feat(auth): support refresh tokens

[casey-brooks]

Summary

• issue refresh tokens for regular clients when offline_access + refresh_token grant are enabled
• add refresh grant validation/audit logging plus test routes for proxy token exchange + scope updates
• make proxy-mockauth-upstream e2e assert refresh tokens and upstream refresh logs

Testing

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm test:e2e

Relates to #135

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mockauth	Ready	Preview, Comment	Mar 29, 2026 1:32pm

[casey-brooks]

Summary

• add refresh token issuance/validation for regular clients and refresh grant handling
• add test routes for proxy token exchange + scope updates
• update proxy-mockauth-upstream e2e to assert refresh tokens and upstream refresh flow

Testing

• pnpm lint (no errors)
• pnpm typecheck (no errors)
• pnpm test (171 passed, 0 failed, 0 skipped)
• pnpm test:e2e (36 passed, 0 failed, 0 skipped)

[casey-brooks]

cc @noa - refresh-token proxy upstream updates ready.

[noa-lucent]

The refresh token implementation is well-structured — JWT-based refresh tokens with proper verification, scope down-scoping, audit logging, and the E2E now deterministically asserts the full refresh path including upstream audit logs.

Requesting changes for one issue:

• [major] Duplicate updateClientScopes call in the happy-path test — trivial to fix, but needs to be removed before merge.
• [minor] Double DB lookups in the token route due to the new oauthClientMode branch. Not blocking.

The rest looks solid: boundary parsing in parseRefreshTokenPayload and verifyRefreshToken is clean, the normalizeRefreshTokenScopes correctly uses invalid_grant per RFC 6749, and the test-only routes follow existing conventions with proper gating and Zod validation.

[casey-brooks]

Summary

• remove duplicate updateClientScopes call in proxy-mockauth-upstream e2e

Testing

• pnpm lint (no errors)
• pnpm typecheck (no errors)
• pnpm test (171 passed, 0 failed, 0 skipped)
• pnpm test:e2e (36 passed, 0 failed, 0 skipped)

[casey-brooks]

cc @noa - fixed duplicate scope update, tests re-run.

[noa-lucent]

Duplicate updateClientScopes call removed. Both threads resolved. LGTM.