refactor(server): extract the token issuer into server/tokens

Move the whole token-issuance domain out of the god object into server/tokens:

- Authorization / TokenSet value objects.
- Signer (access/id token minting) with the OIDC claim vocabulary it owns:
  the id-token claims, Audience, at_hash, cross-client trust, GenSubject,
  GetAudience, ParseCrossClientScope and the claim scope constants.
- Issuer composing the signer and the refresh store.
- RefreshStrategy (rotation policy) and RefreshStore (create/rotate/revoke),
  with the config-reading adapter (NewRefreshTokenPolicy) kept in the server
  package so config parsing stays separate from the strategy object.

The server package now builds tokens.Authorization values and calls the issuer;
introspection, logout and the grants reference the tokens package for the shared
OIDC helpers. writeTokenResponse stays as a transport helper. Request-flow scope
constants (openid, offline_access) stay in the server package. No behaviour
change; public server.NewRefreshTokenPolicy / Config.RefreshTokenPolicy keep
working.

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

server/api.go

@@ -16,6 +16,7 @@ import (
 	"github.com/dexidp/dex/api/v2"
 	"github.com/dexidp/dex/pkg/featureflags"
 	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -42,7 +43,7 @@ func NewAPI(s storage.Storage, logger *slog.Logger, version string, server *Serv
 		logger:  apiLogger,
 		version: version,
 		server:  server,
-		refresh: &refreshTokens{storage: s, now: time.Now, logger: apiLogger},
+		refresh: tokens.NewRefreshStore(s, time.Now, apiLogger),
 	}
 }
 
@@ -53,7 +54,7 @@ type dexAPI struct {
 	logger  *slog.Logger
 	version string
 	server  *Server
-	refresh *refreshTokens
+	refresh *tokens.RefreshStore
 }
 
 func (d dexAPI) GetClient(ctx context.Context, req *api.GetClientReq) (*api.GetClientResp, error) {
@@ -628,7 +629,7 @@ func defaultTo[T comparable](v, def T) T {
 // and cleans up offline session references. Errors are logged but not returned
 // (best-effort).
 func (d dexAPI) revokeUserRefreshTokens(ctx context.Context, userID, connectorID string) {
-	d.refresh.revoke(ctx, userID, connectorID)
+	d.refresh.Revoke(ctx, userID, connectorID)
 }
 
 // unixOrZero returns the Unix timestamp for t, or 0 when t is the zero value.

server/approval.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -182,7 +183,7 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 			implicitOrHybrid = true
 			var err error
 
-			accessToken, _, err = s.issuer.signer.signAccessToken(r.Context(), Authorization{
+			accessToken, _, err = s.issuer.SignAccessToken(r.Context(), tokens.Authorization{
 				Client:      storage.Client{ID: authReq.ClientID},
 				Claims:      authReq.Claims,
 				Scopes:      authReq.Scopes,
@@ -199,7 +200,7 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 			implicitOrHybrid = true
 			var err error
 
-			idToken, idTokenExpiry, err = s.issuer.signer.signIDToken(r.Context(), Authorization{
+			idToken, idTokenExpiry, err = s.issuer.SignIDToken(r.Context(), tokens.Authorization{
 				Client:      storage.Client{ID: authReq.ClientID},
 				Claims:      authReq.Claims,
 				Scopes:      authReq.Scopes,

server/grant_authcode.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 
 	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -71,8 +72,8 @@ func (s *Server) handleAuthCode(w http.ResponseWriter, r *http.Request, client s
 	s.writeAccessToken(w, tokenResponse)
 }
 
-func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, authCode storage.AuthCode, client storage.Client) (*accessTokenResponse, error) {
-	auth := Authorization{
+func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, authCode storage.AuthCode, client storage.Client) (tokens.Response, error) {
+	auth := tokens.Authorization{
 		Client:        client,
 		Claims:        authCode.Claims,
 		Scopes:        authCode.Scopes,
@@ -82,24 +83,24 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 		ConnectorData: authCode.ConnectorData,
 	}
 
-	accessToken, _, err := s.issuer.signer.signAccessToken(ctx, auth)
+	accessToken, _, err := s.issuer.SignAccessToken(ctx, auth)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "failed to create new access token", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return nil, err
+		return tokens.Response{}, err
 	}
 
-	idToken, expiry, err := s.issuer.signer.signIDToken(ctx, auth, accessToken, authCode.ID)
+	idToken, expiry, err := s.issuer.SignIDToken(ctx, auth, accessToken, authCode.ID)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "failed to create ID token", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return nil, err
+		return tokens.Response{}, err
 	}
 
 	if err := s.storage.DeleteAuthCode(ctx, authCode.ID); err != nil {
 		s.logger.ErrorContext(ctx, "failed to delete auth code", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return nil, err
+		return tokens.Response{}, err
 	}
 
 	reqRefresh := func() bool {
@@ -139,11 +140,11 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 
 	var refreshToken string
 	if reqRefresh {
-		refreshToken, err = s.issuer.refresh.create(ctx, auth)
+		refreshToken, err = s.issuer.Refresh.Create(ctx, auth)
 		if err != nil {
 			s.logger.ErrorContext(ctx, "failed to create refresh token", "err", err)
 			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return nil, err
+			return tokens.Response{}, err
 		}
 	}
 

server/grant_clientcredentials.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -36,16 +37,16 @@ func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Req
 		switch scope {
 		case scopeOpenID:
 			hasOpenIDScope = true
-		case scopeEmail, scopeProfile, scopeGroups:
+		case tokens.ScopeEmail, tokens.ScopeProfile, tokens.ScopeGroups:
 			// allowed
 		case scopeOfflineAccess:
 			s.tokenErrHelper(w, errInvalidScope, "client_credentials grant does not support offline_access scope.", http.StatusBadRequest)
 			return
-		case scopeFederatedID:
+		case tokens.ScopeFederatedID:
 			s.tokenErrHelper(w, errInvalidScope, "client_credentials grant does not support federated:id scope.", http.StatusBadRequest)
 			return
 		default:
-			peerID, ok := parseCrossClientScope(scope)
+			peerID, ok := tokens.ParseCrossClientScope(scope)
 			if !ok {
 				unrecognized = append(unrecognized, scope)
 				continue
@@ -79,10 +80,10 @@ func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Req
 	// Populate optional claims based on requested scopes.
 	for _, scope := range scopes {
 		switch scope {
-		case scopeProfile:
+		case tokens.ScopeProfile:
 			claims.Username = client.Name
 			claims.PreferredUsername = client.Name
-		case scopeGroups:
+		case tokens.ScopeGroups:
 			if client.ClientCredentialsClaims != nil {
 				claims.Groups = client.ClientCredentialsClaims.Groups
 			}
@@ -95,15 +96,15 @@ func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Req
 	// Creating connectors with an empty ID with the config and API is prohibited
 	connID := ""
 
-	auth := Authorization{
+	auth := tokens.Authorization{
 		Client:      client,
 		Claims:      claims,
 		Scopes:      scopes,
 		ConnectorID: connID,
 		Nonce:       nonce,
 	}
 
-	accessToken, expiry, err := s.issuer.signer.signAccessToken(ctx, auth)
+	accessToken, expiry, err := s.issuer.SignAccessToken(ctx, auth)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "client_credentials grant failed to create new access token", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
@@ -112,15 +113,15 @@ func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Req
 
 	var idToken string
 	if hasOpenIDScope {
-		idToken, expiry, err = s.issuer.signer.signIDToken(ctx, auth, accessToken, "")
+		idToken, expiry, err = s.issuer.SignIDToken(ctx, auth, accessToken, "")
 		if err != nil {
 			s.logger.ErrorContext(ctx, "client_credentials grant failed to create new ID token", "err", err)
 			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 			return
 		}
 	}
 
-	if err := writeTokenResponse(w, TokenSet{AccessToken: accessToken, IDToken: idToken, Expiry: expiry}, s.now()); err != nil {
+	if err := writeTokenResponse(w, tokens.TokenSet{AccessToken: accessToken, IDToken: idToken, Expiry: expiry}, s.now()); err != nil {
 		s.logger.ErrorContext(ctx, "failed to write token response", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 		return

server/grant_password.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -35,9 +36,9 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 		switch scope {
 		case scopeOpenID:
 			hasOpenIDScope = true
-		case scopeOfflineAccess, scopeEmail, scopeProfile, scopeGroups, scopeFederatedID:
+		case scopeOfflineAccess, tokens.ScopeEmail, tokens.ScopeProfile, tokens.ScopeGroups, tokens.ScopeFederatedID:
 		default:
-			peerID, ok := parseCrossClientScope(scope)
+			peerID, ok := tokens.ParseCrossClientScope(scope)
 			if !ok {
 				unrecognized = append(unrecognized, scope)
 				continue
@@ -120,7 +121,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 		wantRefresh = slices.Contains(scopes, scopeOfflineAccess)
 	}
 
-	tokens, err := s.issuer.Issue(ctx, Authorization{
+	tokens, err := s.issuer.Issue(ctx, tokens.Authorization{
 		Client:        client,
 		Claims:        claims,
 		Scopes:        scopes,

server/grant_refresh.go

@@ -13,77 +13,44 @@ import (
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/server/connectors"
 	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
-type RefreshTokenPolicy struct {
-	rotateRefreshTokens bool // enable rotation
-
-	absoluteLifetime  time.Duration // interval from token creation to the end of its life
-	validIfNotUsedFor time.Duration // interval from last token update to the end of its life
-	reuseInterval     time.Duration // interval within which old refresh token is allowed to be reused
-
-	now func() time.Time
-
-	logger *slog.Logger
-}
-
-func NewRefreshTokenPolicy(logger *slog.Logger, rotation bool, validIfNotUsedFor, absoluteLifetime, reuseInterval string) (*RefreshTokenPolicy, error) {
-	r := RefreshTokenPolicy{now: time.Now, logger: logger}
+// NewRefreshTokenPolicy parses the refresh-token configuration into a rotation
+// strategy. It is the config-reading adapter; the strategy object itself lives
+// in the refresh package, independent of how its intervals are configured.
+func NewRefreshTokenPolicy(logger *slog.Logger, rotation bool, validIfNotUsedFor, absoluteLifetime, reuseInterval string) (*tokens.RefreshStrategy, error) {
+	var validDur, absoluteDur, reuseDur time.Duration
 	var err error
 
 	if validIfNotUsedFor != "" {
-		r.validIfNotUsedFor, err = time.ParseDuration(validIfNotUsedFor)
+		validDur, err = time.ParseDuration(validIfNotUsedFor)
 		if err != nil {
 			return nil, fmt.Errorf("invalid config value %q for refresh token valid if not used for: %v", validIfNotUsedFor, err)
 		}
 		logger.Info("config refresh tokens", "valid_if_not_used_for", validIfNotUsedFor)
 	}
 
 	if absoluteLifetime != "" {
-		r.absoluteLifetime, err = time.ParseDuration(absoluteLifetime)
+		absoluteDur, err = time.ParseDuration(absoluteLifetime)
 		if err != nil {
 			return nil, fmt.Errorf("invalid config value %q for refresh tokens absolute lifetime: %v", absoluteLifetime, err)
 		}
 		logger.Info("config refresh tokens", "absolute_lifetime", absoluteLifetime)
 	}
 
 	if reuseInterval != "" {
-		r.reuseInterval, err = time.ParseDuration(reuseInterval)
+		reuseDur, err = time.ParseDuration(reuseInterval)
 		if err != nil {
 			return nil, fmt.Errorf("invalid config value %q for refresh tokens reuse interval: %v", reuseInterval, err)
 		}
 		logger.Info("config refresh tokens", "reuse_interval", reuseInterval)
 	}
 
-	r.rotateRefreshTokens = !rotation
-	logger.Info("config refresh tokens rotation", "enabled", r.rotateRefreshTokens)
-	return &r, nil
-}
-
-func (r *RefreshTokenPolicy) RotationEnabled() bool {
-	return r.rotateRefreshTokens
-}
-
-func (r *RefreshTokenPolicy) CompletelyExpired(lastUsed time.Time) bool {
-	if r.absoluteLifetime == 0 {
-		return false // expiration disabled
-	}
-	return r.now().After(lastUsed.Add(r.absoluteLifetime))
-}
-
-func (r *RefreshTokenPolicy) ExpiredBecauseUnused(lastUsed time.Time) bool {
-	if r.validIfNotUsedFor == 0 {
-		return false // expiration disabled
-	}
-	return r.now().After(lastUsed.Add(r.validIfNotUsedFor))
-}
-
-func (r *RefreshTokenPolicy) AllowedToReuse(lastUsed time.Time) bool {
-	if r.reuseInterval == 0 {
-		return false // expiration disabled
-	}
-	return !r.now().After(lastUsed.Add(r.reuseInterval))
+	rotate := !rotation
+	logger.Info("config refresh tokens rotation", "enabled", rotate)
+	return tokens.NewRefreshStrategy(rotate, absoluteDur, validDur, reuseDur, time.Now), nil
 }
 
 func contains(arr []string, item string) bool {
@@ -339,27 +306,27 @@ func (s *Server) handleRefreshToken(w http.ResponseWriter, r *http.Request, clie
 	// is only needed on the connector-refresh path.
 	freshIdentity := func(ctx context.Context) (connector.Identity, error) {
 		if userIdent != nil {
-			return identityFromClaims(userIdent.Claims), nil
+			return tokens.IdentityFromClaims(userIdent.Claims), nil
 		}
 		connectorData, rerr := s.refreshConnectorData(ctx, refresh)
 		if rerr != nil {
 			return connector.Identity{}, rerr
 		}
-		ident, rerr := s.refreshWithConnector(ctx, conn, connectorData, scopes, identityFromClaims(refresh.Claims))
+		ident, rerr := s.refreshWithConnector(ctx, conn, connectorData, scopes, tokens.IdentityFromClaims(refresh.Claims))
 		if rerr != nil {
 			return ident, rerr
 		}
 		return ident, nil
 	}
 
-	rawNewToken, ident, err := s.issuer.refresh.rotate(r.Context(), refresh, token, s.refreshTokenPolicy, freshIdentity)
+	rawNewToken, ident, err := s.issuer.Refresh.Rotate(r.Context(), refresh, token, s.refreshTokenPolicy, freshIdentity)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to rotate refresh token", "err", err)
 		s.refreshTokenErrHelper(w, newInternalServerError())
 		return
 	}
 
-	auth := Authorization{
+	auth := tokens.Authorization{
 		Client: client,
 		Claims: storage.Claims{
 			UserID:            ident.UserID,
@@ -375,21 +342,21 @@ func (s *Server) handleRefreshToken(w http.ResponseWriter, r *http.Request, clie
 		AuthTime:    authTime,
 	}
 
-	accessToken, _, err := s.issuer.signer.signAccessToken(r.Context(), auth)
+	accessToken, _, err := s.issuer.SignAccessToken(r.Context(), auth)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to create new access token", "err", err)
 		s.refreshTokenErrHelper(w, newInternalServerError())
 		return
 	}
 
-	idToken, expiry, err := s.issuer.signer.signIDToken(r.Context(), auth, accessToken, "")
+	idToken, expiry, err := s.issuer.SignIDToken(r.Context(), auth, accessToken, "")
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to create ID token", "err", err)
 		s.refreshTokenErrHelper(w, newInternalServerError())
 		return
 	}
 
-	tokens := TokenSet{AccessToken: accessToken, IDToken: idToken, RefreshToken: rawNewToken, Expiry: expiry}
+	tokens := tokens.TokenSet{AccessToken: accessToken, IDToken: idToken, RefreshToken: rawNewToken, Expiry: expiry}
 	if err := writeTokenResponse(w, tokens, s.now()); err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to write token response", "err", err)
 		s.refreshTokenErrHelper(w, newInternalServerError())