✨(oidc) add refresh token tools

[qbey]

Purpose

This provides a way to to refresh the OIDC access token.

The OIDC token will be used to request data to a resource server.
This code is highly related to mozilla/mozilla-django-oidc#377

The refresh token is encrypted in the session.

Proposal

Reuse code written in suitenumerique/docs#584

• allow access token storage in user session
• allow refresh token encrypted storage in user session
• create middleware for access token refresh and provide a decorator

[Copilot]

Pull Request Overview

This PR introduces refresh token tools for OIDC integration by enabling encrypted storage of the refresh token in the user session and adding middleware/decorators to refresh access tokens when needed. Additionally, it updates the authentication backends, URL configurations, client classes, documentation, and testing workflows in support of these features.

• Added functions to import private keys and encrypt/decrypt refresh tokens.
• Implemented a middleware and decorator for on-demand token refresh.
• Updated documentation, changelog, and tests configuration.

Reviewed Changes

Copilot reviewed 45 out of 46 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/lasuite/oidc_resource_server/utils.py	Adds a utility function for importing the resource server’s private key.
src/lasuite/oidc_resource_server/urls.py	Introduces a URL pattern for exposing the JWKS endpoint.
src/lasuite/oidc_resource_server/mixins.py	Provides a mixin to support resource server view functionality.
src/lasuite/oidc_resource_server/clients.py	Implements an authorization server client for token introspection and JWKS retrieval.
src/lasuite/oidc_resource_server/backend.py	Adds the backend implementations for token introspection and JWT handling.
src/lasuite/oidc_resource_server/authentication.py	Updates authentication to leverage the new resource server backend.
src/lasuite/oidc/views.py	Customizes logout views to handle OIDC logout flows.
src/lasuite/oidc/middleware.py	Implements a middleware for refreshing the OIDC access token.
src/lasuite/oidc/decorators.py	Provides a decorator to apply the token refresh middleware on demand.
src/lasuite/oidc/backends.py	Enhances the OIDC authentication backend to support refresh token storage.
documentation/* and pyproject.toml, CHANGELOG.md, workflows.yml	Updates documentation, dependency configuration, and CI workflows.

Files not reviewed (1)

• Makefile: Language not supported

Comments suppressed due to low confidence (1)

src/lasuite/oidc_resource_server/backend.py:136

• The error message is confusing; consider changing it to 'Introspection response is missing required scopes.'

message = "Introspection response contains any required scopes."

[Copilot]

Pull Request Overview

This PR adds refresh token tools to support encrypted storage of OIDC refresh tokens and enables automatic access token refresh via middleware and a decorator. Key changes include updating configuration settings, refining error messages in the backend and tests, and adding comprehensive tests for token refresh functionality.

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/test_project/settings.py	Added OIDC_OP_AUTHORIZATION_ENDPOINT setting for authentication flows
tests/oidc_resource_server/test_backend.py	Corrected error messages for token introspection and user info verification
tests/oidc/test_middleware.py	Added tests covering token refresh scenarios and error cases
tests/oidc/test_decorators.py	Added tests for the refresh_oidc_access_token decorator
tests/oidc/test_backends.py	Added tests to verify session token storage and refresh token handling
src/lasuite/oidc_resource_server/backend.py	Updated logging messages in error handling
src/lasuite/oidc/middleware.py	Introduced middleware to automatically refresh access tokens
src/lasuite/oidc/decorators.py	Provided a decorator wrapping the refresh middleware
src/lasuite/oidc/backends.py	Implemented encrypted storage and retrieval of refresh tokens
documentation/how-to-use-oidc-call-to-resource-server.md	Expanded documentation on configuring and using OIDC tokens
CHANGELOG.md	Documented the new refresh token tools feature

[Copilot]

Pull Request Overview

This pull request adds refresh token tools to the OIDC module, enabling secure storage and automatic refreshing of the access token via session mechanisms and middleware. The changes include new settings and test cases, updated error messages for clarity, and comprehensive documentation on how to use the resource server endpoints.

• Added a new OIDC_AUTHORIZATION_ENDPOINT setting.
• Implemented middleware and decorator for refreshing access tokens.
• Enhanced backend functionality to securely store and retrieve encrypted refresh tokens.

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/test_project/settings.py	Added OIDC_OP_AUTHORIZATION_ENDPOINT setting for auth URL
tests/oidc_resource_server/test_backend.py	Updated error messages for JWKS and scope verification
tests/oidc/test_middleware.py	Added tests to verify various scenarios for the refresh token middleware
tests/oidc/test_decorators.py	Introduced tests for the refresh_oidc_access_token decorator
tests/oidc/test_backends.py	Added tests for storing/retrieving refresh and access tokens
src/lasuite/oidc_resource_server/backend.py	Updated error messages to better reflect missing scopes/JWKS
src/lasuite/oidc/middleware.py	New middleware for automatic access token refresh based on OIDC settings
src/lasuite/oidc/decorators.py	Added a decorator to trigger token refresh on demand
src/lasuite/oidc/backends.py	Implemented functions for encrypted refresh token storage and retrieval
documentation/how-to-use-oidc-call-to-resource-server.md	Added documentation on configuring and using token refresh with the resource server
CHANGELOG.md	Updated changelog with the refresh token tools addition