Additional test for token introspection

tokens_controller_spec.rb

    context 'authorized using Bearer token' do
      let(:client) { FactoryBot.create(:application) }
      let(:client2) { FactoryBot.create(:application) }
      let(:access_token) { FactoryBot.create(:access_token, application: client) }
      let(:access_token2) { FactoryBot.create(:access_token, application: client2) }

      it 'responds with full token introspection' do
        request.headers['Authorization'] = "Bearer #{access_token.token}"

        post :introspect, params: { token: access_token.token }

        should_have_json 'active', true
        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
      end
      
      # We should be able to protect this use case as describbe in RFC 7662
      # If the token can be used only at certain resource servers, the authorization server MUST determine whether or not the token can be used at the resource server making the introspection call.
      it 'responds with full token introspection' do
        request.headers['Authorization'] = "Bearer #{access_token.token}"

        post :introspect, params: { token: access_token2.token }

        should_have_json 'active', true
        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
      end
    end