fix(op): add scope to access token scope

[isegura-eos-eng]

This attempts to solve Issue 660.

All the details are there. TLDR; Access Token response is not compliant with OAuth 2.0. We decided to always return the scope property in the Access Token response to comply with RFC 6749.

The implementation consists of getting the scope from the token request, which should be already containing only the scopes that are granted.

Definition of Ready

• I am happy with the code
• Short description of the feature/issue is added in the pr description
• PR is linked to the corresponding user story
• Acceptance criteria are met
• All open todos and follow ups are defined in a new ticket and justified
• Deviations from the acceptance criteria and design are agreed with the PO and documented.
• No debug or dead code
• My code has no repetitions
• Critical parts are tested automatically
• Where possible E2E tests are implemented
• Documentation/examples are up-to-date
• All non-functional requirements are met
• Functionality of the acceptance criteria is checked manually on the dev system.

Further improvements

In my opinion, a more elegant solution would be to strictly adhere with the protocol and only return the scope if has been modified from the request. If compliant, clients could assume all scopes are given by the absence of the scope property in the token response, this would avoid parsing the response scope. However, this change would probably cause a breaking change in the exported package, so this solution is good for now.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.98%. Comparing base (0992c5f) to head (ee6e4ac).
Report is 105 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #664      +/-   ##
==========================================
+ Coverage   60.06%   60.98%   +0.92%     
==========================================
  Files          80       81       +1     
  Lines        6998     7462     +464     
==========================================
+ Hits         4203     4551     +348     
- Misses       2498     2601     +103     
- Partials      297      310      +13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

🎉 This PR is included in version 3.33.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[muhlemmer]

hey @isegura-eos-eng thanks for the contribution.

If you'd like to have a small gift in return, please send us a mail to hi@zitadel.com. We will send you a form with questions about your address and shirt size.

[isegura-eos-eng]

Thanks @muhlemmer ! Will do!