2010-11-16 version 2.0.0

Major change: you are no longer able to get an access token with the scope if
the client is not registered to have this scope. The global setting scopes is
gone (not backward compatible). You will need to manually add scopes to your
clients, e.g. in mogno console:

  db.oauth2.clients.update({}, { $set: { scopes: ["read", "write"] } }, true, true)

Rack::OAuth2::Server class methods get register -- for registering and updating
client application record -- and get_token_for -- to obtain new/existing token.

Web console now allows you to set/unset individual scopes for each client
application.

Added Sammy.js OAuth 2.0 plugin.


2010-11-12 version 1.4.6

Added Railtie support for Rails 3.x and now running tests against both Rails
2.x and 3.x.


2010-11-11 version 1.4.5

Cosmetic changes to UI. Added throbber and error messages when AJAX requests go
foul. Header on the left, sign-out on the right, as most people expect it.
Client name is no longer a link to the site, site link shown separately.


2010-11-10 version 1.4.4

Added a practice server. You can use it to test your OAuth 2.0 client library.
To fire up the practice server: oauth2-server practice

Bumped up dependencies on Rack 1.1 or later, Sinatra 1.1 or later.


2010-11-09 version 1.4.3

Renamed Rack::OAuth2::Server::Admin to just Rack::OAuth2::Admin.

Checked in config.ru, I use this for testing the Web console.


2010-11-09 version 1.4.2

Fix to commend line tool to properly do authentication.

Added Sinatra as dependency.


2010-11-09 version 1.4.1

Fix to command line tool when accessing MongoDB with username/password.


2010-11-09 version 1.4.0

If authorization handle is passed as request parameter (the recommended way),
then you can call oauth.grant! with a single argument and oauth.deny! with no
arguments.

You can now call oauth.deny! at any point during the authorization flow, e.g.
automatically deny all requests based on scope and client.

To deny access, return status code 403 (was, incorrectly 401). Or just use
oauth.deny!.

Web console gets template_url setting you can use to map access token identity
into a URL in your application. The substitution variable is "{id}".

Added error page when authorization attempt fails (instead of endless
redirect).

Fixed mounting of Web console on Rails. If it failed you before, try again.

Fixed documentation for configuration under Rails, clarify that all the
interesting stuff happens in after_initialize.

Fixed error responses for response_type=token to use fragment identifier.


2010-11-08 version 1.3.1

Added command line tool, helps you get started and setup:
  $ oauth2-server setup --db my_db

Added a touch of color to the UI and ability to delete a client.

You can not sign out of the Web console.


2010-11-07 version 1.3.0

Added OAuth authorization console.

Added param_authentication option: turn this on if you need to support
oauth_token query parameter or form field. Disabled by default.

Added host option: only check requests sent to that host (e.g. only check
requests to api.example.com).

Added path option: only check requests under this path (e.g. only check
requests for /api/...).


2010-11-03 version 1.2.2

Store ObjectId references in database.


2010-11-03 version 1.2.1

Make sure order of scope no longer important for access token lookup.


2010-11-02 version 1.2.0

You can now redirect to /oauth/authorize with authorization query parameter and
it will do the right thing.


2010-11-02 version 1.1.1

Fixed missing rails/init.rb.


2010-11-02 version 1.1.0

Renamed oauth.resource as oauth.identity to remove confusion, besides, it's
more often identity than anything else.

Added automagic loading under Rails, no need to require special path.

Added Rack::OAuth2::Server::Options class, easier to user than Hash.

Added indexes for speedier queries.


2010-11-02 version 1.0.0

World premiere.