do not process id token on token_refresh grant

src/OpenIDConnectProvider.php

@@ -23,6 +23,8 @@
 
 final class OpenIDConnectProvider extends GenericProvider
 {
+    const EXCLUDED_GRANTS = ['refresh_token'];
+
     private ValidatorChain $validatorChain;
     private Signer $signer;
 
@@ -123,6 +125,10 @@ private function constructKey(string $content): Key
     public function getAccessToken($grant, array $options = [])
     {
         $accessToken = parent::getAccessToken($grant, $options);
+        if (in_array((string) $grant, self::EXCLUDED_GRANTS)) {
+
+            return $accessToken;
+        }
         if (!$accessToken instanceof AccessToken) {
             throw new InvalidTokenException('Received wrong access token type');
         }

tests/Unit/OpenIDConnectProviderTest.php

@@ -478,4 +478,52 @@ private function mockParentClassForAccessToken(MockObject $grant, array $options
             ->with(self::identicalTo('content-type'))
             ->willReturn('some content-type');
     }
+
+    public function dataForRefreshTokenRetrieval(): array
+    {
+        return [
+            '1. refresh-token grant' => [
+                'grant' => 'refresh_token',
+                'exception' => null,
+                'exceptionMessage' => null,
+            ],
+            '2. access-token grant' => [
+                'grant' => 'access-code',
+                'exception' => InvalidTokenException::class,
+                'exceptionMessage' => 'Received an invalid id_token from authorization server',
+            ],
+        ];
+    }
+
+    /**
+     * @param string $grantName Grant specified by its name
+     * @param string|null $expectedException
+     * @param string|null $expectedExceptionMessage
+     *
+     * @dataProvider dataForRefreshTokenRetrieval
+     */
+    public function testRefreshTokenRetrieval(
+        string $grantName,
+        ?string $expectedException = null,
+        ?string $expectedExceptionMessage = null
+    ) {
+        $grant = $this->createMock(AbstractGrant::class);
+        $grant
+            ->method('__toString')
+            ->willReturn($grantName);
+
+        $this->mockParentClassForAccessToken($grant, []);
+
+        if ($expectedException) {
+            $this->expectException($expectedException);
+        }
+        if ($expectedExceptionMessage) {
+            $this->expectExceptionMessage($expectedExceptionMessage);
+        }
+        $accessToken = $this->provider->getAccessToken($grant);
+
+        if (!$expectedException) {
+            $this->assertEquals('some access-token', $accessToken->getToken());
+        }
+    }
 }