fix: fixed scopes parsing in refresh token

jasonraimondi · Mar 17, 2021 · 5b60bc0 · 5b60bc0
1 parent 2919943
commit 5b60bc0
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 1 deletion.
diff --git a/src/grants/refresh_token.grant.ts b/src/grants/refresh_token.grant.ts
@@ -19,7 +19,7 @@ export class RefreshTokenGrant extends AbstractGrant {
 
     const user = oldToken.user;
 
-    const scopes = await this.validateScopes(this.getRequestParameter("scope", request, oldToken.scopes));
+    const scopes = await this.validateScopes(this.getRequestParameter("scope", request, oldToken.scopes.map(s=>s.name)));
 
     scopes.forEach(scope => {
       if (!oldToken.scopes.map(scope => scope.name).includes(scope.name)) {

diff --git a/test/unit/grants/refresh_token.grant.spec.ts b/test/unit/grants/refresh_token.grant.spec.ts
@@ -88,6 +88,28 @@ describe("refresh_token grant", () => {
     expect(tokenResponse.body.refresh_token).toMatch(REGEX_ACCESS_TOKEN);
   });
 
+  it("successful without scope", async () => {
+    // arrange
+    const bearerResponse = await grant.makeBearerTokenResponse(client, accessToken);
+    request = new OAuthRequest({
+      body: {
+        grant_type: "refresh_token",
+        client_id: client.id,
+        client_secret: client.secret,
+        refresh_token: bearerResponse.body.refresh_token,
+      },
+    });
+    const accessTokenTTL = new DateInterval("1h");
+
+    // act
+    const tokenResponse = await grant.respondToAccessTokenRequest(request, response, accessTokenTTL);
+
+    // assert
+    expectTokenResponse(tokenResponse);
+    expect(tokenResponse.body.scope).toBe(accessToken.scopes.map(s=>s.name).join(" "));
+    expect(tokenResponse.body.refresh_token).toMatch(REGEX_ACCESS_TOKEN);
+  });
+
   it("throws for resigned token", async () => {
     // arrange
     const jwt = new JwtService("different secret");