-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add oauth scopes #162
Add oauth scopes #162
Conversation
All API requests to the server now fail as we need a Token with scope, we should change this to |
It might be nice to also change the documentation to use the OAUTH scopes instead of the permissions we signed in the backend. Can we only let people with baker permissions request the orders:manage scope or something like that? |
The permissions we require are Django permissions. It's different from OAuth scopes (although, yes, they are related). The conventions for naming them are different. For example, the
No, at least not in a default way. As you can see, the scopes secretly are just strings, they are not really registered in any form. An API can actually request scopes that don't even exist. The only place we could check that is by overriding the OAuth authorization view, which I think is out of scope (pun unintended) for this project. |
I also committed a small typo change (you forgot a comment somewhere) |
Closes #137