oauth2: connection of auth code with access token

[hachreak]

• On access token creation, the relation with the auth code is saved.
  (addresses token revocation by a user #66)

Signed-off-by: Leonardo Rossi leonardo.rossi@studenti.unipr.it

[dvaergiller]

Thank you for contributing.

I have a couple of questions before merging this, and it seems to me that these are two rather independent commits. Would you mind creating two separate pull requests for this?

[hachreak]

hi @dvaergiller, thanks for taking in account my PR! 😄
I'll make two separate PR just now. :)

[dvaergiller]

Thank you. I will close this one for the sake of the new PRs.

[deadtrickster]

@dvaergiller looks like he already moved one commit to the other PR. and only one commit left here

[dvaergiller]

My bad. Reopening.

[dvaergiller]

On this one I would like some more information. Is there any particular use case that is not fulfilled without saving the auth code in the context?

Without looking into it that much, I am not 100% sure that there are no security implications to consider here.

[hachreak]

As mentioned in the commit message, I'm trying to handle the case of access token revocation by the user.
Apparently OAuth2 RFC doesn't cover this use case (or, at least I didn't find anything XD).
I found the 7009 RFC, but doesn't help me because it cover the case where the client ask to revoke its token, but doesn't say anything about the user.
What do you think?

[hachreak]

Hi @dvaergiller , any news about my PR? :)

[dvaergiller]

Hi. Sorry for delays. A few busy weeks.

I'll pick this up again through this week.

[hachreak]

Thanks 😄 💃

[hachreak]

Hi @dvaergiller,
there are any news? Did you find the time to check the PR? :)
thanks

[hachreak]

ping @dvaergiller