When `prompt=none` is set, reauthorizing with a smaller set of scopes causes an error about doorkeeper-openid_connect

[toupeira]

@meagar thanks for the report! I think you're right:

The user has already granted consent for the email and name claims; my reauthorization request is only requesting the email claim, so I believe the correct behavior is to generate and return a new access token with the openid and email claims.

That is what I would expect as well, I can't find anything concrete in the specs except for this section:

Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope

I've started to look into this in #65, but the problem is that Doorkeeper also performs an exact match in https://github.com/doorkeeper-gem/doorkeeper/blob/9ae5f9fff7234123216ae56f37c73534a7373654/lib/doorkeeper/models/access_token_mixin.rb#L104. So even though the OIDC code won't raise an error anymore, Doorkeeper will still render the authorization form.

I'll open an issue on the Doorkeeper gem!