Fixed DEFAULT_SCOPES to be a list

Author: Psykopear

oauth2_provider/oauth2_validators.py

@@ -278,7 +278,7 @@ def validate_scopes(self, client_id, scopes, client, request, *args, **kwargs):
         return set(scopes).issubset(set(oauth2_settings._SCOPES))
 
     def get_default_scopes(self, client_id, request, *args, **kwargs):
-        return oauth2_settings._DEFAULT_SCOPES or oauth2_settings._SCOPES
+        return oauth2_settings._DEFAULT_SCOPES
 
     def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs):
         return request.client.redirect_uri_allowed(redirect_uri)

oauth2_provider/settings.py

@@ -20,6 +20,7 @@
 import six
 
 from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
 try:
     # Available in Python 2.7+
     import importlib
@@ -36,7 +37,7 @@
     'OAUTH2_VALIDATOR_CLASS': 'oauth2_provider.oauth2_validators.OAuth2Validator',
     'OAUTH2_BACKEND_CLASS': 'oauth2_provider.oauth2_backends.OAuthLibCore',
     'SCOPES': {"read": "Reading scope", "write": "Writing scope"},
-    'DEFAULT_SCOPES': {},
+    'DEFAULT_SCOPES': ['__all__'],
     'READ_SCOPE': 'read',
     'WRITE_SCOPE': 'write',
     'AUTHORIZATION_CODE_EXPIRE_SECONDS': 60,
@@ -131,7 +132,17 @@ def __getattr__(self, attr):
         if attr == '_SCOPES':
             val = list(six.iterkeys(self.SCOPES))
         if attr == '_DEFAULT_SCOPES':
-            val = list(six.iterkeys(self.DEFAULT_SCOPES))
+            if '__all__' in self.DEFAULT_SCOPES:
+                # If DEFAULT_SCOPES is set to ['__all__'] the whole set of scopes is returned
+                val = list(self._SCOPES)
+            else:
+                # Otherwise we return a subset (that can be void) of SCOPES
+                val = []
+                for scope in self.DEFAULT_SCOPES:
+                    if scope in self._SCOPES:
+                        val.append(scope)
+                    else:
+                        raise ImproperlyConfigured("Defined DEFAULT_SCOPES not present in SCOPES")
 
         self.validate_setting(attr, val)