2418079785
RFC 7662 lets clients introspect any OAuth2 token, but the endpoint only resolved access tokens. Look up refresh tokens too, honor the optional token_type_hint to drive lookup order with a fallback to the other table, and report revoked or expired refresh tokens as inactive. Signed-off-by: Bryan Frimin <bryan@getprobo.com>