feat: Expose Granted Scopes while fetching credentials

lib/signet/oauth_2/client.rb

@@ -78,6 +78,8 @@ class Client
       #   - <code>:extension_parameters</code> -
       #     When using an extension grant type, this the set of parameters used
       #     by that extension.
+      #   - <code>:granted_scopes</code> -
+      #     All scopes granted by authorization server.
       #
       # @example
       #   client = Signet::OAuth2::Client.new(
@@ -109,6 +111,7 @@ def initialize options = {}
         @state                = nil
         @username             = nil
         @access_type          = nil
+        @granted_scopes       = nil
         update! options
       end
 
@@ -167,6 +170,8 @@ def initialize options = {}
       #   - <code>:extension_parameters</code> -
       #     When using an extension grant type, this is the set of parameters used
       #     by that extension.
+      #   - <code>:granted_scopes</code> -
+      #     All scopes granted by authorization server.
       #
       # @example
       #   client.update!(
@@ -253,7 +258,7 @@ def update_token! options = {}
         self.access_token = options[:access_token] if options.key? :access_token
         self.refresh_token = options[:refresh_token] if options.key? :refresh_token
         self.id_token = options[:id_token] if options.key? :id_token
-
+        self.granted_scopes = options[:granted_scopes] if options.key? :granted_scopes
         self
       end
 
@@ -823,6 +828,25 @@ def expires_at= new_expires_at
         @expires_at = normalize_timestamp new_expires_at
       end
 
+      ##
+      # Returns the scopes granted by the authorization server.
+      #
+      # @return [Array] The scope of access returned by the authorization server.
+      def granted_scopes
+        @granted_scopes
+      end
+
+      ##
+      # Sets the scopes returned by authorization server for this client.
+      #
+      # @param [Array] new_granted_scopes
+      #   The scope of access the client is requesting.  This may be
+      #   expressed as either an Array of String objects or as a
+      #   space-delimited String.
+      def granted_scopes= new_granted_scopes
+        @granted_scopes = new_granted_scopes&.split
+      end
+
       ##
       # Returns true if the access token has expired.
       # Returns false if the token has not expired or has an nil @expires_at.
@@ -857,6 +881,7 @@ def clear_credentials!
         @code = nil
         @issued_at = nil
         @expires_at = nil
+        @granted_scopes = nil
       end
 
       ##
@@ -936,7 +961,8 @@ def to_json *_args
           "refresh_token"        => refresh_token,
           "access_token"         => access_token,
           "id_token"             => id_token,
-          "extension_parameters" => extension_parameters
+          "extension_parameters" => extension_parameters,
+          "granted_scopes"       => granted_scopes
         )
       end
 
@@ -1020,19 +1046,22 @@ def fetch_access_token options = {}
           content_type = response.header[:content_type]
         end
 
-        return ::Signet::OAuth2.parse_credentials body, content_type if status == 200
-
         message = "  Server message:\n#{response.body.to_s.strip}" unless body.to_s.strip.empty?
+
         if [400, 401, 403].include? status
           message = "Authorization failed.#{message}"
           raise ::Signet::AuthorizationError.new message, response: response
         elsif status.to_s[0] == "5"
           message = "Remote server error.#{message}"
           raise ::Signet::RemoteServerError, message
-        else
+        elsif status != 200
           message = "Unexpected status code: #{response.status}.#{message}"
           raise ::Signet::UnexpectedStatusError, message
         end
+        # status == 200
+        parsed_response = ::Signet::OAuth2.parse_credentials body, content_type
+        parsed_response["granted_scopes"] = parsed_response.delete("scope") if parsed_response
+        parsed_response
       end
 
       def fetch_access_token! options = {}

spec/signet/oauth_2/client_spec.rb

@@ -63,6 +63,11 @@ def build_form_encoded_response payload
     expect(@client.scope).to eq ["legit", "alsolegit"]
   end
 
+  it "should allow to set granted scopes" do
+    @client.granted_scopes = "granted_scopes1 granted_scopes2"
+    expect(@client.granted_scopes).to eq ["granted_scopes1", "granted_scopes2"]
+  end
+
   it "should raise an error if a bogus redirect URI is provided" do
     expect(lambda do
       @client = Signet::OAuth2::Client.new redirect_uri: :bogus
@@ -375,13 +380,15 @@ def build_form_encoded_response payload
       :access_token  => "12345",
       refresh_token: "54321",
       :expires_in    => 3600,
-      :issued_at     => issued_at
+      :issued_at     => issued_at,
+      :granted_scopes => "scope1"
     )
     expect(@client.access_token).to eq "12345"
     expect(@client.refresh_token).to eq "54321"
     expect(@client.expires_in).to eq 3600
     expect(@client.issued_at).to eq issued_at
     expect(@client).to_not be_expired
+    expect(@client.granted_scopes).to eq ["scope1"]
   end
 
   it "should handle expires as equivalent to expires_in" do