fix: default addAcceptedScopesHeader and addAuthorizedScopesHeader to true

lib/handlers/authenticate-handler.js

@@ -41,20 +41,14 @@ class AuthenticateHandler {
       throw new InvalidArgumentError('Invalid argument: model does not implement `getAccessToken()`');
     }
 
-    if (options.scope && undefined === options.addAcceptedScopesHeader) {
-      throw new InvalidArgumentError('Missing parameter: `addAcceptedScopesHeader`');
-    }
-
-    if (options.scope && undefined === options.addAuthorizedScopesHeader) {
-      throw new InvalidArgumentError('Missing parameter: `addAuthorizedScopesHeader`');
-    }
-
     if (options.scope && !options.model.verifyScope) {
       throw new InvalidArgumentError('Invalid argument: model does not implement `verifyScope()`');
     }
 
-    this.addAcceptedScopesHeader = options.addAcceptedScopesHeader;
-    this.addAuthorizedScopesHeader = options.addAuthorizedScopesHeader;
+    this.addAcceptedScopesHeader =
+      undefined === options.addAcceptedScopesHeader ? true : options.addAcceptedScopesHeader;
+    this.addAuthorizedScopesHeader =
+      undefined === options.addAuthorizedScopesHeader ? true : options.addAuthorizedScopesHeader;
     this.allowBearerTokensInQueryString = options.allowBearerTokensInQueryString;
     this.model = options.model;
     this.scope = Array.isArray(options.scope) ? options.scope : parseScope(options.scope);

test/integration/handlers/authenticate-handler_test.js

@@ -45,33 +45,26 @@ describe('AuthenticateHandler integration', function () {
       }
     });
 
-    it('should throw an error if `scope` was given and `addAcceptedScopesHeader()` is missing', function () {
-      try {
-        new AuthenticateHandler({
-          model: { getAccessToken: function () {} },
-          scope: ['foobar'],
-        });
+    it('should default `addAcceptedScopesHeader` to `true` if `scope` was given', function () {
+      const handler = new AuthenticateHandler({
+        addAuthorizedScopesHeader: false,
+        model: { getAccessToken: function () {}, verifyScope: function () {} },
+        scope: ['foobar'],
+      });
 
-        should.fail();
-      } catch (e) {
-        e.should.be.an.instanceOf(InvalidArgumentError);
-        e.message.should.equal('Missing parameter: `addAcceptedScopesHeader`');
-      }
+      handler.addAcceptedScopesHeader.should.be.true;
+      handler.addAuthorizedScopesHeader.should.be.false;
     });
 
-    it('should throw an error if `scope` was given and `addAuthorizedScopesHeader()` is missing', function () {
-      try {
-        new AuthenticateHandler({
-          addAcceptedScopesHeader: true,
-          model: { getAccessToken: function () {} },
-          scope: ['foobar'],
-        });
+    it('should default `addAuthorizedScopesHeader` to `true` if `scope` was given', function () {
+      const handler = new AuthenticateHandler({
+        addAcceptedScopesHeader: false,
+        model: { getAccessToken: function () {}, verifyScope: function () {} },
+        scope: ['foobar'],
+      });
 
-        should.fail();
-      } catch (e) {
-        e.should.be.an.instanceOf(InvalidArgumentError);
-        e.message.should.equal('Missing parameter: `addAuthorizedScopesHeader`');
-      }
+      handler.addAcceptedScopesHeader.should.be.false;
+      handler.addAuthorizedScopesHeader.should.be.true;
     });
 
     it('should throw an error if `scope` was given and the model does not implement `verifyScope()`', function () {

test/integration/server_test.js

@@ -165,6 +165,48 @@ describe('Server integration', function () {
 
       handler.should.be.an.instanceOf(Promise);
     });
+
+    it('should set the scopes headers by default if `scope` is set on the server', async function () {
+      const model = Model.from({
+        getAccessToken: function () {
+          return {
+            user: {},
+            accessTokenExpiresAt: new Date(new Date().getTime() + 10000),
+            scope: ['foo', 'bar'],
+          };
+        },
+        verifyScope: function () {
+          return true;
+        },
+        getClient: function () {
+          return {
+            id: 1234,
+            grants: ['authorization_code'],
+            redirectUris: ['http://example.com/cb'],
+          };
+        },
+        saveAuthorizationCode: function () {
+          return { authorizationCode: 123 };
+        },
+      });
+      const server = new Server({ model: model, scope: ['foo'] });
+      const request = new Request({
+        body: {
+          client_id: 1234,
+          response_type: 'code',
+        },
+        headers: { Authorization: 'Bearer foo' },
+        method: {},
+        query: { state: 'foobar' },
+      });
+      const response = new Response({ body: {}, headers: {} });
+
+      const code = await server.authorize(request, response);
+
+      code.authorizationCode.should.equal(123);
+      response.get('X-Accepted-OAuth-Scopes').should.equal('foo');
+      response.get('X-OAuth-Scopes').should.equal('foo bar');
+    });
   });
 
   describe('token()', function () {