Modgud.Client.AspNetCore is JWT-only (AddJwtBearer + JWKS). The admin-UI default access-token type is Reference, so every lib consumer must remember to flip their client to JWT — documented as the #1 setup pitfall in docs/integrate/resource-server.md.
Add an introspection-based mode so the lib can validate the default token type:
- Validate opaque tokens via
POST /connect/introspect (RFC 7662; OpenIddict stock pipeline — Modgud does not customize it). The RS needs its own client credentials for introspection, which materially changes the config surface (ModgudOptions gains client_id/secret or a dedicated introspection credential).
- Handle
active: false (401), map the introspection claims (incl. resource_access, which is destination-tagged into the access token — note: no in-repo test currently pins that introspection actually returns it; add one first).
- Decide caching deliberately: reference tokens'' selling point is instant revocation — an introspection cache trades that away; if a TTL cache is added it must be opt-in and documented.
- TestApps: a Reference-token variant of the ResourceApi sample (or a config toggle) + docs reframing "JWT prerequisite" into "two supported modes".
Context: split out of #116 (whose resolution — prefer token-embedded claims — only benefits JWT clients).
Modgud.Client.AspNetCoreis JWT-only (AddJwtBearer+ JWKS). The admin-UI default access-token type isReference, so every lib consumer must remember to flip their client to JWT — documented as the #1 setup pitfall indocs/integrate/resource-server.md.Add an introspection-based mode so the lib can validate the default token type:
POST /connect/introspect(RFC 7662; OpenIddict stock pipeline — Modgud does not customize it). The RS needs its own client credentials for introspection, which materially changes the config surface (ModgudOptionsgains client_id/secret or a dedicated introspection credential).active: false(401), map the introspection claims (incl.resource_access, which is destination-tagged into the access token — note: no in-repo test currently pins that introspection actually returns it; add one first).Context: split out of #116 (whose resolution — prefer token-embedded claims — only benefits JWT clients).