rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix advertised scopes for oauth protected resources

Browse Source 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-25 10:21:47 +02:00
parent 38b6bbf4b5
commit 2ba8464d4e
6 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/iam/oauth2/protected_resource_metadata.go
View File

@@ -31,7 +31,7 @@ type ProtectedResourceMetadata struct {
func NewProtectedResourceMetadata(
resource uri.URI,
authorizationServer uri.URI,
registeredScopes []coredata.OAuth2Scope,
writeScopes []coredata.OAuth2Scope,
) *ProtectedResourceMetadata {
return &ProtectedResourceMetadata{
Resource: resource,
@@ -39,6 +39,6 @@ func NewProtectedResourceMetadata(
BearerMethodsSupported: []string{
"header",
},
ScopesSupported: protectedResourceScopes(registeredScopes),
ScopesSupported: protectedResourceScopes(writeScopes),
}
}

6
pkg/iam/oauth2/protected_resource_metadata_test.go
View File

@@ -32,19 +32,21 @@ func TestNewProtectedResourceMetadata(t *testing.T) {
reg := oauth2scope.NewRegistry().Register(
map[coredata.OAuth2Scope][]string{
probo.ScopeV1DocumentRead: {"core:document:get"},
probo.ScopeV1Document: {"core:document:create"},
},
)
resource := uri.URI("https://app.example.com")
authorizationServer := uri.URI("https://app.example.com")
metadata := oauth2.NewProtectedResourceMetadata(resource, authorizationServer, reg.RegisteredScopes())
metadata := oauth2.NewProtectedResourceMetadata(resource, authorizationServer, reg.AllWriteScopes())
require.NotNil(t, metadata)
assert.Equal(t, resource, metadata.Resource)
assert.Equal(t, []uri.URI{authorizationServer}, metadata.AuthorizationServers)
assert.Equal(t, []string{"header"}, metadata.BearerMethodsSupported)
assert.Contains(t, metadata.ScopesSupported, oauth2.ScopeOpenID)
assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1Document)
assert.NotContains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
assert.NotContains(t, metadata.ScopesSupported, oauth2.ScopeProfile)
}

4
pkg/iam/oauth2/scopes.go
View File

@@ -32,9 +32,9 @@ func authorizationServerScopes(registeredScopes []coredata.OAuth2Scope) []coreda
)
}
func protectedResourceScopes(registeredScopes []coredata.OAuth2Scope) []coredata.OAuth2Scope {
func protectedResourceScopes(writeScopes []coredata.OAuth2Scope) []coredata.OAuth2Scope {
return slices.Concat(
[]coredata.OAuth2Scope{ScopeOpenID},
registeredScopes,
writeScopes,
)
}

2
pkg/iam/service.go
View File

@@ -233,7 +233,7 @@ func (s *Service) OAuth2ServerMetadata(endpoints oauth2.Endpoints) *oauth2.Serve
// OAuth2ProtectedResourceMetadata returns the RFC 9728 protected resource metadata document.
func (s *Service) OAuth2ProtectedResourceMetadata(resource uri.URI) *oauth2.ProtectedResourceMetadata {
return oauth2.NewProtectedResourceMetadata(resource, resource, s.OAuth2ScopeRegistry.RegisteredScopes())
return oauth2.NewProtectedResourceMetadata(resource, resource, s.OAuth2ScopeRegistry.AllWriteScopes())
}
func (s *Service) IsSignUpEnabled() bool {