anchor.diff:                  throw(refresh_wrong_client)
           end,
   
  +        Now = vcn_utils:time(),
           {AccessToken, AccessTokenHash, RefreshTokenNew, ExpirationTime} =
  -            generate_access_tokens(vcn_utils:time()),
  +            generate_access_tokens(Now),
   
           AccessDocUpdated = AccessDoc#veil_document{record = Access#access{
               token = AccessToken,
  
positive.code:                 ok
          end,
  
          {ok, AccessExpirationSecs} = application:get_env(?APP_Name, access_token_expiration_seconds),
          {ok, IssuerUrl} = application:get_env(?APP_Name, openid_issuer_url),
  
          {ok, #user{name = Name, email_list = Emails}} = user_logic:get_user(UserId),
          {ok, [
              {access_token, AccessToken},
              {token_type, bearer},
              {expires_in, AccessExpirationSecs},
              {refresh_token, RefreshToken},
              {scope, openid},
              {id_token, jwt_encode([
                  {iss, vcn_utils:ensure_binary(IssuerUrl)},
                  {sub, UserId},
                  {aud, Audience},
                  {name, Name},
                  {emails, Emails},
                  {exp, ExpirationTime},
                  {iat, Now}
              ])}
          ]}
      catch
          Error -> {error, Error}
      end.
  
negative.code:     #veil_document{uuid = AccessId, record = Access} = AccessDoc,
      ?alert("Revoking access id: ~p, contents: ~p", [AccessId, Access]),
      ok = ?DB(remove_access, AccessId).
  
  
  %% prepare_token_response/1
  %% ====================================================================
  %% @doc Prepares an OpenID token response to encode into JSON.
  %% ====================================================================
  -spec prepare_token_response(UserId :: binary(), ProviderId :: binary(),
      AccessToken :: binary(), RefreshToken :: binary(),
      ExpirationTime :: non_neg_integer(), Now :: non_neg_integer()) ->
      proplists:proplist().
  %% ====================================================================
  prepare_token_response(UserId, ProviderId, AccessToken, RefreshToken, ExpirationTime, Now) ->
      {ok, AccessExpirationSecs} = application:get_env(?APP_Name, access_token_expiration_seconds),
      {ok, IssuerUrl} = application:get_env(?APP_Name, openid_issuer_url),
  
      Audience = case ProviderId of
          undefined -> UserId;
          _ -> ProviderId
      end,
  
      {ok, #user{name = Name, email_list = Emails}} = user_logic:get_user(UserId),
      {ok, [
          {access_token, AccessToken},
          {token_type, bearer},
          {expires_in, AccessExpirationSecs},
          {refresh_token, RefreshToken},
          {scope, openid},
          {id_token, jwt_encode([
              {iss, vcn_utils:ensure_binary(IssuerUrl)},
              {sub, UserId},
              {aud, Audience},
              {name, Name},
              {emails, Emails},
              {exp, ExpirationTime},
              {iat, Now}
          ])}
      ]}.
  