I think the reason that authorization code is left out of here is that a lot of this information is already determined when handling the authorization endpoint. I think the token endpoint should not be receiving the scope and audience parameters in the authorization code flow.

Line 1306 callsHandler.updateSessionWithRequest which should grant the scopes. If the scopes aren't available in the token hook, I think something else must be going on.

And I hope the drive-by is welcome! I'm not a maintainer here or anything, just someone who saw your note about this PR on Slack and was curious and has spent some time recently staring at some of this code.

I think what may be happening here is that fosite is supposed to handle this but it's called in two phases. First it's called to process the token request, then it's called to issue the token response. I think the token hook might be getting called in between these two phases. Moving some code between the two phases in fosite fixes the issue, I think.

I put up adraft fosite PR that seems to fix this for me, but haven't checked yet whether tests need to be updated or looked into whether there are other consequences to be aware of.

Just to explain that a little more clearly, maybe. The token endpoint handler does these things:

1. Callsfosite.OAuth2Provider.NewAccessRequest(), which calls the fosite code to handle the token request. This is just above your patch.
2. Runs the code around where you've patched here, to handle some things that fosite does not.
3. Calls all the hooks returned fromRegistry.AccessTokenHooks(), just below the code in your patch. That's where the token hook gets called.
4. Callsfosite.OAuth2Provider.NewAccessResponse(), which calls the fosite code to generate a response.

So, I think my patch in fosite is moving the code that reads the granted scope and audience, already set and persisted by the consent flow, and updates the token request. It moves this from step 4 to step 1 so that it's visible in the token hook in step 3.

I think you are on to something!
I'll keep this PR in draft until we have a resolution from your's as well if you don't mind

That sounds like the right move!

Hello, this definitely is not correct. This code part is only for machine interaction. User interaction has to be done differently.

Hello, this definitely is not correct. This code part is only for machine interaction. User interaction has to be done differently.