- def validates(scopes, app_scopes) do
- case scopes -- app_scopes do
- [] -> {:ok, scopes}
+ def validate(scopes, app_scopes, %User{} = user) do
+ with {:ok, _} <- ensure_scopes_support(scopes, app_scopes),
+ {:ok, scopes} <- authorize_admin_scopes(scopes, app_scopes, user) do
+ {:ok, scopes}
+ end
+ end
+
+ defp ensure_scopes_support(scopes, app_scopes) do
+ case OAuthScopesPlug.filter_descendants(scopes, app_scopes) do
+ ^scopes -> {:ok, scopes}