Fix bugs with refresh tokens

Author: nsklikas

src/oidcop/oauth2/token.py

@@ -253,7 +253,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
         _resp = {
             "access_token": access_token.value,
             "token_type": access_token.token_type,
-            "scope": _grant.scope,
+            "scope": scope,
         }
 
         if access_token.expires_at:
@@ -318,7 +318,7 @@ def post_parse_request(
         if "scope" in request:
             req_scopes = set(request["scope"])
             scopes = set(grant.find_scope(token.based_on))
-            if scopes < req_scopes:
+            if not req_scopes.issubset(scopes):
                 return self.error_cls(
                     error="invalid_request",
                     error_description="Invalid refresh scopes",

src/oidcop/oidc/token.py

@@ -218,7 +218,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
         _resp = {
             "access_token": access_token.value,
             "token_type": token_type,
-            "scope": _grant.scope,
+            "scope": scope,
         }
 
         if access_token.expires_at:
@@ -307,7 +307,7 @@ def post_parse_request(
         if "scope" in request:
             req_scopes = set(request["scope"])
             scopes = set(grant.find_scope(token.based_on))
-            if scopes < req_scopes:
+            if not req_scopes.issubset(scopes):
                 return self.error_cls(
                     error="invalid_request",
                     error_description="Invalid refresh scopes",

tests/test_24_oauth2_token_endpoint.py

@@ -458,7 +458,7 @@ def test_refresh_scopes(self):
             _session_info["session_id"], _resp["response_args"]["refresh_token"]
         )
 
-        assert at.scope == rt.scope == _request["scope"]
+        assert at.scope == rt.scope == _request["scope"] == _resp["response_args"]["scope"]
 
     def test_refresh_more_scopes(self):
         areq = AUTH_REQ.copy()
@@ -475,7 +475,7 @@ def test_refresh_more_scopes(self):
 
         _request = REFRESH_TOKEN_REQ.copy()
         _request["refresh_token"] = _resp["response_args"]["refresh_token"]
-        _request["scope"] = ["email", "profile"]
+        _request["scope"] = ["ema"]
 
         _req = self.token_endpoint.parse_request(_request.to_json())
         assert isinstance(_req, TokenErrorResponse)
@@ -534,7 +534,7 @@ def test_refresh_more_scopes_2(self):
             _session_info["session_id"], _resp["response_args"]["refresh_token"]
         )
 
-        assert at.scope == rt.scope == _request["scope"]
+        assert at.scope == rt.scope == _request["scope"] == _resp["response_args"]["scope"]
 
     def test_do_refresh_access_token_not_allowed(self):
         areq = AUTH_REQ.copy()

tests/test_35_oidc_token_endpoint.py

@@ -485,7 +485,7 @@ def test_refresh_scopes(self):
             _session_info["session_id"], _resp["response_args"]["refresh_token"]
         )
 
-        assert at.scope == rt.scope == _request["scope"]
+        assert at.scope == rt.scope == _request["scope"] == _resp["response_args"]["scope"]
 
     def test_refresh_more_scopes(self):
         areq = AUTH_REQ.copy()
@@ -590,7 +590,7 @@ def test_refresh_more_scopes_2(self):
             _session_info["session_id"], _resp["response_args"]["refresh_token"]
         )
 
-        assert at.scope == rt.scope == _request["scope"]
+        assert at.scope == rt.scope == _request["scope"] == _resp["response_args"]["scope"]
 
     def test_refresh_less_scopes(self):
         areq = AUTH_REQ.copy()
@@ -635,6 +635,7 @@ def test_refresh_less_scopes(self):
         )
 
         assert "email" not in idtoken
+        assert  _resp["response_args"]["scope"] == ["openid", "offline_access"]
 
     def test_refresh_no_openid_scope(self):
         areq = AUTH_REQ.copy()
@@ -673,6 +674,7 @@ def test_refresh_no_openid_scope(self):
             "refresh_token",
             "scope",
         }
+        assert _resp["response_args"]["scope"] == ["offline_access"]
 
     def test_refresh_no_offline_access_scope(self):
         areq = AUTH_REQ.copy()
@@ -716,6 +718,7 @@ def test_refresh_no_offline_access_scope(self):
             self.endpoint_context.keyjar,
             sender="",
         )
+        assert _resp["response_args"]["scope"] == ["openid"]
 
     def test_new_refresh_token(self, conf):
         self.endpoint_context.cdb["client_1"] = {