Paul Schneider
3744017127
EnsureDefaultApplicationScopes was inserting every entry of Constants.ApiResourcesScopes (admin, moderation, performer, client, blogs) into the IdentityResources table, as Profile-derived rows. That made them visible to /connect/discovery's scopes_supported under the identity section, but no API resource would ever issue a token bearing them — IdentityServer then rejected clients that requested any of these scopes with 'invalid_scope' at the token endpoint. The most visible casualty was PostIt, a public PKCE client whose postit-settings.json asks for scope=openid profile offline_access blogs. 'blogs' is the scope that gates the Yavsc.Blogs deployment (blogs.pschneider.fr), so the login flow died at the token step. Fix: - Constants.ApiResourcesScopes entries are now seeded as ApiScope rows (with Name + DisplayName). IdentityResources stays limited to the actual OpenID Connect profile (openid, profile). - EnsureDefaultConfiguration gains an idempotent AlignPostItClientScopes pass that adds any missing scope from PostItScopes to the existing 'postit' client's AllowedScopes. Nothing is removed — manual revocation stays manual. Existing live databases pick up both changes on next startup: missing ApiScope rows are inserted, and the postit client's ClientScope rows catch up. |
||
|---|---|---|
| .. | ||
| cli | ||
| PostIt | ||
| PostIt.Tests | ||
| templateWeb | ||
| Yavsc.Abstract | ||
| Yavsc.Api | ||
| Yavsc.Blogs | ||
| Yavsc.Org | ||
| Yavsc.Org.Tests | ||
| Yavsc.Server | ||
| Yavsc.Web | ||