From a06487c0f7c9a663a9cf725a03d2b71ed6eab6dd Mon Sep 17 00:00:00 2001
From: Joe Grandja <jgrandja@pivotal.io>
Date: Fri, 22 Sep 2017 15:21:22 -0400
Subject: [PATCH] Move additionalParameters to TokenResponseAttributes

Fixes gh-4554
---
 .../security/oauth2/core/AccessToken.java          | 14 --------------
 .../core/endpoint/TokenResponseAttributes.java     |  9 ++++++---
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AccessToken.java b/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AccessToken.java
index 06685ff321..72bf2e7442 100644
--- a/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AccessToken.java
+++ b/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AccessToken.java
@@ -19,7 +19,6 @@ import org.springframework.util.Assert;
 
 import java.time.Instant;
 import java.util.Collections;
-import java.util.Map;
 import java.util.Set;
 
 /**
@@ -38,7 +37,6 @@ import java.util.Set;
 public class AccessToken extends SecurityToken {
 	private final TokenType tokenType;
 	private final Set<String> scopes;
-	private final Map<String,Object> additionalParameters;
 
 	public static final class TokenType {
 		public static final TokenType BEARER = new TokenType("Bearer");
@@ -76,19 +74,11 @@ public class AccessToken extends SecurityToken {
 	}
 
 	public AccessToken(TokenType tokenType, String tokenValue, Instant issuedAt, Instant expiresAt, Set<String> scopes) {
-		this(tokenType, tokenValue, issuedAt, expiresAt, scopes, Collections.emptyMap());
-	}
-
-	public AccessToken(TokenType tokenType, String tokenValue, Instant issuedAt, Instant expiresAt,
-						Set<String> scopes, Map<String,Object> additionalParameters) {
-
 		super(tokenValue, issuedAt, expiresAt);
 		Assert.notNull(tokenType, "tokenType cannot be null");
 		this.tokenType = tokenType;
 		this.scopes = Collections.unmodifiableSet(
 			scopes != null ? scopes : Collections.emptySet());
-		this.additionalParameters = Collections.unmodifiableMap(
-			additionalParameters != null ? additionalParameters : Collections.emptyMap());
 	}
 
 	public TokenType getTokenType() {
@@ -98,8 +88,4 @@ public class AccessToken extends SecurityToken {
 	public Set<String> getScopes() {
 		return this.scopes;
 	}
-
-	public Map<String, Object> getAdditionalParameters() {
-		return additionalParameters;
-	}
 }
diff --git a/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/TokenResponseAttributes.java b/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/TokenResponseAttributes.java
index 0743aafdfd..20052bfa15 100644
--- a/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/TokenResponseAttributes.java
+++ b/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/TokenResponseAttributes.java
@@ -19,6 +19,7 @@ import org.springframework.security.oauth2.core.AccessToken;
 import org.springframework.util.Assert;
 
 import java.time.Instant;
+import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
 
@@ -32,6 +33,7 @@ import java.util.Set;
  */
 public final class TokenResponseAttributes {
 	private AccessToken accessToken;
+	private Map<String,Object> additionalParameters;
 
 	private TokenResponseAttributes() {
 	}
@@ -57,7 +59,7 @@ public final class TokenResponseAttributes {
 	}
 
 	public Map<String, Object> getAdditionalParameters() {
-		return this.accessToken.getAdditionalParameters();
+		return this.additionalParameters;
 	}
 
 	public static Builder withToken(String tokenValue) {
@@ -99,10 +101,11 @@ public final class TokenResponseAttributes {
 			Assert.isTrue(this.expiresIn >= 0, "expiresIn must be a positive number");
 			Instant issuedAt = Instant.now();
 			AccessToken accessToken = new AccessToken(this.tokenType, this.tokenValue, issuedAt,
-				issuedAt.plusSeconds(this.expiresIn), this.scopes, this.additionalParameters);
-
+				issuedAt.plusSeconds(this.expiresIn), this.scopes);
 			TokenResponseAttributes tokenResponse = new TokenResponseAttributes();
 			tokenResponse.accessToken = accessToken;
+			tokenResponse.additionalParameters = Collections.unmodifiableMap(
+				this.additionalParameters != null ? this.additionalParameters : Collections.emptyMap());
 			return tokenResponse;
 		}
 	}