@drawbridge/drawbridge-utils 0.0.82 → 0.0.83

package/dist/oauth/server.cjs

@@ -361,6 +361,19 @@ var createOAuthModel = ({ controller }) => ({
     const granted = intersect(scope, token.scope ?? []);
     return granted.length > 0;
   },
+  // Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+  // AuthorizeHandler grants whatever scope the request asks for — the client
+  // registry's scopes list was only advisory (reachable from any logged-in
+  // browser via the dashboard's authorize BFF). Every requested scope must be
+  // registered on the client; an empty request falls back to the client's
+  // full registered grant. Returning false → invalid_scope.
+  validateScope: (user, client, scope) => {
+    const requested = Array.isArray(scope) ? scope : scope ? String(scope).split(/\s+/).filter(Boolean) : [];
+    const allowed = (client == null ? void 0 : client.scopes) ?? [];
+    if (!requested.length) return allowed;
+    const invalid = requested.filter((entry) => !allowed.includes(entry));
+    return invalid.length ? false : requested;
+  },
   // client_credentials grant: treat the client as the resource owner.
   getUserFromClient: (client) => ({ id: client.id, type: "client" })
 });

package/dist/oauth/server.d.cts

@@ -304,6 +304,28 @@ const createOAuthModel = ({ controller }) => ({
 
 	},
 
+	// Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+	// AuthorizeHandler grants whatever scope the request asks for — the client
+	// registry's scopes list was only advisory (reachable from any logged-in
+	// browser via the dashboard's authorize BFF). Every requested scope must be
+	// registered on the client; an empty request falls back to the client's
+	// full registered grant. Returning false → invalid_scope.
+	validateScope : ( user, client, scope ) => {
+
+		const requested = Array.isArray( scope )
+			? scope
+			: ( scope ? String( scope ).split( /\s+/ ).filter( Boolean ) : [] );
+
+		const allowed = client?.scopes ?? [];
+
+		if( ! requested.length ) return allowed;
+
+		const invalid = requested.filter( ( entry ) => ! allowed.includes( entry ) );
+
+		return invalid.length ? false : requested;
+
+	},
+
 	// client_credentials grant: treat the client as the resource owner.
 	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
 

package/dist/oauth/server.d.ts

@@ -304,6 +304,28 @@ const createOAuthModel = ({ controller }) => ({
 
 	},
 
+	// Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+	// AuthorizeHandler grants whatever scope the request asks for — the client
+	// registry's scopes list was only advisory (reachable from any logged-in
+	// browser via the dashboard's authorize BFF). Every requested scope must be
+	// registered on the client; an empty request falls back to the client's
+	// full registered grant. Returning false → invalid_scope.
+	validateScope : ( user, client, scope ) => {
+
+		const requested = Array.isArray( scope )
+			? scope
+			: ( scope ? String( scope ).split( /\s+/ ).filter( Boolean ) : [] );
+
+		const allowed = client?.scopes ?? [];
+
+		if( ! requested.length ) return allowed;
+
+		const invalid = requested.filter( ( entry ) => ! allowed.includes( entry ) );
+
+		return invalid.length ? false : requested;
+
+	},
+
 	// client_credentials grant: treat the client as the resource owner.
 	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
 

package/dist/oauth/server.js

@@ -326,6 +326,19 @@ var createOAuthModel = ({ controller }) => ({
     const granted = intersect(scope, token.scope ?? []);
     return granted.length > 0;
   },
+  // Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+  // AuthorizeHandler grants whatever scope the request asks for — the client
+  // registry's scopes list was only advisory (reachable from any logged-in
+  // browser via the dashboard's authorize BFF). Every requested scope must be
+  // registered on the client; an empty request falls back to the client's
+  // full registered grant. Returning false → invalid_scope.
+  validateScope: (user, client, scope) => {
+    const requested = Array.isArray(scope) ? scope : scope ? String(scope).split(/\s+/).filter(Boolean) : [];
+    const allowed = (client == null ? void 0 : client.scopes) ?? [];
+    if (!requested.length) return allowed;
+    const invalid = requested.filter((entry) => !allowed.includes(entry));
+    return invalid.length ? false : requested;
+  },
   // client_credentials grant: treat the client as the resource owner.
   getUserFromClient: (client) => ({ id: client.id, type: "client" })
 });

package/package.json

@@ -164,5 +164,5 @@
     "test": "node --test test/"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.82"
+  "version": "0.0.83"
 }