27763d19ea
idpyoidc already gates refresh-token issuance on the offline_access scope (verified by test), but the refresh-token grant was configured to also mint fresh ID tokens. Drop id_token from the refresh_token grant's supports_minting so refreshing yields only access (and a rotated refresh) token; ID tokens come from authentication. Refresh-token rotation is retained. Refs: porchlight-553 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_app_integration.py | ||
| test_authorization.py | ||
| test_claims.py | ||
| test_consent_flow.py | ||
| test_discovery.py | ||
| test_e2e_flow.py | ||
| test_login_oidc_redirect.py | ||
| test_provider.py | ||
| test_token.py | ||
| test_userinfo.py | ||