Impact: major
Type: bugfix

Issues

• HYDRA_SESSION_LIFESPAN env value should be a Number (else it will be ignored). Setting via ENV passes a string, so it should be converted.
• The granted scopes during user consent flow are not correctly passed back to Hydra. This can be seen when openid scope is added at the beginning of the auth flow by the consumer app, and there is no issuance of an id_token on completion of the auth. This was also preventing refresh-tokens from being granted (seen while fixing Enable access token refreshing example-storefront#350)

Solution

• HYDRA_SESSION_LIFESPAN: If the env is passed in, convert it to Number before using.
• Scopes: Make getConsent call to retrieve the list of the client-requested scope, and pass them when granting the consent in the acceptConsentRequest call.

Testing

1. You need to have Starterkit (develop branch), Hydra (master) and Reaction services running
2. First, without using this branch (use rc-5) , see that refresh_token is not issued after logging in. You can add a console.log in the strategy callback
3. Switch your Reaction service to run on this branch, perform the login flow again, and confirm that you see id_token and refresh_tokens in your log.