dup the options hash to avoid accidental mutation

lib/oauth2/access_token.rb

@@ -10,6 +10,7 @@ class << self
       # @param [Hash] a hash of AccessToken property values
       # @return [AccessToken] the initalized AccessToken
       def from_hash(client, hash)
+        hash = hash.dup
         new(client, hash.delete('access_token') || hash.delete(:access_token), hash)
       end
 
@@ -39,6 +40,7 @@ def from_kvform(client, kvform)
     def initialize(client, token, opts = {}) # rubocop:disable Metrics/AbcSize
       @client = client
       @token = token.to_s
+      opts = opts.dup
       [:refresh_token, :expires_in, :expires_at].each do |arg|
         instance_variable_set("@#{arg}", opts.delete(arg) || opts.delete(arg.to_s))
       end

spec/oauth2/access_token_spec.rb

@@ -44,6 +44,13 @@ def assert_initialized_token(target) # rubocop:disable Metrics/AbcSize
       assert_initialized_token(target)
     end
 
+    it 'does not modify opts hash' do
+      hash = {:access_token => token, :expires_at => Time.now.to_i}
+      hash_before = hash.dup
+      AccessToken.from_hash(client, hash)
+      expect(hash).to eq(hash_before)
+    end
+
     it 'initalizes with a form-urlencoded key/value string' do
       kvform = "access_token=#{token}&expires_at=#{Time.now.to_i + 200}&foo=bar"
       target = AccessToken.from_kvform(client, kvform)
@@ -57,6 +64,13 @@ def assert_initialized_token(target) # rubocop:disable Metrics/AbcSize
       expect(target.options[:mode]).to eq(:body)
     end
 
+    it 'does not modify opts hash' do
+      opts = {:param_name => 'foo', :header_format => 'Bearer %', :mode => :body}
+      opts_before = opts.dup
+      AccessToken.new(client, token, opts)
+      expect(opts).to eq(opts_before)
+    end
+
     it 'initializes with a string expires_at' do
       hash = {:access_token => token, :expires_at => '1361396829', 'foo' => 'bar'}
       target = AccessToken.from_hash(client, hash)