Include Requested Scopes in Webhook Requests (#3891)

ory · Jan 2, 2025 · c3ff306 · c3ff306
1 parent 6673c87
commit c3ff306
Show file tree

Hide file tree

Showing 7 changed files with 33 additions and 0 deletions.
diff --git a/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json b/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -35,6 +35,11 @@
   },
   "request": {
     "client_id": "app-client",
+    "requested_scopes": [
+      "hydra.*",
+      "offline",
+      "openid"
+    ],
     "granted_scopes": [
       "offline",
       "openid",

diff --git a/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json b/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -35,6 +35,11 @@
   },
   "request": {
     "client_id": "app-client",
+    "requested_scopes": [
+      "hydra.*",
+      "offline",
+      "openid"
+    ],
     "granted_scopes": [
       "offline",
       "openid",

diff --git a/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json b/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -35,6 +35,11 @@
   },
   "request": {
     "client_id": "app-client",
+    "requested_scopes": [
+      "hydra.*",
+      "offline",
+      "openid"
+    ],
     "granted_scopes": [
       "offline",
       "openid",

diff --git a/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json b/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -35,6 +35,11 @@
   },
   "request": {
     "client_id": "app-client",
+    "requested_scopes": [
+      "hydra.*",
+      "offline",
+      "openid"
+    ],
     "granted_scopes": [
       "offline",
       "openid",

diff --git a/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json b/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -35,6 +35,11 @@
   },
   "request": {
     "client_id": "app-client",
+    "requested_scopes": [
+      "hydra.*",
+      "offline",
+      "openid"
+    ],
     "granted_scopes": [
       "offline",
       "openid",

diff --git a/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json b/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -35,6 +35,11 @@
   },
   "request": {
     "client_id": "app-client",
+    "requested_scopes": [
+      "hydra.*",
+      "offline",
+      "openid"
+    ],
     "granted_scopes": [
       "offline",
       "openid",

diff --git a/oauth2/token_hook.go b/oauth2/token_hook.go
@@ -31,6 +31,8 @@ type AccessRequestHook func(ctx context.Context, requester fosite.AccessRequeste
 type Request struct {
 	// ClientID is the identifier of the OAuth 2.0 client.
 	ClientID string `json:"client_id"`
+	// RequestedScopes is the list of scopes requested to the OAuth 2.0 client.
+	RequestedScopes []string `json:"requested_scopes"`
 	// GrantedScopes is the list of scopes granted to the OAuth 2.0 client.
 	GrantedScopes []string `json:"granted_scopes"`
 	// GrantedAudience is the list of audiences granted to the OAuth 2.0 client.
@@ -170,6 +172,7 @@ func TokenHook(reg interface {
 
 		request := Request{
 			ClientID:        requester.GetClient().GetID(),
+			RequestedScopes: requester.GetRequestedScopes(),
 			GrantedScopes:   requester.GetGrantedScopes(),
 			GrantedAudience: requester.GetGrantedAudience(),
 			GrantTypes:      requester.GetGrantTypes(),