/** {@inheritDoc} */
  public void updateAuthorizationCode(AuthorizationCode authorizationCode) {
    deleteAuthorizationCode(authorizationCode.getTokenId());

    // Store in CTS
    try {
      tokenStore.create(authorizationCode);
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"UPDATED_AUTHORIZATION_CODE", authorizationCode.toString()};
        auditLogger.logAccessMessage("CREATED_AUTHORIZATION_CODE", obs, null);
      }
    } catch (CoreTokenException e) {
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"FAILED_UPDATE_AUTHORIZATION_CODE", authorizationCode.toString()};
        auditLogger.logErrorMessage("FAILED_UPDATE_AUTHORIZATION_CODE", obs, null);
      }
      logger.error(
          "DefaultOAuthTokenStoreImpl::Unable to create authorization code "
              + authorizationCode.getTokenInfo(),
          e);
      throw new OAuthProblemException(
          Status.SERVER_ERROR_INTERNAL.getCode(),
          "Internal error",
          "Could not create token in CTS",
          null);
    }
  }
  /** {@inheritDoc} */
  public DeviceCode createDeviceCode(
      Set<String> scope,
      String clientId,
      String nonce,
      String responseType,
      String state,
      String acrValues,
      String prompt,
      String uiLocales,
      String loginHint,
      Integer maxAge,
      String claims,
      OAuth2Request request,
      String codeChallenge,
      String codeChallengeMethod)
      throws ServerException, NotFoundException {

    logger.message("DefaultOAuthTokenStoreImpl::Creating Authorization code");

    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    final String deviceCode = UUID.randomUUID().toString();

    String userCode = null;
    int i;
    for (i = 0; userCode == null && i < 10; i++) {
      // A 6-byte array will result in an 8-char Base64 user code.
      byte[] randomBytes = new byte[6];
      secureRandom.nextBytes(randomBytes);
      userCode = Base64.encode(randomBytes);
      try {
        readDeviceCode(userCode, request);
        // code can be found - try again
      } catch (InvalidGrantException e) {
        // Good, it doesn't exist yet.
        break;
      } catch (ServerException e) {
        logger.message("Could not query CTS, assume duplicate to be safe", e);
      }
      userCode = null;
    }

    if (i == 10) {
      throw new ServerException("Could not generate a unique user code");
    }

    long expiryTime =
        System.currentTimeMillis() + (1000 * providerSettings.getDeviceCodeLifetime());
    final DeviceCode code =
        new DeviceCode(
            deviceCode,
            userCode,
            clientId,
            nonce,
            responseType,
            state,
            acrValues,
            prompt,
            uiLocales,
            loginHint,
            maxAge,
            claims,
            expiryTime,
            scope,
            realmNormaliser.normalise(request.<String>getParameter(REALM)),
            codeChallenge,
            codeChallengeMethod);

    // Store in CTS
    try {
      tokenStore.create(code);
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"CREATED_DEVICE_CODE", code.toString()};
        auditLogger.logAccessMessage("CREATED_DEVICE_CODE", obs, null);
      }
    } catch (CoreTokenException e) {
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"FAILED_CREATE_DEVICE_CODE", code.toString()};
        auditLogger.logErrorMessage("FAILED_CREATE_DEVICE_CODE", obs, null);
      }
      logger.error("Unable to create device code " + code, e);
      throw new ServerException("Could not create token in CTS");
    }

    request.setToken(DeviceCode.class, code);

    return code;
  }
  /** {@inheritDoc} */
  public AccessToken createAccessToken(
      String grantType,
      String accessTokenType,
      String authorizationCode,
      String resourceOwnerId,
      String clientId,
      String redirectUri,
      Set<String> scope,
      RefreshToken refreshToken,
      String nonce,
      String claims,
      OAuth2Request request)
      throws ServerException, NotFoundException {

    OpenIdConnectClientRegistration clientRegistration = getClientRegistration(clientId, request);

    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    final String id = UUID.randomUUID().toString();
    final String auditId = UUID.randomUUID().toString();

    String realm = realmNormaliser.normalise(request.<String>getParameter(REALM));

    long expiryTime = 0;
    if (clientRegistration == null) {
      expiryTime = providerSettings.getAccessTokenLifetime() + System.currentTimeMillis();
    } else {
      expiryTime =
          clientRegistration.getAccessTokenLifeTime(providerSettings) + System.currentTimeMillis();
    }

    final AccessToken accessToken;
    if (refreshToken == null) {
      accessToken =
          new OpenAMAccessToken(
              id,
              authorizationCode,
              resourceOwnerId,
              clientId,
              redirectUri,
              scope,
              expiryTime,
              null,
              OAuth2Constants.Token.OAUTH_ACCESS_TOKEN,
              grantType,
              nonce,
              realm,
              claims,
              auditId);
    } else {
      accessToken =
          new OpenAMAccessToken(
              id,
              authorizationCode,
              resourceOwnerId,
              clientId,
              redirectUri,
              scope,
              expiryTime,
              refreshToken.getTokenId(),
              OAuth2Constants.Token.OAUTH_ACCESS_TOKEN,
              grantType,
              nonce,
              realm,
              claims,
              auditId);
    }
    try {
      tokenStore.create(accessToken);
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"CREATED_TOKEN", accessToken.toString()};
        auditLogger.logAccessMessage("CREATED_TOKEN", obs, null);
      }
    } catch (CoreTokenException e) {
      logger.error("Could not create token in CTS: " + e.getMessage());
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"FAILED_CREATE_TOKEN", accessToken.toString()};
        auditLogger.logErrorMessage("FAILED_CREATE_TOKEN", obs, null);
      }
      throw new ServerException("Could not create token in CTS: " + e.getMessage());
    }
    request.setToken(AccessToken.class, accessToken);
    return accessToken;
  }
  /** {@inheritDoc} */
  public RefreshToken createRefreshToken(
      String grantType,
      String clientId,
      String resourceOwnerId,
      String redirectUri,
      Set<String> scope,
      OAuth2Request request)
      throws ServerException, NotFoundException {

    final String realm = realmNormaliser.normalise(request.<String>getParameter(REALM));

    logger.message("Create refresh token");

    OpenIdConnectClientRegistration clientRegistration = getClientRegistration(clientId, request);

    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);

    final String id = UUID.randomUUID().toString();
    final String auditId = UUID.randomUUID().toString();

    final long lifeTime;
    if (clientRegistration == null) {
      lifeTime = providerSettings.getRefreshTokenLifetime();
    } else {
      lifeTime = clientRegistration.getRefreshTokenLifeTime(providerSettings);
    }

    long expiryTime = lifeTime < 0 ? -1 : lifeTime + System.currentTimeMillis();

    AuthorizationCode token = request.getToken(AuthorizationCode.class);
    String authModules = null;
    String acr = null;
    if (token != null) {
      authModules = token.getAuthModules();
      acr = token.getAuthenticationContextClassReference();
    }

    RefreshToken currentRefreshToken = request.getToken(RefreshToken.class);
    if (currentRefreshToken != null) {
      authModules = currentRefreshToken.getAuthModules();
      acr = currentRefreshToken.getAuthenticationContextClassReference();
    }

    RefreshToken refreshToken =
        new OpenAMRefreshToken(
            id,
            resourceOwnerId,
            clientId,
            redirectUri,
            scope,
            expiryTime,
            OAuth2Constants.Bearer.BEARER,
            OAuth2Constants.Token.OAUTH_REFRESH_TOKEN,
            grantType,
            realm,
            authModules,
            acr,
            auditId);

    try {
      tokenStore.create(refreshToken);
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"CREATED_REFRESH_TOKEN", refreshToken.toString()};
        auditLogger.logAccessMessage("CREATED_REFRESH_TOKEN", obs, null);
      }
    } catch (CoreTokenException e) {
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"FAILED_CREATE_REFRESH_TOKEN", refreshToken.toString()};
        auditLogger.logErrorMessage("FAILED_CREATE_REFRESH_TOKEN", obs, null);
      }
      logger.error("Unable to create refresh token: " + refreshToken.getTokenInfo(), e);
      throw new ServerException("Could not create token in CTS: " + e.getMessage());
    }

    request.setToken(RefreshToken.class, refreshToken);

    return refreshToken;
  }
  /** {@inheritDoc} */
  public AuthorizationCode createAuthorizationCode(
      Set<String> scope,
      ResourceOwner resourceOwner,
      String clientId,
      String redirectUri,
      String nonce,
      OAuth2Request request,
      String codeChallenge,
      String codeChallengeMethod)
      throws ServerException, NotFoundException {

    logger.message("DefaultOAuthTokenStoreImpl::Creating Authorization code");

    OpenIdConnectClientRegistration clientRegistration = getClientRegistration(clientId, request);

    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    final String code = UUID.randomUUID().toString();

    long expiryTime = 0;
    if (clientRegistration == null) {
      expiryTime = providerSettings.getAuthorizationCodeLifetime() + System.currentTimeMillis();
    } else {
      expiryTime =
          clientRegistration.getAuthorizationCodeLifeTime(providerSettings)
              + System.currentTimeMillis();
    }

    final String ssoTokenId = getSsoTokenId(request);

    final OpenAMAuthorizationCode authorizationCode =
        new OpenAMAuthorizationCode(
            code,
            resourceOwner.getId(),
            clientId,
            redirectUri,
            scope,
            getClaimsFromRequest(request),
            expiryTime,
            nonce,
            realmNormaliser.normalise(request.<String>getParameter(REALM)),
            getAuthModulesFromSSOToken(request),
            getAuthenticationContextClassReferenceFromRequest(request),
            ssoTokenId,
            codeChallenge,
            codeChallengeMethod);

    // Store in CTS
    try {
      tokenStore.create(authorizationCode);
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"CREATED_AUTHORIZATION_CODE", authorizationCode.toString()};
        auditLogger.logAccessMessage("CREATED_AUTHORIZATION_CODE", obs, null);
      }
    } catch (CoreTokenException e) {
      if (auditLogger.isAuditLogEnabled()) {
        String[] obs = {"FAILED_CREATE_AUTHORIZATION_CODE", authorizationCode.toString()};
        auditLogger.logErrorMessage("FAILED_CREATE_AUTHORIZATION_CODE", obs, null);
      }
      logger.error("Unable to create authorization code " + authorizationCode.getTokenInfo(), e);
      throw new ServerException("Could not create token in CTS");
    }

    request.setToken(AuthorizationCode.class, authorizationCode);

    return authorizationCode;
  }