Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
export function makeAdministrationScopes(
access: string[],
realm: string,
entity: string,
id: string,
actions: string[]
): string[] {
const exhaustive: string[] = [];
const available: string[] = [];
for (const action of actions) {
const scope = `${realm}:${entity}.${id}:${action}`;
exhaustive.push(scope);
if (isSuperset(access, `${realm}:${entity}.:${action}`)) {
available.push(scope);
}
}
const optimizations: string[] = [];
for (const scope of exhaustive) {
const [realm, context, action] = scope.split(":");
const segments = action.split(".");
// Speculatively try grouping actions with trailing `**`
for (let i = 0; i < segments.length - 1; i++) {
const speculation = `${realm}:${context}:${segments
.slice(0, i)
.join(".")}.**`;
if (
}
// We have an error to redirect
if (url.searchParams.has("error")) {
setRedirecting(true);
setSpeculativeGrantId(v4());
window.location.replace(url.href);
return;
}
// Check that all requested scopes are already granted
const grantedScopes = grant && grant.scopes;
if (
grantedScopes &&
requestedScopeTemplates &&
isSuperset(grantedScopes, requestedScopeTemplates)
) {
// TODO: We need to allow the app to force us to show a confirmation
// screen. IIRC this is part of the OpenID Connect spec, but I have
// useless airplane wifi right now. This should be an easy thing to
// implement here, so we can enable automatic redirection.
//
// Found the spec: https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1
//
// onGrantAccess();
}
}
}, [
paramsClientId,
if (!credential) {
throw new AuthenticationError("No such credential exists.");
}
const values = {
currentAuthorizationId: authorizationId,
currentUserId: credential.userId,
currentGrantId: null,
currentClientId: null
};
// Make sure the user can create new authorizations.
const user = await User.read(tx, credential.userId);
if (
!isSuperset(
await user.access(tx, values),
createV2AuthXScope(
realm,
{
type: "authorization",
authorizationId: "",
grantId: "",
clientId: "",
userId: user.id
},
{
basic: "*",
scopes: "*",
secrets: "*"
}
)
...possibleAdministrationScopes.filter(possible =>
isSuperset(scopes, possible)
)
...possibleAdministrationScopes.filter(possible =>
isSuperset(scopes, possible)
)
...possibleAdministrationScopes.filter(possible =>
isSuperset(scopes, possible)
)
(grantedScopesExplanations.filter(e => {
return e && isSuperset(s, e.scope);
}) as ReadonlyArray<{
scope: string;
...possibleAdministrationScopes.filter(possible =>
isSuperset(scopes, possible)
)
...possibleAdministrationScopes.filter(possible =>
isSuperset(scopes, possible)
)
...possibleAdministrationScopes.filter(possible =>
isSuperset(scopes, possible)
)