committed 03:53PM - 11 Sep 26 UTC
Some providers return a token response with no access token at all, or
with an e…mpty `access_token` alongside the `id_token`. `oauth2` 2.x
treats `id_token` as one of the keys that can hold the token value, so
`AccessToken.from_hash` either takes the `id_token` and removes it from
the params, leaving `access_token["id_token"]` nil and the JWT decode
failing, or it takes the empty `access_token` and raises
"OAuth2::AccessToken has no token".
When userinfo is disabled the strategy reads everything it needs from
the `id_token`, so build the access token directly and keep the whole
parsed response in the params.
- The spec for the userinfo-disabled path goes back to an
`id_token`-only token response, which is what a provider with no
userinfo endpoint sends.
- A new case covers a response with a blank `access_token`.