mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 11:24:57 -05:00

Files

T

Gustavo Valverde 39d132e834 fix(oauth-provider): challenge with the scopes a token is missing

The insufficient-scope challenge keyed on the FORBIDDEN status, so any
permission denial became a scope challenge advertising the configured
scopes, which the token already held. Clients following the step-up flow
re-authorized for scopes they had and retried into the same failure.

Key the challenge on an explicit `insufficient_scope` marker carrying the
scopes the token lacks, matching how DPoP challenges are already detected.
Scope verification reports every missing scope at once rather than the first,
and handlers raise the same challenge through `insufficientScopeError` for
scopes only they know about. Everything else, including a plain FORBIDDEN,
propagates untouched.

2026-07-28 19:16:31 -04:00