fix: Returning Valid token_type in Introspection Response

[ajanthan]

Related issue

ory/hydra#1762

Proposed changes

• Added fix to return bearer or mac in token_type of introspection response based on the type of the token being introspected

• If the token type is access_token it returns bearer always as mac is not supported now.

• Added extra attribute token_use to return the token type access_token or refresh_token.

Checklist

• I have read the contributing guidelines
• I have read the security policy
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got green light (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation within the code base (if appropriate)

Further comments

[ajanthan]

cc @aeneasr

[aeneasr]

Thank you for this PR! I looked a bit into Mac-based HTTP based authentication and could not find anything related to OAuth2 except for this draft which expired 2014 while HTTP Bearer token is an accepted standard.

I think it's therefore safe to assume that fosite always returns a bearer token, which is great, because then we do not have to break backwards compatibility any more! So all we have to do is update the introspection writer!

I just realized that the request parameters have a token_type_hint parameter which can be access_token or refresh_token (see also RFC7009) but then return token_type in a completely different context (related to the HTTP auth mechanism). Classic OAuth2 ...

[aeneasr]

Awesome, thank you for your contribution! This looks pretty good but I have some ideas how to improve it further :)

[aeneasr]

Awesome 🎉

Thank you for your contribution!