Set missing Shield.settings.bearer_login_scopes_allowed option

GrottoPress · Jul 11, 2024 · 3fdbea8 · 3fdbea8
1 parent 905281b
commit 3fdbea8
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/config/shield.cr b/config/shield.cr
@@ -1,4 +1,7 @@
 Shield.configure do |settings|
+  settings.bearer_login_scopes_allowed =
+    ENV["BEARER_LOGIN_SCOPES_ALLOWED"]?.try(&.split) || [] of String
+
   settings.bearer_login_expiry = ENV["BEARER_LOGIN_EXPIRY"]?.try do |expiry|
     Time::Span.new(seconds: expiry.to_i)
   end

diff --git a/sample.env.yml b/sample.env.yml
@@ -66,6 +66,9 @@ password:
 
 skip_log_regex: code|password|secret|token
 
+bearer_login:
+  scopes_allowed: api.current_user.show api.current_user.update
+
 jobs:
   batch_size: '-1'
   poll_interval: '3' # seconds

diff --git a/src/pages/current_user/bearer_logins/new_page.cr b/src/pages/current_user/bearer_logins/new_page.cr
@@ -46,6 +46,8 @@ struct CurrentUser::BearerLogins::NewPage < MainLayout
   end
 
   private def options_for_scopes
-    BearerScope.action_scopes.map { |scope| {scope.to_s, scope.to_s} }
+    Shield.settings.bearer_login_scopes_allowed.map do |scope|
+      {scope, scope}
+    end
   end
 end