Reject grant_type=client_credentials token requests containing scope=offline_access

[kevinchalet]

We recently added the ability to automatically grant the requested scopes for grant_type=client_credentials (which requires that the client be granted the corresponding scope permissions, of course) but we forgot to add a check to prevent a refresh token from being requested via scope=offline_access, which is a scenario we deliberately don't allow. We have a check preventing blocking grant_type=refresh_token requests in this case:

OrchardCore/src/OrchardCore.Modules/OrchardCore.OpenId/Controllers/AccessController.cs

Lines 588 to 600 in 18938aa

	if (request.IsRefreshTokenGrantType())
	{
	var type = info.Principal.FindFirst(OpenIdConstants.Claims.EntityType)?.Value;
	if (!string.Equals(type, OpenIdConstants.EntityTypes.User))
	{
	return Forbid(new AuthenticationProperties(new Dictionary<string, string>
	{
	[OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.UnauthorizedClient,
	[OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
	"The refresh token grant type is not allowed for refresh tokens retrieved using the client credentials flow."
	}), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
	}
	}

Since there's no point returning a refresh token that won't be usable, we should add a check to prevent the offline_access scope from being requested in the first place. That's exactly what this PR does 😄

[HengzheLi]

So, is that means after this change, the client_credentials granted client have to re-apply a new access token instead of refreshing the access token using refresh token?

[kevinchalet]

To get a new access token with client_credentials, simply send a new grant_type=client_credentials request instead of using refresh tokens.

grant_type=refresh_token with a refresh token issued after a first grant_type=client_credentials has never been supported, this PR just fixes a regression introduced in the last OC patch that allowed a refresh token to be returned (but you can't use it so there's really no point returning it in the first place).