Detect auth scope changes across app updates

src/access.ts

@@ -21,9 +21,11 @@ export class Access {
   scopeModeMap: ScopeModeMap;
   rootPaths: string[];
   storageType: string;
+  rs?: { _checkScopeChange?: () => void; };
 
-  constructor() {
-    this.reset();
+  constructor(rs?: { _checkScopeChange?: () => void; }) {
+    this.rs = rs;
+    this.reset(false);
   }
 
   /**
@@ -74,6 +76,7 @@ export class Access {
     }
     this._adjustRootPaths(scope);
     this.scopeModeMap[scope] = mode;
+    this._notifyChange();
   }
 
   /**
@@ -99,11 +102,13 @@ export class Access {
     for (const name in this.scopeModeMap) {
       savedMap[name] = this.scopeModeMap[name];
     }
-    this.reset();
+    this.reset(false);
     delete savedMap[scope];
     for (const name in savedMap) {
-      this.claim(name as AccessScope, savedMap[name]);
+      this._adjustRootPaths(name as AccessScope);
+      this.scopeModeMap[name] = savedMap[name];
     }
+    this._notifyChange();
   }
 
   /**
@@ -141,9 +146,12 @@ export class Access {
    *
    * @ignore
    */
-  reset(): void {
+  reset(notifyChange = true): void {
     this.rootPaths = [];
     this.scopeModeMap = {};
+    if (notifyChange) {
+      this._notifyChange();
+    }
   }
 
   /**
@@ -193,6 +201,12 @@ export class Access {
     this.storageType = type;
   }
 
+  private _notifyChange (): void {
+    if (this.rs && typeof this.rs._checkScopeChange === 'function') {
+      this.rs._checkScopeChange();
+    }
+  }
+
   static _rs_init(): void {
     return;
   }

src/authorize.ts

@@ -10,6 +10,7 @@ interface AuthResult {
   access_token?: string;
   refresh_token?: string;
   code?: string;
+  scope?: string;
   rsDiscovery?: object;
   error?: string;
   remotestorage?: string;
@@ -129,6 +130,8 @@ export class Authorize {
       throw new Error("Cannot authorize due to undefined or empty scope; did you forget to access.claim()?");
     }
 
+    remoteStorage._rememberPendingScope(options.scope);
+
     // TODO add a test for this
     // keep track of the discovery data during redirect if we can't save it in localStorage
     if (!localStorageAvailable() && remoteStorage.backend === 'remotestorage') {
@@ -153,6 +156,7 @@ export class Authorize {
         .openWindow(url, options.redirectUri, 'location=yes,clearsessioncache=yes,clearcache=yes')
         .then((authResult: AuthResult) => {
           remoteStorage.remote.configure({ token: authResult.access_token });
+          remoteStorage._completeAuthorization(authResult.scope || options.scope);
         });
       return;
     }
@@ -273,6 +277,7 @@ export class Authorize {
       }
 
       if (params.error) {
+        remoteStorage._forgetPendingScope();
         if (params.error === 'access_denied') {
           throw new UnauthorizedError('Authorization failed: access denied', { code: 'access_denied' });
         } else {
@@ -288,6 +293,7 @@ export class Authorize {
 
       if (params.access_token) {
         remoteStorage.remote.configure({ token: params.access_token });
+        remoteStorage._completeAuthorization(params.scope);
         authParamsUsed = true;
       }
 
@@ -350,12 +356,14 @@ export class Authorize {
           };
           if (settings.token) {
             remoteStorage.remote.configure(settings);
+            remoteStorage._completeAuthorization(xhr?.response?.scope);
           } else {
             remoteStorage._emit('error', new Error(`no access_token in "successful" response: ${xhr.response}`));
           }
           sessionStorage.removeItem('remotestorage:codeVerifier');
           break;
         default:
+          remoteStorage._forgetPendingScope();
           remoteStorage._emit('error', new Error(`${xhr.statusText}: ${xhr.response}`));
       }
     }