Support "incremental authorization"

[rfk]

OAuth has a nice flow called "incremental authorization" that allows a client to request scopes on an as-needed basis, and have them added to its existing refresh_token rather juggling multiple refresh_tokens:

• https://tools.ietf.org/html/draft-wdenniss-oauth-incremental-auth-01
• https://developers.google.com/identity/protocols/OAuth2WebServer#incrementalAuth

I think this will be useful as we build out a refresh-token-focussed client lib over in https://github.com/mozilla/application-services/issues/40

[eoger]

Would this also help us build a OAuth-based (instead of sessionToken) devices system with 1 refresh token = 1 device?

[rfk]

Yes, exactly :-)

[shane-tomlinson]

Here's the latest proposed spec: https://tools.ietf.org/html/draft-ietf-oauth-incremental-authz-00

[vladikoff]

@rfk @eoger do we close this for now or we need this still?

[rfk]

I'd like to do this one day, but it seems a ways off, we can easily file a fresh bug for it if necessary. 🗡