Made sure all endpoints used the self._create_request() method and referred to request.resource_owner_key instead of request.oauth_token

3 files changed, 10 insertions, 8 deletions

diff --git a/oauthlib/oauth1/rfc5849/endpoints/access_token.py b/oauthlib/oauth1/rfc5849/endpoints/access_token.py
index 9ad185a..e89aa00 100644
--- a/oauthlib/oauth1/rfc5849/endpoints/access_token.py
+++ b/oauthlib/oauth1/rfc5849/endpoints/access_token.py
@@ -36,7 +36,7 @@ class AccessTokenEndpoint(BaseEndpoint):
         :returns: The token as an urlencoded string.
         """
         request.realms = self.request_validator.get_realms(
-                request.oauth_token, request)
+                request.resource_owner_key, request)
         token = {
             'oauth_token': self.token_generator(),
             'oauth_token_secret': self.token_generator(),
diff --git a/oauthlib/oauth1/rfc5849/endpoints/authorization.py b/oauthlib/oauth1/rfc5849/endpoints/authorization.py
index 1cc0915..5aa4388 100644
--- a/oauthlib/oauth1/rfc5849/endpoints/authorization.py
+++ b/oauthlib/oauth1/rfc5849/endpoints/authorization.py
@@ -90,12 +90,12 @@ class AuthorizationEndpoint(BaseEndpoint):
         request = self._create_request(uri, http_method=http_method, body=body,
                 headers=headers)
 
+        if not request.resource_owner_key:
+            raise errors.InvalidRequestError('request.resource_owner_key must be set after '
+                                      'request token verification.')
         if not self.request_validator.verify_request_token(
                 request.resource_owner_key, request):
             raise errors.InvalidClientError()
-        if not request.resource_owner_key:
-            raise NotImplementedError('request.resource_owner_key must be set after '
-                                      'request token verification.')
 
         request.realms = realms
         if (request.realms and not self.request_validator.verify_realms(
@@ -123,13 +123,13 @@ class AuthorizationEndpoint(BaseEndpoint):
                   2. A dict of credentials which may be useful in creating the
                   authorization form.
         """
-        request = Request(uri, http_method=http_method, body=body,
+        request = self._create_request(uri, http_method=http_method, body=body,
                 headers=headers)
 
         if not self.request_validator.verify_request_token(
-                request.oauth_token, request):
+                request.resource_owner_key, request):
             raise errors.InvalidClientError()
 
         realms = self.request_validator.get_realms(
-                request.oauth_token, request)
-        return realms, {'resource_owner_key': request.oauth_token}
+                request.resource_owner_key, request)
+        return realms, {'resource_owner_key': request.resource_owner_key}
diff --git a/oauthlib/oauth1/rfc5849/request_validator.py b/oauthlib/oauth1/rfc5849/request_validator.py
index de5b623..70ce6d9 100644
--- a/oauthlib/oauth1/rfc5849/request_validator.py
+++ b/oauthlib/oauth1/rfc5849/request_validator.py
@@ -736,6 +736,8 @@ class RequestValidator(object):
         """Associate an authorization verifier with a request token.
 
         :param token: A request token string.
+        :param verifier A dictionary containing the oauth_verifier and 
+                        oauth_token
         :param request: An oauthlib.common.Request object.
 
         We need to associate verifiers with tokens for validation during the