We are trying to change the scope for an oAuth client. As soon as we want to save the changes, there is a huge popup claiming that all the tokens will expiry, and all users will need to re-authorize. That's sound logic, so we tried, but this is not what happens. All tokens (and refresh token) are still alive. We tried by both adding and removing scopes. The path we tried:
1) set some scopes on the oAuth client (suppose resources A and B)
2) make a connection, extract the refresh token from the callback, and get a short-term token
3) request for resource A
4) change scope by removing resource B
5) request a new short-term token with the refresh flow
6) request again for resource A with the new token
At point 5, I expect to fail as the user never re-authorized the app as the UI claims. But both point 5 and 6 works ok.
So, the question here is: "is the token validation smart enough to check the scopes, refresh token are not expired and the UI is just pessimistically overreacting, OR the popup is right and this example should stop at point 5"?
TIA
