Authly::Grant
Inherits Reference < Object
Patch: carry the granted scope across a refresh. Upstream Grant#scope
returns the request scope (absent on a standard refresh), else the auth
code's scope (absent on a refresh), else "". So a refreshed access token
lost its scope entirely — emitting scope: [] — and every downstream
API call 403'd on rest-api's can_read (which requires the public
scope). We recover the scope embedded in the refresh token by the
AccessToken#initialize patch above. An explicit (narrowing) request
scope still wins, per RFC 6749 §6.
Constants
ID tokens live 120 seconds, matching the Ruby service: PlaceOS left
doorkeeper-openid_connect's expiration commented out in
config/initializers/doorkeeper_openid_connect.rb, so its default of
120 applied. The ID token is a one-shot assertion consumed immediately
at sign-in, not a credential to hold — the access token carries the
session.