@jorenvandeweyer I think this is a very good approach. What I'd like to see, since this is a good chance at least, is to stronger bind these tests to paragraphs in the standard. For example we could use the phrasing from the standard(s) when writing the (un)its or refer to the sections, if possible.

@jorenvandeweyer I have a question - do you propose these tests, because the current password grant tests are incomplete or do you want to test more towards standard compliance?

If second - I would propose to refactor the paths from /integration to /compliance so it's clear these tests are not only simply testing integration

Then another thing on the DB I think it would be good to reuse the DB across other tests, so maybe exporting some factory function would be good so every test flow would start with a clean-state DB instance?

The current "integration" tests are currently testing the grant flows step by step. I think the real integration tests that test the complete flow from start to end are missing.

It think it's an opportunity to test the compliance in these tests too.

I'll finish this pull request this weekend, and include a factory for the db.

I read quickly over it. It seems about right. Also it does not touch any old code, so there is no risk, that we break something. I personally dont like the should notation, but hey... the other unit tests are also in should notation, so for having the same principle over the whole project, I will not demand a change. :D

I think I implemented all feedback. Can this be merged? I want to write some compliance tests for the other grant types in a different pull request.