Support revocation with URL-encoded parameters

Author: srook

lib/oauth2/client.rb

@@ -256,10 +256,10 @@ def get_token(params, access_token_opts = {}, extract_access_token = nil, &block
     # @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
     def revoke_token(token, token_type_hint = nil, params = {}, &block)
       params[:token_method] ||= :post_with_query_string
+      params[:token] = token
+      params[:token_type_hint] = token_type_hint if token_type_hint
+
       req_opts = params_to_req_opts(params)
-      req_opts[:params] ||= {}
-      req_opts[:params][:token] = token
-      req_opts[:params][:token_type_hint] = token_type_hint if token_type_hint
 
       request(http_method, revoke_url, req_opts, &block)
     end

spec/oauth2/client_spec.rb

@@ -1216,13 +1216,6 @@ def self.contains_token?(hash)
         }.not_to raise_error
       end
     end
-
-    def stubbed_client(params = {}, &stubs)
-      params = {site: "https://api.example.com"}.merge(params)
-      OAuth2::Client.new("abc", "def", params) do |builder|
-        builder.adapter :test, &stubs
-      end
-    end
   end
 
   describe "#revoke_token" do
@@ -1259,6 +1252,19 @@ def stubbed_client(params = {}, &stubs)
         }.not_to raise_error
       end
 
+      it "submits params in request body" do
+        client = stubbed_client do |stub|
+          stub.post("/oauth/revoke") do |req|
+            expect(req.body[:token]).to eq(token)
+            expect(req.params).to be_empty
+
+            [200, {"Content-Type" => "application/json"}, ""]
+          end
+        end
+
+        client.revoke_token(token, "access_token", token_method: :post)
+      end
+
       it "has status 200" do
         expect(instance.revoke_token(token, nil, extra: "param").status).to eq(200)
       end
@@ -1332,4 +1338,11 @@ def stubbed_client(params = {}, &stubs)
       expect(subject.inspect).to include("@secret=[FILTERED]")
     end
   end
+
+  def stubbed_client(params = {}, &stubs)
+    params = {site: "https://api.example.com"}.merge(params)
+    OAuth2::Client.new("abc", "def", params) do |builder|
+      builder.adapter :test, &stubs
+    end
+  end
 end