Change: get allowed scopes from user, not client, for authz code flo

1 files changed, 16 insertions, 1 deletions

diff --git a/yarns/900-local.yarn b/yarns/900-local.yarn
index c9721bc..cae5db1 100644
--- a/yarns/900-local.yarn
+++ b/yarns/900-local.yarn
@@ -40,7 +40,22 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     IMPLEMENTS GIVEN Qvisqve configuration has user account (\S+) with password (\S+)
     username = get_next_match()
     password = get_next_match()
-    V['users'] = { username: password }
+    user = {
+        'password': password,
+    }
+    users = V['users'] or {}
+    users[username] = {'password': password}
+    V['users'] = users
+
+    IMPLEMENTS GIVEN Qvisqve configuration allows user (\S+) scopes (.+)
+    username = get_next_match()
+    scopes = get_next_match()
+    users = V['users']
+    print('users', users)
+    user = users[username]
+    user['scopes'] = scopes.split()
+    users[username] = user
+    V['users'] = users
 
     IMPLEMENTS GIVEN Qvisqve configuration has application (\S+) with callback url (\S+) and secret (\S+) and allowed scopes (.+)
     app = get_next_match()