Coverage increased (+1.9%) to 89.918% when pulling 06f25d3 on singingwolfboy:oauthlib3 into 4fb0db5 on requests:master.

thanks for doing this! sorry i missed that str/bytes issue in the test for fake_refresh_with_auth.

fyi, i wrote both the 'breaking changes' PR for oauthlib and the #331 code you built off of. there are some new test cases in there that should make you feel better.

the most general description of #331 is this: previous versions of both libraries did some stuff that was not spec compliant by default, and made it impossible to do other things that are spec compliant. with this patch, both projects should now default to spec compliance but can still do non-compliant things if needed.

fyi, i wrote both the 'breaking changes' PR for oauthlib and the #331 code you built off of. there are some new test cases in there that should make you feel better.

Oh, that's good to know! In that case, I'm very confident that the code you wrote actually works correctly. :) I'll give it a few more days to let others object if they want (although I don't expect anyone will), and then I'll merge this to master.

When it gets released, do you think it should be a major version bump (2.0.0), minor version bump (1.2.0) or micro version bump (1.1.1)? Assuming that there are no other changes in the release, of course.

I think this should be fine as a minor bump. The only people who should expect problems are those who were relying on broken oauth2 implementations, because they:

• Are communicating with non-compliant servers which expect/require arguments on endpoints that do not require them (why oauthlib was modified).
• Have extensive tests which expect oauthlib/oauthlib-requests to generate URLs with certain arguments in them (why some tests in this library needed to be redone)

In both cases, it's because the oauth2 exchange was being implemented in a specially broken way, and oauthlib has exception messages that should properly educate the developer on what to do.

This "family" of PRs traces back to a regression in oauthlib where client_id was lost (oauthlib/oauthlib#585) when expected. A chunk of code was rewritten to pass it around more correctly, and not re-introduce the error which the regression had solved. A few other spec-compliant checks and auto-population of arguments that interacted with client_id were also introduced to ensure valid requests.