denniseilander / laravel-passport-scopes-restriction
Restrict scopes for different Laravel Passport clients.
Fund package maintenance!
denniseilander
Installs: 11 967
Dependents: 0
Suggesters: 0
Security: 0
Stars: 13
Watchers: 0
Forks: 1
Open Issues: 1
Requires
- php: ^8.2
- ext-json: *
- illuminate/contracts: ^11.0
- laravel/passport: ^12.0
- spatie/laravel-package-tools: ^1.16
Requires (Dev)
- mockery/mockery: ^1.6
- nunomaduro/collision: ^8.1.1
- nunomaduro/larastan: ^2.9
- orchestra/testbench: ^9.0.0
- phpunit/phpunit: ^10.5
README
This package allows you to limit the scopes a client can request.
By default, Laravel Passport doesn't support restricting scopes per client.
Every client can access all available scopes in your project. This package solves that problem.
When to use this package
When your api project contains multiple third party oauth_clients, and you can't control which scopes they request, you may want to limit the scopes a client can request.
Installation
You can install the package via composer:
composer require denniseilander/laravel-passport-scopes-restriction
You can publish and run the migrations with:
php artisan vendor:publish --provider="Denniseilander\PassportScopeRestriction\PassportClientServiceProvider" --tag="passport-scopes-restriction-migrations" php artisan migrate
Optionally you can publish the config file with:
php artisan vendor:publish --provider="Denniseilander\PassportScopeRestriction\PassportClientServiceProvider" --tag="passport-scopes-restriction-config"
Usage
After running the migration, you may add specific scopes to each of your oauth_clients allowed_scopes
column.
You can assign specific scopes the same way as they are assigned to the oauth_access_tokens scopes
column:
// one scope ["read-users"] // multiple scopes ["read-users","edit-users"]
Every time an access token is requested for a specific client, the allowed_scopes
will be added to the scopes
column of that token.
You may also add an allowed scope within your POST: passport/oauth
request, to specific assign a scope to that access_token:
// The same scopes are defined in the allowed_scopes column of the oauth_clients table Passport::tokensCan([ 'scope-1' => 'Scope 1', 'scope-2' => 'Scope 2', 'scope-3' => 'Scope 3', ]); POST /oauth/token ?scope=scope-1
This will only assign scope-1
to the access_token.
You may leave the scope field empty, which will assign all allowed scopes to the access_token
Syncing existing scopes with new allowed scopes
Sometimes you have your oauth_access_tokens
table filled with existing tokens and want to update the scopes
because you've changed the allowed_scopes
value of a specific client.
This package makes it easy to synchronize exiting token scopes with your allowed scopes by running the following command:
php artisan passport:scopes-sync
If you've added new scopes to the allowed_scopes
column on the clients table,
but you want to keep the existing scopes on your tokens, you may add the --keep-existing-scopes
flag to the sync command:
php artisan passport:scopes-sync --keep-existing-scopes
Testing
composer test
Changelog
Please see CHANGELOG for more information on what has changed recently.
Contributing
Please see CONTRIBUTING for details.
Security Vulnerabilities
Please review our security policy on how to report security vulnerabilities.
Credits
License
The MIT License (MIT). Please see License File for more information.