OAuth2.0 Provider: refresh tokens #12450
Description
Issue - Enhancement
Following on from merging #12391, let's add refresh token support to the OAuth 2.0 provider and shorten the token issuance time.
Acceptance Criteria (optional)
- when exchanging a code for an access token, issue a refresh token as well
- access token lives for a limited time (say 10 minutes)
- refresh token lives for (say 30 days)
- token endpoint enhanced to handle the issuance of new access and refresh tokens
Estimated effort: 3 points (see CONTRIBUTING.md)