diff --git a/grid_api/services/oauth_server.py b/grid_api/services/oauth_server.py index 18b86a5b..9a645a1e 100644 --- a/grid_api/services/oauth_server.py +++ b/grid_api/services/oauth_server.py @@ -463,7 +463,7 @@ def introspect_access_token(token: str) -> dict: "aud": claims["aud"], "scope": " ".join(claims["scopes"]), "token_type": "Bearer", - "iss": claims["iss"], + "iss": issuer(), "iat": claims["iat"], "exp": claims["exp"], } diff --git a/grid_api/services/tests/test_oauth_server.py b/grid_api/services/tests/test_oauth_server.py index 6a196db9..652c5a2b 100644 --- a/grid_api/services/tests/test_oauth_server.py +++ b/grid_api/services/tests/test_oauth_server.py @@ -158,7 +158,11 @@ async def test_native_loopback_pkce_code_is_single_use_and_never_stored_plaintex required_scope="inference.submit", ) assert str(authenticated["account_id"]) == oauth_db["id"] - assert oauth_server.introspect_access_token(token["access_token"])["active"] is True + introspected = oauth_server.introspect_access_token(token["access_token"]) + assert introspected["active"] is True + assert introspected["iss"] == "https://api.example.test" + assert introspected["aud"] == "https://api.example.test" + assert introspected["client_id"] == client["client_id"] with pytest.raises(oauth_server.OAuthProtocolError, match="Invalid or expired authorization code"): await oauth_server.exchange_authorization_code(