Adds code to warn users, when scope is downgraded

CHANGELOG.md

@@ -1,5 +1,8 @@
 ## Changelog
 
+5.2.4 - 2026-07-27
+- Added code to warn users if scope is downgraded
+
 5.2.3 - 2026-07-20
 - Added code to harden check and disallow update user action
 

OAuth2.php

@@ -187,6 +187,7 @@ public function getClientSideTranslationKeys(&$translationKeys)
         $translationKeys[] = 'OAuth2_AdminTypeHelp';
         $translationKeys[] = 'OAuth2_AdminGrantTypesHelp';
         $translationKeys[] = 'OAuth2_AdminScopeHelp';
+        $translationKeys[] = 'OAuth2_AdminScopeReducedWarning';
         $translationKeys[] = 'OAuth2_AdminRedirectUrisHelp';
         $translationKeys[] = 'OAuth2_AdminActiveHelp';
         $translationKeys[] = 'OAuth2_ErrorXNotProvided';

lang/en.json

@@ -44,6 +44,7 @@
     "AdminScope": "Allowed scope",
     "AdminScopes": "Allowed scopes",
     "AdminScopeHelp": "Scope defines the maximum access level granted to the OAuth token. For example, if the %1$sadmin%2$s scope is used, the token will have admin-level access at most, even if the authenticated user is a superuser.",
+    "AdminScopeReducedWarning": "You reduced the allowed scope, but access tokens already issued keep their previous scope until they expire. To restrict existing access immediately, Pause the client.",
     "AdminRedirectUris": "Redirect URIs (one per line)",
     "AdminRedirectUrisHelp": "Allowed redirect or callback URIs for the authorisation code flow (one per line, must match exactly).",
     "AdminActiveLabel": "Active",

plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "OAuth2",
   "description": "Provide secure access to the Matomo API using scoped permissions. No static credentials.",
-  "version": "5.2.3",
+  "version": "5.2.4",
   "theme": false,
   "require": {
     "php": ">=8.1.0",

tests/UI/OAuth2_spec.js

@@ -97,7 +97,7 @@ describe("OAuth2Admin", function () {
         await testEnvironment.save();
     }
 
-    async function fillClientForm(name, typeTitle, redirectUri)
+    async function fillClientForm(name, typeTitle, redirectUri, scopeTitle = 'Matomo read level access')
     {
         await page.evaluate(function (name) {
             $('#name').val(name).change();
@@ -110,7 +110,7 @@ describe("OAuth2Admin", function () {
             await selectValue(page, 'div[name="type"]', typeTitle);
         }
 
-        await selectValue(page,'div[name="scopes"]', 'Matomo read level access.');
+        await selectValue(page,'div[name="scopes"]', scopeTitle);
         await page.evaluate(function (redirectUri) {
             const redirectField = document.querySelector('#redirect_uris');
 
@@ -204,4 +204,37 @@ describe("OAuth2Admin", function () {
         });
         await capturePage('secret_not_shown_again');
     });
+
+    it('should warn when an existing client scope is reduced', async function () {
+        // Create a client with admin scope, then reduce it to read on edit.
+        await page.goto(createUrl);
+        await fillClientForm('Scope narrowing client', 'Confidential', 'https://narrow.example/callback', 'Matomo admin level access');
+        await submitForm(true);
+
+        await page.goto(adminUrl);
+        await editFirstClient();
+        await selectValue(page, 'div[name="scopes"]', 'Matomo read level access');
+        await submitForm();
+
+        await page.waitForSelector('#notificationContainer .notification-warning', { visible: true });
+        const warningText = await page.$eval('#notificationContainer .notification-warning', (el) => el.innerText);
+
+        expect(warningText).to.contain('reduced the allowed scope');
+    });
+
+    it('should not warn when an existing client scope is not reduced', async function () {
+        // Editing without lowering the scope must not raise the warning.
+        await page.goto(createUrl);
+        await fillClientForm('Scope unchanged client', 'Confidential', 'https://unchanged.example/callback', 'Matomo read level access');
+        await submitForm(true);
+
+        await page.goto(adminUrl);
+        await editFirstClient();
+        await page.evaluate(function () {
+            $('#name').val('Scope unchanged client renamed').change();
+        });
+        await submitForm();
+
+        expect(await page.$('#notificationContainer .notification-warning')).to.be.null;
+    });
 });