What claim should be send when refresh token request ?

[clement-dufaure]

About this issue : #166

I'm ok that the scope claim of en access token should be compliant with the scope request, on the server-side management.

but I'm wondering if the oidc client should use the configuration provided scope or the first access token scope claim when requesting a new access toeken.
Currently oidc-spa seems to use the first access token scope claim, but other library use configuration scope each time.

Example :
configuration
scope: "openid profile roles"

first accesstoken :

{
...
"scope": "openid profile"
}

Should the refresh token request be

grant_type: refresh_token
refresh_token : yyy
scope : openid profile

or

grant_type: refresh_token
refresh_token : yyy
scope : openid profile roles

[garronej]

Hello @clement-dufaure,

Honestly, I have no strong option on this.

Maybe @coderabbitai can give us it's two sense on this?