pomerium / pomerium / 21043492763

46%

Build Type

push

github

Committed by web-flow

Commit Message

mockidp: add OAuth refresh token support (#6048)

## Summary

The mock IDP previously returned the same encoded state for both
access_token and refresh_token, which doesn't match OAuth behavior. This
change adds refresh token support:

- Add refresh token storage with thread-safe access
- Generate opaque UUID-based refresh tokens (30-day lifetime)
- Handle `grant_type=refresh_token` in the token endpoint
- Add `expires_in` field to token responses (1 hour for access tokens)
- Implement refresh token validation and expiration
- Support refresh token rotation (new token issued on each refresh)

## Related issues

<!-- none -->

## User Explanation

<!-- No user-facing changes - this is a test utility -->

## Checklist

- [ ] reference any related issues
- [ ] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Run Details

0 of 64 new or added lines in 1 file covered. (0.0%)

29 existing lines in 8 files now uncovered.

29837 of 56574 relevant lines covered (52.74%)

125.63 hits per line