fix(oauth): add exp to idToken (#20694) (#20903)

(cherry picked from commit e0ed7d3)

Co-authored-by: William Luke <william@atto-byte.com>

frappe/oauth.py

@@ -331,6 +331,8 @@ def finalize_id_token(self, id_token, token, token_handler, request):
 
 		userinfo = get_userinfo(user)
 
+		id_token["exp"] = id_token.get("iat") + token.get("expires_in")
+
 		if userinfo.get("iss"):
 			id_token["iss"] = userinfo.get("iss")
 
@@ -363,6 +365,7 @@ def get_authorization_code_scopes(self, client_id, code, redirect_uri, request):
 
 	def get_jwt_bearer_token(self, token, token_handler, request):
 		now = datetime.datetime.now()
+
 		id_token = dict(
 			aud=token.client_id,
 			iat=round(now.timestamp()),

frappe/tests/test_oauth20.py

@@ -335,6 +335,7 @@ def decode_id_token(self, id_token):
 			audience=self.client_id,
 			key=self.client_secret,
 			algorithms=["HS256"],
+			options={"verify_signature": True, "require": ["exp", "iat", "aud"]},
 		)