Adds possibility to have allowed scopes restriction per client #201
Description
Hi,
Currently, if an access token request is made by a client, without any provided scopes, the default scopes (declared in the supported_scopes option in the bundle configuration) are added to the token.
As I read the OAuth2.php code, I understand that if no scope is given, the "default scopes" are assigned to the token. But I think that "default scopes" and "supported_scopes" are two different things.
If I declare an "ADMIN" scope in the supported_scope option, any clients which doesn't ask for a specific scope will be "ADMIN granted".
I understand that scope is needed in auth-code grant flow, because the user has to allow the client to access his info with the specified scopes, but for client_credentials grant flow (which IMHO could be used by any clients to be able to retrieve some useful information from the API), no scope is required in the access token request.
Maybe it's my fault and I don't know how to use it, but I thinks it's could be very useful to declare the allowed scopes during the client creation (like the allowed grant types), to be able to secure some controllers from third party clients.
It could be done by checking the client id, but it seams better to deal with scopes (aka Symfony roles in this case) here.
What is your opinion about that ? Is there a thing I missed or didn't understand ?