From 8e61c665541b96289127d5d6727670ca9b16d3e5 Mon Sep 17 00:00:00 2001
From: Jose Antonio Insua <insuafer@adobe.com>
Date: Fri, 17 Apr 2026 12:37:39 +0200
Subject: [PATCH 1/2] Refresh of access tokens doesn't support resource
 parameter

---
 ims/refresh_token.go      |  6 ------
 ims/refresh_token_test.go | 45 ---------------------------------------
 2 files changed, 51 deletions(-)

diff --git a/ims/refresh_token.go b/ims/refresh_token.go
index 63fd6a9..84d5c88 100644
--- a/ims/refresh_token.go
+++ b/ims/refresh_token.go
@@ -32,8 +32,6 @@ type RefreshTokenRequest struct {
 	// Scope is the scope list in the refresh token. This field is optional. If
 	// provided, it must be a subset of the scopes in the request token.
 	Scope []string
-
-	Resource []string
 }
 
 // RefreshTokenResponse is the response of an access token refresh.
@@ -72,10 +70,6 @@ func (c *Client) RefreshTokenWithContext(ctx context.Context, r *RefreshTokenReq
 		data.Set("scope", strings.Join(r.Scope, ","))
 	}
 
-	for _, res := range r.Resource {
-		data.Add("resource", res)
-	}
-
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("%s/ims/token/v2", c.url), strings.NewReader(data.Encode()))
 	if err != nil {
 		return nil, fmt.Errorf("create request: %v", err)
diff --git a/ims/refresh_token_test.go b/ims/refresh_token_test.go
index 9a0b5bc..999a932 100644
--- a/ims/refresh_token_test.go
+++ b/ims/refresh_token_test.go
@@ -139,51 +139,6 @@ func TestRefreshTokenError(t *testing.T) {
 	}
 }
 
-func TestRefreshTokenWithResource(t *testing.T) {
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if err := r.ParseForm(); err != nil {
-			t.Fatalf("parse form: %v", err)
-		}
-		resources := r.PostForm["resource"]
-		if len(resources) != 1 {
-			t.Fatalf("expected 1 resource value, got %d", len(resources))
-		}
-		if resources[0] != "https://api-alpha.example.com" {
-			t.Fatalf("invalid resource: %v", resources[0])
-		}
-
-		body := struct {
-			AccessToken  string `json:"access_token"`
-			RefreshToken string `json:"refresh_token"`
-		}{
-			AccessToken:  "accessToken",
-			RefreshToken: "newRefreshToken",
-		}
-		if err := json.NewEncoder(w).Encode(&body); err != nil {
-			t.Fatalf("encode response: %v", err)
-		}
-	}))
-	defer s.Close()
-
-	c, err := ims.NewClient(&ims.ClientConfig{URL: s.URL})
-	if err != nil {
-		t.Fatalf("create client: %v", err)
-	}
-
-	r, err := c.RefreshToken(&ims.RefreshTokenRequest{
-		RefreshToken: "refreshToken",
-		ClientID:     "clientID",
-		ClientSecret: "clientSecret",
-		Resource:     []string{"https://api-alpha.example.com"},
-	})
-	if err != nil {
-		t.Fatalf("token: %v", err)
-	}
-	if r.AccessToken != "accessToken" {
-		t.Errorf("invalid access token: %v", r.AccessToken)
-	}
-}
-
 func TestRefreshTokenNoRefreshToken(t *testing.T) {
 	c, err := ims.NewClient(&ims.ClientConfig{
 		URL: "http://ims.endpoint",

From e663a3919029334c4c499df6546384ab9682a4a1 Mon Sep 17 00:00:00 2001
From: Jose Antonio Insua <insuafer@adobe.com>
Date: Fri, 17 Apr 2026 12:58:01 +0200
Subject: [PATCH 2/2] Exchange JWT expected to accept resources

---
 ims/exchange_jwt.go |  2 ++
 ims/obo.go          | 10 +++-------
 ims/token.go        |  2 +-
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/ims/exchange_jwt.go b/ims/exchange_jwt.go
index fa8654f..eb1c545 100644
--- a/ims/exchange_jwt.go
+++ b/ims/exchange_jwt.go
@@ -65,6 +65,8 @@ type ExchangeJWTRequest struct {
 	MetaScope []MetaScope
 	// Additional claims to add to the JWT token.
 	Claims map[string]interface{}
+	// Resources provided to be added as access token audiences
+	Resources []string
 }
 
 // ExchangeJWTResponse contains the response of a successful exchange of a JWT
diff --git a/ims/obo.go b/ims/obo.go
index 4fb8dcc..a41f1e9 100644
--- a/ims/obo.go
+++ b/ims/obo.go
@@ -23,15 +23,11 @@ import (
 const defaultOBOGrantType = "urn:ietf:params:oauth:grant-type:token-exchange"
 
 type OBOExchangeRequest struct {
-	ClientID string
-
+	ClientID     string
 	ClientSecret string
-
 	SubjectToken string
-
-	Scopes []string
-	
-	Resource []string
+	Scopes       []string
+	Resource     []string
 }
 
 type OBOExchangeResponse struct {
diff --git a/ims/token.go b/ims/token.go
index 6df26cb..6800718 100644
--- a/ims/token.go
+++ b/ims/token.go
@@ -40,7 +40,7 @@ type TokenRequest struct {
 	CodeVerifier string
 	// The client credentials flow needs the IMS Org ID when the IMS Client is not owned by one IMS Org
 	OrgID string
-
+	// Resources provided to be added as access token audiences
 	Resource []string
 }