feat: filtering mode

Author: james-d-elliott

handler/oauth2/flow_refresh.go

@@ -29,6 +29,11 @@ type RefreshTokenGrantHandler struct {
 		fosite.AudienceStrategyProvider
 		fosite.RefreshTokenScopesProvider
 	}
+
+	// IgnoreRequestedScopeNotInOriginalGrant determines the action to take when the requested scopes in the refresh
+	// flow were not originally granted. If false which is the default the handler will automatically return an error.
+	// If true the handler will filter out / ignore the scopes which were not originally granted.
+	IgnoreRequestedScopeNotInOriginalGrant bool
 }
 
 // HandleTokenEndpointRequest implements https://tools.ietf.org/html/rfc6749#section-6
@@ -105,7 +110,11 @@ func (c *RefreshTokenGrantHandler) HandleTokenEndpointRequest(ctx context.Contex
 	for _, scope := range request.GetRequestedScopes() {
 		// Addresses point 2 of the text in RFC6749 Section 6.
 		if !strategy(originalScopes, scope) {
-			return errorsx.WithStack(fosite.ErrInvalidScope.WithHintf("The requested scope '%s' was not originally granted by the resource owner.", scope))
+			if c.IgnoreRequestedScopeNotInOriginalGrant {
+				continue
+			} else {
+				return errorsx.WithStack(fosite.ErrInvalidScope.WithHintf("The requested scope '%s' was not originally granted by the resource owner.", scope))
+			}
 		}
 
 		if !strategy(request.GetClient().GetScopes(), scope) {