Mercurial > prosody-modules
changeset 5446:dd7bddc87f98
mod_http_oauth2: Fix inclusion of role in refreshed access tokens
`refresh_token_info` does not carry the role, and due to behavior prior
to prosody trunk rev a1ba503610ed it would have reverted to the users'
default role. After that it instead issues a token without role which is
thus not usable with e.g. mod_rest
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Thu, 11 May 2023 21:37:35 +0200 |
| parents | 74fdf4a7cca1 |
| children | aa4828f040c5 |
| files | mod_http_oauth2/mod_http_oauth2.lua |
| diffstat | 1 files changed, 4 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/mod_http_oauth2/mod_http_oauth2.lua Thu May 11 15:10:44 2023 +0200 +++ b/mod_http_oauth2/mod_http_oauth2.lua Thu May 11 21:37:35 2023 +0200 @@ -410,11 +410,14 @@ return oauth_error("invalid_grant", "invalid refresh token"); end + local refresh_scopes = refresh_token_info.grant.data.oauth2_scopes; + local new_scopes, role = filter_scopes(username, refresh_scopes); + -- new_access_token() requires the actual token refresh_token_info.token = params.refresh_token; return json.encode(new_access_token( - refresh_token_info.jid, refresh_token_info.role, refresh_token_info.grant.data.oauth2_scopes, client, nil, refresh_token_info + refresh_token_info.jid, role, new_scopes, client, nil, refresh_token_info )); end