Need to set scope to getAuthorizationUrl for Gitlab

[romaricp]

Hi Julien,

It doesn't really seem appropriate not to define a scope for the request of Gitlab connect :
https://github.com/julienj/twity/blob/master/src/Security/GitlabAuthenticator.php#L123

The doc show how we can define a specific scope :

$options = [
    'state' => 'OPTIONAL_CUSTOM_CONFIGURED_STATE',
    'scope' => ['read_user','openid'] // array or string
];

$authorizationUrl = $provider->getAuthorizationUrl($options);

For me only read_user and openid should be enough.
The problem is if by default there is no scope set, Gitlab will allow the scope : api which is very permissive towards the end user, because the Gitlab API is very powerful.

What is your point of view on this ? ;) 🍻

[julienj]

Hi Romaric,

I haven't worked on this project for a long time.
So I'll archive it for clarity.

I suggest you do a fork if you need to make it evolve.

Thanks very