fix(refresh-token): validate scope before revoking token #390

[runeb]

Summary

Fixes token destruction when refresh requests include invalid scopes. Currently, revokeToken() is called before getScope() validation. If scope validation fails, the token is destroyed without replacement.

Linked issue(s)

Fixes #390

Involved parts of the project

lib/grant-types/refresh-token-grant-type.js - Reordered scope validation to occur before token revocation in the refresh token grant handler.

Added tests?

Yes. Added test in test/integration/grant-types/refresh-token-grant-type_test.js that verifies InvalidScopeError is thrown when extra scope is requested, and that revokeToken()/saveToken() are not called before validation.

OAuth2 standard

RFC 6749 Section 6 states: "The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client."

Current implementation revokes before validation, violating this guidance. The fix ensures revocation only occurs after successful scope validation.

Reproduction

1. Issue refresh token without scope
2. Request refresh with invalid scope (e.g., scope=unauthorized)
3. Before fix: Token destroyed, retry fails with "invalid grant"
4. After fix: Token preserved, retry succeeds