I am looking at this test case https://github.com/ory/hydra/blob/master/oauth2/fosite_store_helpers.go#L185-L212 and I see that it stores multiple sessions with same request ID, is this really valid? shouldn't request IDs be unique? especially because fosite store interface has

RevokeAccessToken

and

RevokeRefreshToken

which operate based on request ID, so then they can revoke multiple tokens?

Yes, revokation revokes the whole request chain as per spec

but isn't there always just one token per (request ID, token type)?

Not with the new graceful feature

I see, thanks

any time