Repository navigation
feat(oauth): Let users narrow granted scopes on consent - #128404
Open
sentry-junior[bot] wants to merge 1 commit into
Open
sentry-junior[bot] wants to merge 1 commit into
sentry-junior[bot] wants to merge 1 commit into
Conversation
Authorize and device consent decisions accept an optional scopes list. When present, only that subset of the requested scopes is persisted to the authorization, grant, implicit token, or device code. Omitting it keeps the existing grant-everything behavior, so current clients are unaffected. Selections outside the requested scopes are rejected: authorize redirects with invalid_scope, device returns a 400 and keeps the request pending. Co-Authored-By: Evan Purkhiser <evan.purkhiser@sentry.io>
github-actions
Bot
added
the
Scope: Backend
Contributor
|
This issue has gone three weeks without activity. In another week, I will close it. But! If you comment or otherwise update it, I will reset the clock, and if you remove the label "A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backend half of letting users pick which requested permissions an OAuth app actually gets on the consent screen. This is progressive enhancement: the consent page can start sending a selection whenever it's ready, and nothing changes for callers that don't.
API change
POST /api/0/oauth/authorize/andPOST /api/0/oauth/device/now accept an optionalscopes: string[]on the decision body (shared throughConsentDecisionSerializer).null: every requested scope is granted. This is the current behavior, so existing clients are unaffected.ApiAuthorization,ApiGrant.scope_list, the implicitApiToken, andApiDeviceCode.scope_list. Device token exchange already issues tokens from that last field.invalid_scope, the same way org-selection failures already redirect. In the device flow it returns a 400 onscopesand the request stays pending, so the user can correct it.The token endpoint already returns the real granted
scope, as RFC 6749 §5.1 requires. Clients that let users narrow should read that value instead of assuming they got the full set.Behavior notes
project:readwhen onlyproject:writewas requested) is left for a follow-up.hasExistingConsentisfalsethe next time the app requests the full set, so they see the consent screen again. That seems right, and there's a test for it.via evan.purkhiser.
--
View Junior Session [Sentry]