh && !self.authProvider.token.refreshToken) {
	completionBlock([CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"No refresh token!"]);
	}

	NSDictionary *headers = @{@"Content-Type" : @"application/x-www-form-urlencoded; charset=UTF-8"};

	NSMutableData *requestBody = [NSMutableData new];
	// compile request
	if (isRefresh) {
	[self appendString:@"grant_type=refresh_token" toData:requestBody];

	[self appendString:@"&refresh_token=" toData:requestBody];
	[self appendString:[CMISURLUtil encodeUrlParameterValue:self.authProvider.token.refreshToken] toData:requestBody];
	} else {
	[self appendString:@"grant_type=authorization_code" toData:requestBody];

	id code = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthCode];
	if (code) {
	[self appendString:@"&code=" toData:requestBody];
	[self appendString:[CMISURLUtil encodeUrlParameterValue:[code description]] toData:requestBody];
	}

	id redirectUri = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthRedirectUri];
	if (redirectUri) {
	[self appendString:@"&redirect_uri=" toData:requestBody];
	[self appendString:[CMISURLUtil encodeUrlParameterValue:[redirectUri description]] toData:requestBody];
	}
	}

	id clientId = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthClientId];
	if (clientId) {
	[self appendString:@"&client_id=" toData:requestBody];
	[self appendString:[CMISURLUtil encodeUrlParameterValue:[clientId description]] toData:requestBody];
	}

	id clientSecret = [self.authProvider.session objectForKey:kCMISSessionParameterOAuthClientSecret];
	if (clientSecret) {
	[self appendString:@"&client_secret=" toData:requestBody];
	[self appendString:[CMISURLUtil encodeUrlParameterValue:[clientSecret description]] toData:requestBody];
	}

	if ([CMISLog sharedInstance].logLevel == CMISLogLevelTrace) {
	CMISLogTrace(@"Request body: %@", [[NSString alloc] initWithData:requestBody encoding:NSUTF8StringEncoding]);
	}

	// request token
	__weak typeof(self) weakSelf = self;
	[self invoke:[NSURL URLWithString:(NSString *)tokenEndpoint]
	httpMethod:HTTP_POST
	session:self.authProvider.session
	body:requestBody
	headers:headers
	cmisRequest:nil
	completionBlock:^(CMISHttpResponse httpResponse, NSError error) {
	NSError *cmisError = nil;
	if (error) {
	completionBlock(error);
	} else {
	// parse response
	NSDictionary *jsonDictionary = [CMISOAuthHttpResponse parseResponse:httpResponse error:&cmisError];

	if(cmisError) { // there was an error parsing the response
	completionBlock(cmisError);
	} else {
	id tokenType = [jsonDictionary cmis_objectForKeyNotNull:@"token_type"];
	if (![tokenType isKindOfClass:NSString.class] \|\| [@"bearer" caseInsensitiveCompare:(NSString *) tokenType] != NSOrderedSame) {
	cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:[NSString stringWithFormat:@"Unsupported OAuth token type: %@", tokenType]];
	completionBlock(cmisError);
	return;
	}

	id jsonAccessToken = [jsonDictionary cmis_objectForKeyNotNull:@"access_token"];
	if (![jsonAccessToken isKindOfClass:NSString.class]) {
	cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Invalid OAuth access_token!"];
	completionBlock(cmisError);
	return;

	}

	id jsonRefreshToken = [jsonDictionary cmis_objectForKeyNotNull:@"refresh_token"];
	if (jsonRefreshToken && ![jsonRefreshToken isKindOfClass:NSString.class]) {
	cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Invalid OAuth refresh_token!"];
	completionBlock(cmisError);
	return;
	}

	NSNumber *expiresIn = weakSelf.authProvider.defaultTokenLifetime;
	id jsonExpiresIn = [jsonDictionary cmis_objectForKeyNotNull:@"expires_in"];
	if (jsonExpiresIn) {
	if ([jsonExpiresIn isKindOfClass:NSNumber.class]) {
	expiresIn = (NSNumber *)jsonExpiresIn;
	} else if ([jsonExpiresIn isKindOfClass:NSString.class]) {
	expiresIn = [NSNumber numberWithLongLong:[(NSString *)jsonExpiresIn longLongValue]];
	} else {
	cmisError = [CMISErrors createCMISErrorWithCode:kCMISErrorCodeConnection detailedDescription:@"Invalid OAuth expires_in value!"];
	completionBlock(cmisError);
	return;
	}
	}

	if ([expiresIn longLongValue] <= 0) {
	expiresIn = self.authProvider.defaultTokenLifetime;
	}

	weakSelf.authProvider.token = [[CMISOAuthToken alloc] initWithAccessToken:jsonAccessToken refreshToken:jsonRefreshToken expirationTimestamp:[NSNumber numberWithLongLong:([expiresIn longLongValue] * 1000 + [[NSDate date] timeIntervalSince1970] * 1000)]]; // seconds to milliseconds
	completionBlock(nil); // success
	}
	}
	}];
	}

	- (void)invoke:(NSURL )url httpMethod:(CMISHttpRequestMethod)httpRequestMethod session:(CMISBindingSession )session body:(NSData )body headers:(NSDictionary )headers cmisRequest:(CMISRequest )cmisRequest completionBlock:(void (^)(CMISHttpResponse , NSError *))completionBlock
	{
	NSMutableURLRequest *urlRequest = [CMISDefaultNetworkProvider createRequestForUrl:url
	httpMethod:httpRequestMethod
	session:session];
	if (!cmisRequest.isCancelled) {
	CMISHttpRequest* request = [CMISOAuthHttpRequest startRequest:urlRequest
	httpMethod:httpRequestMethod
	requestBody:body
	headers:headers
	session:session
	completionBlock:completionBlock];
	if (request) {
	cmisRequest.httpRequest = request;
	}
	} else {
	if (completionBlock) {
	completionBlock(nil, [CMISErrors createCMISErrorWithCode:kCMISErrorCodeCancelled
	detailedDescription:@"Request was cancelled"]);
	}
	}
	}

	- (void)appendString:(NSString )string toData:(NSMutableData )data
	{
	[data appendData:[string dataUsingEncoding:NSUTF8StringEncoding]];
	}

	- (BOOL)isConcurrent {
	return NO;
	}

	- (BOOL)isExecuting {
	return executing;
	}

	- (BOOL)isFinished {
	return finished;
	}

	- (void)completeOperation {
	[self willChangeValueForKey:@"isFinished"];
	[self willChangeValueForKey:@"isExecuting"];

	executing = NO;
	finished = YES;

	[self didChangeValueForKey:@"isExecuting"];
	[self didChangeValueForKey:@"isFinished"];
	}

	- (void)executeCompletionBlockAccessToken:(NSString *)accessToken {
	[self executeCompletionBlockAccessToken:accessToken error:nil];
	}

	- (void)executeCompletionBlockError:(NSError *)error {
	[self executeCompletionBlockAccessToken:nil error:error];
	}

	- (void)executeCompletionBlockAccessToken:(NSString )accessToken error:(NSError )error {
	if (self.operationCompletionBlock) {
	void (^completionBlock)(NSString accessToken, NSError error);
	completionBlock = self.operationCompletionBlock;
	self.operationCompletionBlock = nil; // Prevent multiple execution if method on this request gets called inside completion block
	completionBlock(accessToken, error);
	}
	[self completeOperation];
	}

	@end