Implement Access Policy for Managed Roles

refactor simple_oauth to use access policies instead of RoleStorage::isPermissionInRoles()

The maintainers of simple_oauth may already be thinking ahead to using access policies, so we should coordinate with them to see if there are any plans developing already. We may also have to live with a patch or override for a bit, if they need to support Drupal 10.2 or earlier (before access policies were implemented).

Maybe the first place to look is \Drupal\simple_oauth\Authentication\TokenAuthUser::hasPermission(), which ultimately delegates down to \Drupal\simple_oauth\Oauth2ScopeProvider::scopeHasPermission(), which is where the module is currently checking RoleStorage::isPermissionInRoles().

However, in the process of testing ahead of the farmOS 3.3.0 release (which include these updates), we discovered that managed role permissions were not being applied in OAuth2 API requests

We also need to add some basic tests of the farmOS API using OAuth2. Our current tests did not catch this issue. This would be a good time to add those tests.

For what it's worth, I also opened a core issue suggesting that RoleStorage::isPermissionInRoles() be deprecated: 📌 Deprecate RoleStorage::isPermissionInRoles() Active

I've opened a PR on Github implementing these changes: https://github.com/farmOS/farmOS/pull/922

2. refactor simple_oauth to use access policies instead of RoleStorage::isPermissionInRoles()

It sounds like this might be underway in 🐛 6.0 is missing cache context + access policy support Active .