fix: Refresh not expected to support resources, JWT flow yes

ims/exchange_jwt.go

@@ -65,6 +65,8 @@ type ExchangeJWTRequest struct {
 	MetaScope []MetaScope
 	// Additional claims to add to the JWT token.
 	Claims map[string]interface{}
+	// Resources provided to be added as access token audiences
+	Resources []string
 }
 
 // ExchangeJWTResponse contains the response of a successful exchange of a JWT

ims/obo.go

@@ -23,15 +23,11 @@ import (
 const defaultOBOGrantType = "urn:ietf:params:oauth:grant-type:token-exchange"
 
 type OBOExchangeRequest struct {
-	ClientID string
-
+	ClientID     string
 	ClientSecret string
-
 	SubjectToken string
-
-	Scopes []string
-
-	Resource []string
+	Scopes       []string
+	Resource     []string
 }
 
 type OBOExchangeResponse struct {

ims/refresh_token.go

@@ -32,8 +32,6 @@ type RefreshTokenRequest struct {
 	// Scope is the scope list in the refresh token. This field is optional. If
 	// provided, it must be a subset of the scopes in the request token.
 	Scope []string
-
-	Resource []string
 }
 
 // RefreshTokenResponse is the response of an access token refresh.
@@ -72,10 +70,6 @@ func (c *Client) RefreshTokenWithContext(ctx context.Context, r *RefreshTokenReq
 		data.Set("scope", strings.Join(r.Scope, ","))
 	}
 
-	for _, res := range r.Resource {
-		data.Add("resource", res)
-	}
-
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("%s/ims/token/v2", c.url), strings.NewReader(data.Encode()))
 	if err != nil {
 		return nil, fmt.Errorf("create request: %v", err)

ims/refresh_token_test.go

@@ -139,51 +139,6 @@ func TestRefreshTokenError(t *testing.T) {
 	}
 }
 
-func TestRefreshTokenWithResource(t *testing.T) {
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if err := r.ParseForm(); err != nil {
-			t.Fatalf("parse form: %v", err)
-		}
-		resources := r.PostForm["resource"]
-		if len(resources) != 1 {
-			t.Fatalf("expected 1 resource value, got %d", len(resources))
-		}
-		if resources[0] != "https://api-alpha.example.com" {
-			t.Fatalf("invalid resource: %v", resources[0])
-		}
-
-		body := struct {
-			AccessToken  string `json:"access_token"`
-			RefreshToken string `json:"refresh_token"`
-		}{
-			AccessToken:  "accessToken",
-			RefreshToken: "newRefreshToken",
-		}
-		if err := json.NewEncoder(w).Encode(&body); err != nil {
-			t.Fatalf("encode response: %v", err)
-		}
-	}))
-	defer s.Close()
-
-	c, err := ims.NewClient(&ims.ClientConfig{URL: s.URL})
-	if err != nil {
-		t.Fatalf("create client: %v", err)
-	}
-
-	r, err := c.RefreshToken(&ims.RefreshTokenRequest{
-		RefreshToken: "refreshToken",
-		ClientID:     "clientID",
-		ClientSecret: "clientSecret",
-		Resource:     []string{"https://api-alpha.example.com"},
-	})
-	if err != nil {
-		t.Fatalf("token: %v", err)
-	}
-	if r.AccessToken != "accessToken" {
-		t.Errorf("invalid access token: %v", r.AccessToken)
-	}
-}
-
 func TestRefreshTokenNoRefreshToken(t *testing.T) {
 	c, err := ims.NewClient(&ims.ClientConfig{
 		URL: "http://ims.endpoint",

ims/token.go

@@ -40,7 +40,7 @@ type TokenRequest struct {
 	CodeVerifier string
 	// The client credentials flow needs the IMS Org ID when the IMS Client is not owned by one IMS Org
 	OrgID string
-
+	// Resources provided to be added as access token audiences
 	Resource []string
 }