configure introspection correctly

lib/policy_service_web/router.ex

@@ -15,7 +15,7 @@ defmodule PolicyServiceWeb.Router do
     plug PolicyServiceWeb.Plugs.RequireOrganizationId
     plug PolicyServiceWeb.Plugs.ExtractOrganizationId
 
-    plug :validate
+    plug :introspect
     plug :authorize_roles
   end
 
@@ -46,17 +46,18 @@ defmodule PolicyServiceWeb.Router do
     get "/", OpenApiSpex.Plug.SwaggerUI, path: "/api/openapi"
   end
 
-  def validate(conn, _opts) do
+  def introspect(conn, _opts) do
     zitadel = Application.get_env(:policy_service, :zitadel)
 
     opts =
-      Oidcc.Plug.ValidateJwtToken.init(
+      Oidcc.Plug.IntrospectToken.init(
         provider: PolicyService.ZitadelProvider,
         client_id: zitadel[:client_id],
-        client_secret: zitadel[:client_secret]
+        client_secret: zitadel[:client_secret],
+        token_introspection_opts: %{client_self_only: false}
       )
 
-    Oidcc.Plug.ValidateJwtToken.call(
+    Oidcc.Plug.IntrospectToken.call(
       conn,
       opts
     )