[#468] Defined OAuth restrictions for all applicable routes.

Improved missing "scopes" param handling.
Allowed "any of" / "all of" mode specification in OAuthScopesPlug.
Fixed auth UI / behavior when user selects no permissions at /oauth/authorize.

1 files changed, 3 insertions, 6 deletions

diff --git a/lib/pleroma/web/oauth.ex b/lib/pleroma/web/oauth.ex
index 8c78d1100..d2835a0ba 100644
--- a/lib/pleroma/web/oauth.ex
+++ b/lib/pleroma/web/oauth.ex
@@ -3,16 +3,13 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.OAuth do
-  def parse_scopes(scopes, default) when is_list(scopes) do
-    scopes = Enum.filter(scopes, &(&1 not in [nil, ""]))
-
-    if Enum.any?(scopes),
-      do: scopes,
-      else: default
+  def parse_scopes(scopes, _default) when is_list(scopes) do
+    Enum.filter(scopes, &(&1 not in [nil, ""]))
   end
 
   def parse_scopes(scopes, default) when is_binary(scopes) do
     scopes
+    |> String.trim()
     |> String.split(~r/[\s,]+/)
     |> parse_scopes(default)
   end