Skip to content

v1.0.4

Choose a tag to compare

View all tags
@mathsgod mathsgod released this 08 Oct 07:59
· 6 commits to main since this release
v1.0.4
8f8117d

Adds optional scope selection for authorization requests that omit scope. Enable OAUTH_AUTO_SELECT_SCOPES=true through ProviderFactory, or autoSelectScopes: true on Config. Selected scopes are the intersection of the provider allowlist, client scopes, and current user permissions.

  • Shows selected scopes in the built-in consent page and requires renewed consent if the selection changes before approval.
  • Rejects an empty intersection and preserves strict handling of explicitly requested scopes.
  • Keeps automatic selection disabled by default. Custom AuthorizationFlow implementations must integrate the request-local AutomaticScopes helper before enabling it; README includes migration instructions.
  • Updates README and .env.example with configuration and behavior.

Validation: full suite completed with 117 tests, 600 assertions, and 8 optional integration skips. Both browser consent integration tests also passed separately with a configured Light checkout (28 assertions). Composer validation passed.

Assets 2
Loading