From a02fb687a603463f4fad8c4f0ab8f59326ac8548 Mon Sep 17 00:00:00 2001
From: Jenny Bryan <jenny.f.bryan@gmail.com>
Date: Sat, 4 Nov 2017 20:37:33 -0700
Subject: [PATCH 1/2] Normalize scopes in the hash; fixes #494

---
 R/oauth-token.r                   | 9 ++++++++-
 tests/testthat/test-oauth-cache.R | 4 +++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/R/oauth-token.r b/R/oauth-token.r
index 811bd70c..8be1bdf8 100644
--- a/R/oauth-token.r
+++ b/R/oauth-token.r
@@ -104,7 +104,10 @@ Token <- R6::R6Class("Token", list(
     # endpoint = which site
     # app = client identification
     # params = scope
-    msg <- serialize(list(self$endpoint, self$app, self$params$scope), NULL)
+    msg <- serialize(
+      list(self$endpoint, self$app, normalize_scopes(self$params$scope)),
+      NULL
+    )
 
     # for compatibility with digest::digest()
     paste(openssl::md5(msg[-(1:14)]), collapse = "")
@@ -349,3 +352,7 @@ TokenServiceAccount <- R6::R6Class("TokenServiceAccount", inherit = Token2.0, li
   cache = function(path) self,
   load_from_cache = function() self
 ))
+
+normalize_scopes <- function(x) {
+  setNames(sort(unique(x)), NULL)
+}
diff --git a/tests/testthat/test-oauth-cache.R b/tests/testthat/test-oauth-cache.R
index ecdc2d44..2ddf6672 100644
--- a/tests/testthat/test-oauth-cache.R
+++ b/tests/testthat/test-oauth-cache.R
@@ -30,13 +30,14 @@ test_that("use_cache() respects options", {
   expect_equal(use_cache(), ".httr-oauth")
 })
 
-test_that("token saved to and restored from cache", {
+test_that("token saved to and restored from cache, scopes normalized in hash", {
   owd <- setwd(tmp_dir())
   on.exit(setwd(owd))
 
   token_a <- Token2.0$new(
     app = oauth_app("x", "y", "z"),
     endpoint = oauth_endpoints("google"),
+    params = list(scope = c(a = "a", "b")),
     cache_path = ".tmp-cache",
     credentials = list(a = 1)
   )
@@ -45,6 +46,7 @@ test_that("token saved to and restored from cache", {
   token_b <- Token2.0$new(
     app = oauth_app("x", "y", "z"),
     endpoint = oauth_endpoints("google"),
+    params = list(scope = c(b = "b", "a")),
     cache_path = ".tmp-cache"
   )
 

From bf8cf5ab3773044db7397adca3ff737eee1ed596 Mon Sep 17 00:00:00 2001
From: Jenny Bryan <jenny.f.bryan@gmail.com>
Date: Wed, 21 Nov 2018 17:40:57 -0800
Subject: [PATCH 2/2] Add NEWS bullet

---
 NEWS.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS.md b/NEWS.md
index db3da849..f7238e69 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,5 +1,7 @@
 # httr 1.3.1.9000
 
+* Scopes are de-duplicated, sorted, and stripped of names before being hashed. This eliminates a source of hash mismatch that causes new tokens to be requested, even when existing tokens have the necessary scope. (@jennybc, #495)
+
 * The default value of `failure` argument in `parse_http_date()` is set to `structure(NA_real_, class = "Date")` so that the reponse with a "failure" date can be printed out correctly. (@shrektan, #544)
 
 # httr 1.3.1