connect
connect copied to clipboard
authorizedScope, allow for no role scopes
not allowing for this case can cause a crash
@ikb42 can you describe what's happening in a little more detail? I'm not sure I understand "no role scopes". We're handling these "unassigned" scopes in Scope.determine()
method:
https://github.com/anvilresearch/connect/blob/master/models/Scope.js#L46-L85
In the case that the subject client
has been assigned a role
but the role
has no permitted scopes
.
If this subject and a scope
is then passed to Scope.determine
, then subject.authorizedScope
will return [ undefined ]
which will then crash in Scope.determine
on line found = found || (result.indexOf(scope.name) !== -1)
.