thephpleague/oauth2-client

2.8.0 breaks exiting scope handling

MrMooky opened this issue · 5 comments

MrMooky commented

Last week's release introduced the following in the getAccessToken() function:

https://github.com/thephpleague/oauth2-client/pull/1030/files#diff-e8490e4bb8acb102745699d2bd7aa0a298d836c92d00d2ed57dd4c7ad8b24282

if (empty($options['scope'])) {
    $options['scope'] = $this->getDefaultScopes();
}

if (is_array($options['scope'])) {
    $separator = $this->getScopeSeparator();
    $options['scope'] = implode($separator, $options['scope']);
}

This broke my existing integration because previously added scopes were lost and I got an API error: ACCESS_TOKEN_SCOPE_INSUFFICIENT.

To "fix" the issue, I had to add the scopes like this while refreshing the token:

$newAccessToken = $this->provider->getAccessToken('refresh_token', [
    'refresh_token' => $existingAccessToken->getRefreshToken(),
    'scope' => ['openid', 'email', 'profile', 'https://www.googleapis.com/auth/drive.file'],
]);

All the default ('openid', 'email', 'profile') scopes, plus the one I already added while calling getAuthorizationUrl(). So to me, 2.8.0 is a breaking change that should have been mentioned.

liayn commented

Discussion to be continued in #1030 please.

barryvdh commented

Can you try if #1053 fixes your issue?

tm1000 commented

@barryvdh that fixes the issue

jamesmacwhite commented

I have been going crazy chasing this issue with the Google Provider where the scopes requested outside of the default were being lost on refresh token actions.

I have downgraded back to 2.7.0 temporarily to fix this. It would be good to pin this issue because the Google Provider gets broken pretty bad by this currently.

  • 👍2
YungBricoCoop commented

Thanks a lot for reporting this bug! We just spent 5 hours debugging our app only to find out that this little piece of code was breaking everything. Pinning the dependency to 2.7.0 works perfectly.