{"action":"opened","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/398","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/398/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/398/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/398/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/398","id":116103373,"number":398,"title":"scopes and internal app permissions","user":{"login":"leemason","id":1238646,"avatar_url":"https://avatars.githubusercontent.com/u/1238646?v=3","gravatar_id":"","url":"https://api.github.com/users/leemason","html_url":"https://github.com/leemason","followers_url":"https://api.github.com/users/leemason/followers","following_url":"https://api.github.com/users/leemason/following{/other_user}","gists_url":"https://api.github.com/users/leemason/gists{/gist_id}","starred_url":"https://api.github.com/users/leemason/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leemason/subscriptions","organizations_url":"https://api.github.com/users/leemason/orgs","repos_url":"https://api.github.com/users/leemason/repos","events_url":"https://api.github.com/users/leemason/events{/privacy}","received_events_url":"https://api.github.com/users/leemason/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-10T13:10:47Z","updated_at":"2015-11-10T13:10:47Z","closed_at":null,"body":"im working on an app which has:\r\n\r\nusers\r\nroles\r\npermissions\r\n\r\nusers can have many roles\r\nroles and/or users can have many permissions (role permissions propigate down to the user)\r\n\r\nnow as you would expect obviously ive in advance kept my \"permissions\" compatible with scopes for consistency.\r\n\r\nboth permissions and scopes have the same identifiers which works great.\r\n\r\nive come across a situation that i need clarifying:\r\n\r\nsay i have:\r\n\r\nUser1\r\nHas Editor Role\r\nHas Permissions user:read, user:update\r\n\r\nUser2\r\nHas Admin Role\r\nHas Permissions user:read, user:update, user:delete\r\n\r\n\r\ni then have api endpoints:\r\n\r\nget /user/{id} - read user\r\nput /user/{id} - updates user\r\ndelete /user{id} - deletes user\r\n\r\nWhat should happen if i have an app that requests the ```user:delete``` scope, but gets authorized by a user without that permission?\r\n\r\n\r\n1. should an access token be granted, with the actual permissions granted as part of the response so the app can account for the lack of this scope (dont think this is possible right now, it throws an exception).\r\n\r\n2. should i check for this on the authorize page that gets displayed to the user and not allow them to authorize the app as they cant forfill the requirements?\r\n\r\n3. should i catch the exception is my handler and send back to the redirect uri with an error stating the issue? \r\n\r\n"}}