Enhancing scopes about oauth2-server-php

[F21]

After more investigation, what if we just pass some data about the request to getSupportedScopes? In this case, getSupportedScopes would just return a list of valid scopes depending on the grant_type, the client_id or some other info?

[F21]

Hmm. But the problem with the "simple" approach is that we will not be able to get the client_id and other request info in the case of the JWT grant type. In this case, we will only be able to get the grant_type and assertion as the JWT is only decoded in the JWTBearer grant type.

So perhaps we do need a validateScope(), but we pass $request and the result of getTokenDataFromRequest to it.

[bshaffer]

I like your thinking. My original thought was to use getSupportedScopes as a way to find the valid ones on a client/user basis.

getClientDataFromRequest in the JWT grant type returns client_id. Shouldn't we be able to use this?

[F21]

Yes! That's what we need! I must have missed getClientDataFromRequest() when I was looking at the code yesterday :p

How about passing $request to getSupportedScopes() as well? Or do you think we should do a bit of refactoring to include the grant_type to the array returned by getClientDataFromRequest()?

[bshaffer]

$request is bulky. Let's avoid passing it unless it makes sense. I would prefer to stick to $user_id, $client_id, and $scope if possible.

[bshaffer]

in fact, we can get rid of getScopeFromRequest... that was mainly just a convenience method I wrote, but I see no reason why that needs to be in there, as that should never require custom logic.

[F21]

Another thought: While we are at it, do you think we should also pass those things to getDefaultScope()? We can increase the flexibility by allowing different default scopes for different client_ids and user_ids etc.

Reason I considered passing $request is that it would be quite useful if we want to return different scopes depending on the grant_type. Is there any other way to get the grant_type without having to use $request?

[bshaffer]

If you want that level of complexity, you could inject the request into the scope object before passing it to the server.

[F21]

That's a good idea! Since custom Scopes can be implemented by using the ScopeInterface, things are quite customizable. :)

[bshaffer]

Closed with the merging of PR #66

[bojanz]

Since we added $client_id to getSupportedScopes(), it would have made sense to pass it to getDefaultScope() too.
If all scopes depend on the client, then so does the default scope.

(I solved this in my implementation by injecting the value into the constructor).