# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1687684327 -7200
# Node ID 540beba5b75b53ce87046943d0f51350be4969cc
# Parent  d52cc18f0aa883113d203d1ebfbfbf7e1bb6641b
mod_http_oauth2: Always show list of requested scopes

Upon further reflection, these are probably too important to hide behind
a <details> thing.

diff -r d52cc18f0aa8 -r 540beba5b75b mod_http_oauth2/html/consent.html
--- a/mod_http_oauth2/html/consent.html	Sun Jun 25 00:00:02 2023 +0200
+++ b/mod_http_oauth2/html/consent.html	Sun Jun 25 11:12:07 2023 +0200
@@ -14,6 +14,7 @@
 
 	<h1>{site_name}</h1>
 	<fieldset>
+	<form method="post">
 	<legend>Authorize new application</legend>
 	<p>A new application wants to connect to your account.</p>
 	<dl>
@@ -29,6 +30,11 @@
 		{client.policy_uri&
 		<dt>Policy</dt>
 		<dd><a href="{client.policy_uri}">View policy</a></dd>}
+
+		<dt>Requested permissions</dt>
+		<dd>{scopes#
+			<input class="scope" type="checkbox" id="scope_{idx}" name="scope" value="{item}" checked><label class="scope" for="scope_{idx}">{item}</label>}
+		</dd>
 	</dl>
 
 	<p>To allow <em>{client.client_name}</em> to access your account
@@ -36,10 +42,6 @@
 	   select 'Allow'. Otherwise, select 'Deny'.
 	</p>
 
-	<form method="post">
-		<details><summary>Requested permissions</summary>{scopes#
-			<input class="scope" type="checkbox" id="scope_{idx}" name="scope" value="{item}" checked><label class="scope" for="scope_{idx}">{item}</label>}
-		</details>
 		<input type="hidden" name="user_token" value="{state.user.token}">
 		<button type="submit" name="consent" value="denied">Deny</button>
 		<button type="submit" name="consent" value="granted">Allow</button>