Dan MilneandClaude Opus 4.8
8c370d0829
handle_authorization_code_grant and handle_device_code_grant each inlined the same ~50-line access-token / refresh-token / id-token minting and RFC 6749 §5.1 response block. Factor it into mint_and_render_tokens, parameterized by the redeemed grant (auth code or device code), its belongs_to association, and the claims request. Also moves the auth-code consent lookup ahead of minting so a missing consent record can no longer leave orphaned tokens committed in the transaction (a return inside the locked transaction does not roll back). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUaWqESTbUEdSi9erQ3jgt