Diff

mod_http_oauth2/mod_http_oauth2.lua @ 5271:3a1df3adad0c

mod_http_oauth2: Allow user to decide which requested scopes to grant These should at the very least be shown to the user, so they can decide whether to grant them. Considered whether to filter the requested scopes down to actually understood scopes that would be granted, but decided that this was a bit complex for a first step, since role role selection and other kinds of scopes are mixed into the same field here.
author Kim Alvefur <zash@zash.se>
date Thu, 23 Mar 2023 16:28:08 +0100
parent 5268:bac39c6e7203
child 5273:40be37652d70
line wrap: on
line diff
--- a/mod_http_oauth2/mod_http_oauth2.lua	Thu Mar 23 16:19:09 2023 +0100
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Thu Mar 23 16:28:08 2023 +0100
@@ -366,9 +366,14 @@
 			};
 		end
 
+		local scope = array():append(form):filter(function(field)
+			return field.name == "scope";
+		end):pluck("value"):concat(" ");
+
 		user.token = form.user_token;
 		return {
 			user = user;
+			scope = scope;
 			consent = form.consent == "granted";
 		};
 	end
@@ -522,11 +527,14 @@
 		return render_page(templates.login, { state = auth_state, client = client });
 	elseif auth_state.consent == nil then
 		-- Render consent page
-		return render_page(templates.consent, { state = auth_state, client = client }, true);
+		return render_page(templates.consent, { state = auth_state; client = client; scopes = parse_scopes(params.scope) }, true);
 	elseif not auth_state.consent then
 		-- Notify client of rejection
 		return error_response(request, oauth_error("access_denied"));
 	end
+	-- else auth_state.consent == true
+
+	params.scope = auth_state.scope;
 
 	local user_jid = jid.join(auth_state.user.username, module.host);
 	local client_secret = make_client_secret(params.client_id);