Scope from jwt should be correctly propagated to the user principal

Author: pendula95

vertx-auth-oauth2/src/main/java/io/vertx/ext/auth/oauth2/impl/OAuth2AuthProviderImpl.java

@@ -586,6 +586,11 @@ private User createUser(JsonObject json, boolean skipMissingKeyNotify) {
           user.attributes()
             .put("rootClaim", "accessToken");
 
+          // scope can be present inside JWT and this should be copied to user principal as it is expected from AuthHandler
+          if (token.containsKey("scope")) {
+            user.principal().put("scope", token.getString("scope"));
+          }
+
         } catch (NoSuchKeyIdException e) {
           if (!skipMissingKeyNotify) {
             // tag the user attributes that we don't have the required key too

vertx-auth-oauth2/src/test/java/io/vertx/ext/auth/test/oauth2/Oauth2TokenScopeTest.java

@@ -124,7 +124,13 @@ public void tokenIsValid(TestContext should) {
       } else {
         User token = res.result();
         should.assertFalse(token.expired());
-        test.complete();
+        ScopeAuthorization.create(" ").getAuthorizations(token)
+          .onComplete(call -> {
+            should.assertTrue(call.succeeded());
+            should.assertTrue(PermissionBasedAuthorization.create("scopeA").match(token));
+            should.assertTrue(PermissionBasedAuthorization.create("scopeB").match(token));
+            test.complete();
+          });
       }
     });
   }
@@ -191,7 +197,6 @@ public void tokenIsNotValid(TestContext should) {
         should.assertTrue(call.succeeded());
         // the scopes are missing
         should.assertFalse(PermissionBasedAuthorization.create("scopeX").match(res.result()));
-        should.assertFalse(PermissionBasedAuthorization.create("scopeB").match(res.result()));
         test.complete();
       });
     });