The scope argument is optional in the OAuth2 framework. Therefore the resource owner is allowed to provide a default behavior for a situation where a client is not requesting a specific scope. The current behavior is that all the Scopes configured for the client will be applied, but user roles are ignored.
User roles are added to scopes when client is requesting access token without providing any scopes.
Closed: outdated
5.2
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I don't understand how this can be achieved in 6.0. The goal is to dynamically assign scopes based on the user role. The ability to add default roles per consumer does not achieve assigning default roles per user -- users of different roles may use the same consumer.