Laravel Passport client scopes restriction

This package allows you to limit the scopes a client can request.
By default, Laravel Passport doesn't support restricting scopes per client. Every client can access all available scopes in your project. This package solves that problem.

When to use this package

When your api project contains multiple third party oauth_clients, and you can't control which scopes they request, you may want to limit the scopes a client can request.

Installation

You can install the package via composer:

composer require denniseilander/laravel-passport-scopes-restriction

You can publish and run the migrations with:

php artisan vendor:publish --provider="Denniseilander\PassportScopeRestriction\PassportClientServiceProvider" --tag="passport-scopes-restriction-migrations"
php artisan migrate

Optionally you can publish the config file with:

php artisan vendor:publish --provider="Denniseilander\PassportScopeRestriction\PassportClientServiceProvider" --tag="passport-scopes-restriction-config"

Usage

After running the migration, you may add specific scopes to each of your oauth_clients allowed_scopes column. You can assign specific scopes the same way as they are assigned to the oauth_access_tokens scopes column:

// one scope
["read-users"]

// multiple scopes
["read-users","edit-users"]

Every time an access token is requested for a specific client, the allowed_scopes will be added to the scopes column of that token.

You may also add an allowed scope within your POST: passport/oauth request, to specific assign a scope to that access_token:

// The same scopes are defined in the allowed_scopes column of the oauth_clients table
Passport::tokensCan([
    'scope-1' => 'Scope 1',
    'scope-2' => 'Scope 2',
    'scope-3' => 'Scope 3',
]);

POST /oauth/token ?scope=scope-1

This will only assign scope-1 to the access_token.

You may leave the scope field empty, which will assign all allowed scopes to the access_token

Syncing existing scopes with new allowed scopes

Sometimes you have your oauth_access_tokens table filled with existing tokens and want to update the scopes because you've changed the allowed_scopes value of a specific client.

This package makes it easy to synchronize exiting token scopes with your allowed scopes by running the following command:

php artisan passport:scopes-sync

If you've added new scopes to the allowed_scopes column on the clients table, but you want to keep the existing scopes on your tokens, you may add the --keep-existing-scopes flag to the sync command:

php artisan passport:scopes-sync --keep-existing-scopes

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Dennis Eilander
• All Contributors

License

The MIT License (MIT). Please see License File for more information.