Repository: oauthlib/oauthlib

Issue:
OIDC request_type "code token" does not save access token
I was experimenting with `django-oauth-toolkit` and noticed when setting a request type of `code token` the returned access token was not valid because it was not saved into the database. Looking into the issue I believe that during the hybrid flow for `code`, after the token is generated there is a missing call to `request_validator.save_token(code, request)`.

That is, the following code:

https://github.com/oauthlib/oauthlib/blob/d54965b86ce4ede956db70baff0b3d5e9182a007/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py#L272-L279

After `oauth2.rfc6749.grant_types.base.GrantTypeBase.add_token` is called as a modifier there is no corresponding call to `request_validator.save_token`. That is, I would have expected (based on examining the implicit flow) to see something like the following present:

```python
if 'access_token' in grant:
  self.request_validator.save_token(grant, request)
```

Alternatively, if `save_authorization_code` is expected to make this check then this is an issue for the `django-oauth-toolkit` project.

### Version

```plaintext
$ pip3 freeze | grep oauth
django-oauth-toolkit==1.5.0
oauthlib==3.1.0
```



Comments:

Patch:
diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
index bf42d88..97aeca9 100644
--- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
+++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
@@ -272,6 +272,8 @@ class AuthorizationCodeGrant(GrantTypeBase):
         grant = self.create_authorization_code(request)
         for modifier in self._code_modifiers:
             grant = modifier(grant, token_handler, request)
+        if 'access_token' in grant:
+            self.request_validator.save_token(grant, request)
         log.debug('Saving grant %r for %r.', grant, request)
         self.request_validator.save_authorization_code(
             request.client_id, grant, request)


Test patch:
diff --git a/tests/oauth2/rfc6749/grant_types/test_authorization_code.py b/tests/oauth2/rfc6749/grant_types/test_authorization_code.py
index 20a2416..dec5323 100644
--- a/tests/oauth2/rfc6749/grant_types/test_authorization_code.py
+++ b/tests/oauth2/rfc6749/grant_types/test_authorization_code.py
@@ -324,3 +324,18 @@ class AuthorizationCodeGrantTest(TestCase):
             authorization_code.code_challenge_method_s256("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
                                                           "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM")
         )
+
+    def test_code_modifier_called(self):
+        bearer = BearerToken(self.mock_validator)
+        code_modifier = mock.MagicMock(wraps=lambda grant, *a: grant)
+        self.auth.register_code_modifier(code_modifier)
+        self.auth.create_authorization_response(self.request, bearer)
+        code_modifier.assert_called_once()
+
+    def test_hybrid_token_save(self):
+        bearer = BearerToken(self.mock_validator)
+        self.auth.register_code_modifier(
+            lambda grant, *a: dict(list(grant.items()) + [('access_token', 1)])
+        )
+        self.auth.create_authorization_response(self.request, bearer)
+        self.mock_validator.save_token.assert_called_once()