AccessTokenEntityInterface::getNewToken() and scopes parameter.

[Danack]

Hi,

Please could you clarify for me what an implementation of AccessTokenEntityInterface should do with the scopes parameter in getNewToken() ? or any of the parameters actually.

The getNewToken method is called, and then immediately scopes are added to the token again, which lead to the scopes being double entered on my implementation.

oauth2-server/src/Grant/AbstractGrant.php

Lines 335 to 342 in bf7084a

	$accessToken = $this->accessTokenRepository->getNewToken($client, $scopes, $userIdentifier);
	$accessToken->setClient($client);
	$accessToken->setUserIdentifier($userIdentifier);
	$accessToken->setExpiryDateTime((new \DateTime())->add($accessTokenTTL));
	foreach ($scopes as $scope) {
	$accessToken->addScope($scope);
	}

cheers
Dan

[Sephster]

Hi @Danack - Apologies for the delayed response. This looks like a bug to me as you are correct in that we are likely double entering scopes. This shouldn't created duplicates against the access token though as these are indexed on the scope ID:

oauth2-server/src/Entities/Traits/TokenEntityTrait.php

Lines 42 to 45 in 9fc288c

	public function addScope(ScopeEntityInterface $scope)
	{
	$this->scopes[$scope->getIdentifier()] = $scope;
	}

The easiest fix would be to remove the duplicate code from the Abstract Grant but I will need to do a thorough check to make sure this won't break anything. Thanks for reporting this

[lordrhodos]

I hit the same issue as well and was wondering why the AbstractGrant adds the scopes again after they had been passed to the getNewToken method of the repository. I was not using indexed entries in the scopes collection (common doctrine ArrayCollection). Changed that for now, but would love to see a fix in the future.

[Sephster]

This issue was originally tackled in #553 but reverted as it introduced a breaking change. I think it should be reinstated for version 8.

[crtl]

I wanted to ask the same question.
Either AccessTokenEntityRepository:getNewToken or AbstractGrant should setup the token.
Why call a factory when I do everything myself?

If it is to execute additional logic, why dont you use an event system?