Wrong behavior in refreshing a token

[rishabhsairawat]

The behavior of refreshing a token is not valid.

Doorkeeper Configuration:

# config/initializers/doorkeeper.rb

Doorkeeper.configure do
  # ...
  access_token_expires_in 2.hours

  custom_access_token_expires_in do |context|
     1.hour if context.grant_type == Doorkeeper::OAuth::PASSWORD
  end

  use_refresh_token do |context|
     true if context.grant_type == Doorkeeper::OAuth::PASSWORD
  end
  
# ...
end

Steps to reproduce

1. Create a token using password grant_type.
2. The response of Step 1 will be having a token with expiry as 1 hour.
3. Now create a token using refresh_token from the last step.
4. The response of Step 3 will be having a token with expiry as 2 hours.

Expected behavior

Token expiry in both cases should be the same as I haven't defined token expiry for refresh_token grant type explicitly.

Actual behavior

The expiry of the token received after refreshing the original token isn't equal to the expiry of the original token. It violates the OAuth2.0 RFC:

Refresh tokens are issued to the client by the authorization server and are
used to obtain a new access token when the current access token
becomes invalid or expires, or to obtain additional access tokens
with identical or narrower scope (access tokens may have a shorter
lifetime and fewer permissions than authorized by the resource
owner).

I am using doorkeeper version 5.0.2. But the same problem exists with the master.

I think by default, the expiry of token received after refreshing should be the same as that of the original token. @nbulaj I can prepare a PR to fix this. But first let me know your thoughts on this.

[nbulaj]

I didn't figure out why it violates the OAuth2.0 RFC (just reading the text you posted above), but I definitely agree on that: "Token expiry in both cases should be the same" 👍

So it would be great to see a PR, thanks!

[nbulaj]

I didn't figure out why it violates the OAuth2.0 RFC (just reading the text you posted above), but I definitely agree on that: "Token expiry in both cases should be the same" 👍

So it would be great to see a PR, thanks!

[rishabhsairawat]

@nbulaj As RFC mentions that token received after refreshing the original token may have a shorter expiry. But here I am able to get token with more expiry than the original token.

[nbulaj]

Let's do it!