struct

Authly::AccessToken

Inherits JSON::Serializable < Struct < Value < Object

Patch: authly's refresh token (token_generator.cr#generate_refresh_token) carries sub => client_id and no resource-owner identity, and RefreshToken never overrides user_id. So refreshing an access token mints one with a random sub, losing the user — and, via our ClaimsProvider (which does User.find?(sub)), also dropping the u{n,e,p,r} block and the aud claim. This is the exact upstream gap the AuthorizationCode#user_id patch fixes for the code grant; we extend the same compensation to refresh.

@sub is already the resource-owner id at this point (set from user_id before the refresh token is generated in AccessToken#initialize), so we re-mint the refresh token to embed it. Only user grants pass a real user_id; client_credentials (which has no resource owner) is left as-is.

Constructors

new(client_id : String, scope : String, id_token : String | Nil = nil, cert_thumbprint : String | Nil = nil, user_id : String | Nil = nil)

Initialize with optional user_id for password grant flow

@param client_id - The OAuth client ID @param scope - Space-separated scopes @param id_token - Optional OpenID Connect ID token @param cert_thumbprint - Optional mTLS certificate thumbprint @param user_id - Optional user ID (from password grant or authorization code)

Source