Part of story #14570 Authorization grant confirmation page How to test: - Create a new OAuth2 app in a project administration. - Access the authorization endpoint. '<client_id> and <redirect_uri> must be replaced. <redirect_uri> should be URL-encoded. https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&state=xyz&response_type=code&scope=demo&redirect_uri=<redirect_uri> - Note that only the "demo" scope is requested in the URI above. - Authorize the app. - Access the authorization endpoint a second time with the same URI. You should be redirected immediately, without the form showing up. The scopes are the same and you already granted them. - Access the authorization endpoint a third time, but change the scope parameter to scope=demo%20read:project. You should see the form with both scopes and should NOT receive an authorization code right away. Change-Id: I4e8e2e4a2e791bd59c02cf574e2f39ca1e4c5811

+706 −179

Author

Joris MASSON (jmasson) 2020-03-12 10:42

Committer

Joris MASSON (jmasson) 2020-03-12 17:57

Hash 4e8bc4f5aaf626afcc5a5f92dc89c90da6070310

Parent 9089ca5893248f81fd7b28536038a5f6eb3d10b1

Reference git #tuleap/stable/4e8bc4f5aaf626afcc5a5f92dc89c90da6070310