As a Developer, I would like an API abstraction for the scope checking requirements of individual resources

• Type: Story
• Status: Closed
• Priority: Minor
• Resolution: Completed
• Affects Version/s: Master
• Fix Version/s: 7.4.13 DXP U53, Master
• Component/s: Application Security > OAuth2
• Labels:
  • 7.4.13-u53
  • beyond_7.4
  • beyond_7.4-must
  • fc_22_10
  • fc_22_11
• Sprint: AppSec Iteration 98, AppSec Iteration 99, AppSec Iteration 100, AppSec Iteration 101

Motivation

We wrap the current logic of scope checking behind an SPI to make it possible to use that by the GraphQL logic.

Acceptance Criteria

p.s. The following ACs should be met before and after the implementation, because we are simply refactoring existing code.

1. AC-1
   • Given there is an application configured to OAuth 2 with well defined scopes for a JAX-RS application
   • When a valid access_token has been received on a request by the said JAX-RS application through a proper request
   • Then the request is authorized (subject to permission checking)
2. AC-2
   • Given there is an application configured to OAuth 2 with well defined scopes for a JAX-RS application
   • When an invalid access_token is used in the OAuth 2.0 header for receiving data from the application
   • Then the response must be a 401 Unathorized response