Should external introspection's client_id be stuffed into application?

[n2ygk]

If the introspection endpoint is external (not using oauth2_provider as the OAuth 2 AS) the
application gets set to None here:

django-oauth-toolkit/oauth2_provider/oauth2_validators.py

Lines 335 to 344 in 5b51da7

	access_token, _created = AccessToken\
	.objects.select_related("application", "user")\
	.update_or_create(token=token,
	defaults={
	"user": user,
	"application": None,
	"scope": scope,
	"expires": expires,
	})

In the case of Implicit or Authorization Code grants, the external introspected username is potentially added to the UserModel here if it doesn't already exist:

django-oauth-toolkit/oauth2_provider/oauth2_validators.py

Lines 313 to 317 in 5b51da7

	if "active" in content and content["active"] is True:
	if "username" in content:
	user, _created = UserModel.objects.get_or_create(
	**{UserModel.USERNAME_FIELD: content["username"]}
	)

Should the external introspected client_id also cause a similar thing to happen, creating an Application instance if one is not defined?

Currently, because AccessToken.application is None, there is no consistent way to identify which OAuth2 Client was used. If the internal introspection server was used, application is set but if the external introspection server was used, application is not.

This is especially a concern when the Client Credentials grant type is used as there is no user.

Would it break anything to dummy up an application instance in a manner similar to what is currently done for user? Something along these lines right around the same lines referenced above:

application, _created = Application.objects.get_or_create(
    client_id=content["client_id"],
    user=None,
    redirect_uris="",
    client_type="Public",
    authorization_grant_type="", # what to put here?
    client_secret="",
    name=content["client_id"],
)

[n2ygk]

A workaround is to assign each Client Credentials client a unique scope in the external OAuth2 AS that only it is allowed to request and to check for that scope in TokenMatchesOASRequirements