Is implementation of `verifyScope` required?

[shrihari-prakash]

I understand the point of validateScope function, however, the library also has a verifyScope definition in model which never get's called at any point. I also tried searching for this function in the repository and couldn;t find any place where it is called but there are references to it. What's the deal with this function? Can I delete verifyScope implementations from my model?

[jankapunkt]

@shrihari-prakash which version of the package do you refer to and in which file is this function call located?

[shrihari-prakash]

Hello @jankapunkt ,

I am on version 4.3.0.

This is the function I am talking about: https://node-oauthoauth2-server.readthedocs.io/en/latest/model/spec.html#verifyscope-accesstoken-scope-callback

The model specification strictly wants this function, but when I implement it with a simple console, I never see it called. (See sample here: https://github.com/shrihari-prakash/liquid/blob/352f6f96cc518452489aabd11d9587be0dca3cb3/src/model/oauth.ts#L329)

[jankapunkt]

This seems to be an outdated documentation. However, let me check the code whether this might still be located somewhere.

[shrihari-prakash]

These are the search results when I tried to see where this is called: https://github.com/search?q=repo%3Anode-oauth%2Fnode-oauth2-server%20verifyScope&type=code

Not sure if something doesn't appear in git search.

[shrihari-prakash]

Oh there were matches I did not expand :). In any case, verifyScope is never called when calling authenticate

[jankapunkt]

Okay I rechecked and they were named differently because they implement different things:

verifyScope - In AuthenticateHandler - Invoked during request authentication to check if the provided access token was authorized the requested scopes.

validateScope - In AuthorizeHandler - Invoked to check if the requested scope is valid for a particular client/user combination.

Note that verifyScope is never called when you provide your own authenticateHandler for the server.authorize method: https://node-oauthoauth2-server.readthedocs.io/en/latest/api/oauth2-server.html#authorize-request-response-options-callback

[shrihari-prakash]

Aah ok understood! Perhaps it is a good idea to make verifyScope optional in types as TypeScript throws an error if you do not implement it even though it is optional. :)

[jankapunkt]

Hm this is a bit problematic, since it's only optional if you provide your own authenticateHandler but by default it's could be required when scope is passed. I'm not sure if this kind of logic can be covered by TypeScript?

[jankapunkt]

In any case, would you mind to open a PR for the types, targeting development?

[shrihari-prakash]

Let me check the types file and see if such a logic can be incorporated.

[shrihari-prakash]

@jankapunkt you are right. It's pretty hard to achieve this conditional thing. However, one realistic option is we make the verifyScope optional and throw an error if we do not find it when custom auth handler is passed. What do you think?

[shrihari-prakash]

Hm this is a bit problematic, since it's only optional if you provide your own authenticateHandler but by default it's could be required when scope is passed. I'm not sure if this kind of logic can be covered by TypeScript?

@jankapunkt are you saying even if you do not provide your own authenticateHandler verifyScope might only be required under certain other conditions?

[jankapunkt]

@shrihari-prakash this logic is already implemented, see https://github.com/node-oauth/node-oauth2-server/blob/development/lib/handlers/authenticate-handler.js#L40

What I'm referring to is to project this logic into the types system:

• verifyScope is optional if a custom authenticateHandler is passed as options to authorize
• it's also optional if the authentication request does not contain a scope (see line above)
• otherwise it's required

[shrihari-prakash]

Nice.. Good that the error logic is already there. Then I do not see a problem with making the verifyScope function optional in types. Can I send a PR?