fix(sso): return token_type, expires_in and profile.name from /sso/token

[burkestar]

Fixes #129

Problem

The POST /sso/token response (authorization_code grant) has only access_token and profile. workos-python 10.5.0 parses it as SSOTokenResponse, which requires expires_in and declares token_type: "Bearer". Because expires_in is missing, client.sso.get_profile_and_token(code=...) fails, so SSO login can't be completed against the emulator.

Changes

• Add token_type: "Bearer" and expires_in (600s, the spec's example) to the response, and sign the access token with that same lifetime.
• Derive the spec-required, nullable Profile.name from first_name/last_name in formatSSOProfile, so /sso/profile gets it too.
• Resolves a pre-existing issue where SSO tokens carried a 1-hour expiry that /sso/profile ignored

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds missing fields to the SSO token response.

The PR appears safe to merge; no new actionable issue was identified.

Summary

The PR adds the token fields and derived profile name needed by SSO SDK clients, then verifies bearer tokens before profile lookup so the reported lifetime is enforced.

• Adds token-response, profile-name, and expiry tests.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[SSO authorization code] --> B["POST /sso/token"]
  B --> C[Signed bearer token and profile]
  C --> D["GET /sso/profile"]
  D --> E{Signature and expiry valid?}
  E -- Yes --> F[Return profile]
  E -- No --> G[401]

Loading

_{Reviews (2) · Last reviewed commit: "fix(sso): enforce the access token's exp..."}