Provide default scopes if client is not requesting a specific scope

I don't understand how this can be achieved in 6.0. The goal is to dynamically assign scopes based on the user role. The ability to add default roles per consumer does not achieve assigning default roles per user -- users of different roles may use the same consumer.

However, we could add an event that developers can subscribe to (or a hook alter) to alter the scope negotiation behaviour on a custom module.

I opened a new MR that does this: it adds hook_simple_oauth_scopes_alter(), allowing to alter the requested scopes.

dieterholvoet → changed the visibility of the branch 6.0.x to hidden.

dieterholvoet → changed the visibility of the branch 2857930-provide-default-scopes-6.x to hidden.

dieterholvoet → changed the visibility of the branch 2857930-2857930-provide-default-scopes-6.x to hidden.

The example in simple_oauth.api.php is what users would have to add to a custom module to achieve what this issue is about.

FYI: this issue becomes more important when using Dynamic Client Registration with Oauth, which I was impkementing. In such a case the authorization code grant type is used and the client does not manually select any scopes but we need default scopes to be set otherwise the request becomes invalid.