add/set approvedScopes in User

[lsnider]

It's possible for a user to grant a subset of the requested scopes. Google has been pushing this recently...see the attached screenshot of their latest Oauth page. Their latest default is to have no scopes checked making it quite easy for a user to select a subset of the requested scopes.

Part of the Oauth flow suggests the providers should return the approved scopes as part of the code -> access_token exchange if the user auth'ed a subset of the requested scopes. In my testing of Google, M365, Slack, and Zoom, the scope field is always returned as part of the code -> access_token exchange.

There was a recent issue asking for this feature.

As pointed out in the link within issue#568, we should expect code -> access_token, refresh_token (optional), expires_at, scope (optional)

There was a recent PR which brought the User class up from just access_token to also include refresh_token, and expires_at.

This PR also brings in scope to the User object. That would complete the User object for storing everything the code -> access_token exchange returns.

Would you like to merge this up stream? If so, I can do whatever I can to make this acceptable up steam. I tested this with the providers we are using. I can also put in a PR for the SocialiteProviders manager. In SocialiteProviders, it's much like this PR but we set the scopes here and add a parseApprovedScopes function like the others in that file.

Tested with native Oauth Provider:

• Google Personal
• Google Workspace/Gsuite

Tested with SocialiteProviders (needs a simple PR):

• M365
• Slack (we have a fork of the Slack Provider)

If it's helpful, here are a few documents showing the scope field gets returned from a auth code to access token exchange

• GitHub
• Google
• M365
• Slack
• Zoom

[taylorotwell]

I don't seem to have permission to edit this PR?

[lsnider]

@taylorotwell Were you just having trouble marking it as a draft? I don't see any permissions controls on my side regarding the PR. Did add you as a writer to this forked repo if you were looking to push to the branch.

[lsnider]

If this PR gets merged, here is the corresponding PR for SocialliteProviders