- 🇺🇸United States m.stenta
Bumping this to 3.x - but it may need to be updated/closed if the Simple OAuth v6 upgrade affects it.
- Status changed to Closed: won't fix
about 1 year ago 6:31pm 30 October 2023 - 🇺🇸United States paul121 Spokane, WA
I should note that those tools and scripts won't support both farmOS 1.x and 2.x long term,
... and now 3.x and Simple OAuth v6 is in the mix. In v6 consumers can no-longer automatically grant "user access" to a token. This is because all scopes must now be created separate of roles, either as an OAuth2 Scope config entity, or be defined in a static scopes file. There is no guarantee that scopes have been created for each role that exists in the system (although I think this would be a nice convenience thing for simple OAuth to offer).
Ultimately I think it is a good that API integrations be more specific in requesting which scopes they require and not blanket granting all user access. This will require some work in the short term for existing apps/integrations to upgrade and make sure the relevant scopes exist on the server(s) they are connecting to. But in the long term this new implementation of OAuth2 scopes should make things easier because we can provide a default set of scopes that are based on permissions instead of roles, and applications can be more confident that these general purpose scopes they are requesting will exist (eg: "asset:view", "asset:create")