[PATCH 2/4] auth: db-oauth2: Fix scope check to require all configured scopes

Switch token-in-scope check to AND semantics: all configured scopes
must be present in the token. Behaviour now matches the JWT path.

Gbp-Pq: Name 0002-auth-db-oauth2-Fix-scope-check-to-require-all-config.patch

diff --git a/src/auth/db-oauth2.c b/src/auth/db-oauth2.c
index ed1bf013c35a268d5f14337be70de58db8ccd045..159344f9ad6b0518863c077d1f7d80494ec1825b 100644 (file)
--- a/src/auth/db-oauth2.c
+++ b/src/auth/db-oauth2.c
@@ -556,22 +556,25 @@ db_oauth2_token_in_scope(struct db_oauth2_request *req,
        if (array_is_empty(&req->db->set->scope))
                return TRUE;
 
-       bool found = FALSE;
        const char *value = auth_fields_find(req->fields, "scope");
        bool has_scope = value != NULL;
        if (!has_scope)
                value = auth_fields_find(req->fields, "aud");
        e_debug(authdb_event(req->auth_request),
-               "Token scope(s): %s",
-               value);
-       if (value != NULL) {
-               const char *wanted_scope;
+               "Token scope(s): %s", value);
+
+       bool found = FALSE;
+       if (value != NULL && *value != '\0') {
                const char *const *entries = has_scope ?
                        t_strsplit_spaces(value, " ") :
                        t_strsplit_tabescaped(value);
-               array_foreach_elem(&req->db->set->scope, wanted_scope) {
-                       if ((found = str_array_find(entries, wanted_scope)))
+               const char *wanted;
+               found = TRUE;
+               array_foreach_elem(&req->db->set->scope, wanted) {
+                       if (!str_array_find(entries, wanted)) {
+                               found = FALSE;
                                break;
+                       }
                }
        }
        if (!found) {