Refresh Token is not provided with offline_access

[tommyasai]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

Hi Ory team, I really appreciate your work to develop such a great product.
This could be an entry-level question but let me ask here because I am struggling with this for weeks.

I cannot get a refresh token even if I set offline_access or offline to scope.

Is it supposed to be included in the response body as well as the access token? Or somewhere else?
Is anything necessary to get a refresh token?

Reproducing the bug

The following is my client info.

{
        "client_id": "MY CLIENT ID",
        "client_name": "MY CLIENT NAME",
        "created_at": "2022-02-01T00:01:20.000Z",
        "grant_types": [
                "authorization_code",
                "refresh_token"
        ],
        "jwks": {},
        "metadata": {},
        "redirect_uris": [
                "https://oauth-redirect.googleusercontent.com/r/myproject",
                "https://oauthdebugger.com/debug"
        ],
        "response_types": [
                "code"
        ],
        "scope": "openid offline offline_access",
        "subject_type": "public",
        "token_endpoint_auth_method": "client_secret_post",
        "updated_at": "2022-02-02T14:13:50.000Z",
        "userinfo_signed_response_alg": "none"
}

This is the request contents. I use https://oauthdebugger.com to test it by myself.
I tried offline, offline_access, and offline offline_access

POST /oauth/oauth2/token HTTP/1.1
Host: MY HOST
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache

grant_type=authorization_code&code=<MY CODE>&client_id=<MY CLIENT>&client_secret=<MY SECRET>&redirect_uri=https%3A%2F%2Foauthdebugger.com%2Fdebug&scope=offline

Relevant log output

I couldn't find any errors in the logs.

Relevant configuration

No response

Version

1.10.6

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Kubernetes

Additional Context

[Background]
I want to authorize Google Actions to access our app,
but it's timed out within 30 minutes probably because the refresh token is not supplied.
In addition, the Test Suite of Google Actions also failed with refresh token not provided error.

[aeneasr]

Thank you for the question, please ensure that the user grants the scope as well when accepting consent.

[tommyasai]

@aeneasr
As you said, we found that the offline scope was missing when requesting a consent challenge to hydra from our identity service.
After including the offline to the consent request, I could get the refresh token.
I really appreciate your prompt response!!