Alexander Varwijk commented on merge request !172 at project / simple_oauth

Alexander Varwijk
2025-08-18T07:11:48Z

I think we should maybe as a string $drupalScope argument here. Currently our scope system only works in the primary Drupal scope of the Access Policy system. This means that OAuth can not access resources from e.g. the group module.

By making the OAuth2 Scope aware of Drupal permission scopes we have a path forward to make the OAuth module work with those things too.

The only thing I'm unsure about is what that would mean for the Oauth2AccessPolicy::applies method, I think perhaps it should be always true (i.e. we should also revoke permissions within e.g. the "group" Drupal scope if no OAuth scopes grant permissions there).