Laravel Passport: PKCE Flow: Authorization page always show up

[estuardoquan]

Laravel Version

12

PHP Version

8.4.7

Database Driver & Version

docker mysql:latest

Description

According to the docs; or at least the authorization code grant section If a user has already approved the authorization with xyz scopes the authorization view wont appear if no value is given to prompt query parameter; I've been working with the PKCE setup for a while now and its been inconsistent at times but last version I used (i.e. 12) mostly asked for authorization only once; version 13 is now asking me everytime... The prompt query parameter set to none throws an error and does not give a code... Is there a way to revert this to only ask just once?

Steps To Reproduce

It works; just not as expected

[estuardoquan]

I was checking:

    /**
     * Determine if the given user has already granted the client access to the scopes.
     *
     * @param  \Laravel\Passport\Scope[]  $scopes
     */
    protected function hasGrantedScopes(Authenticatable $user, Client $client, array $scopes): bool
    {
        $tokensScopes = $client->tokens()->where([
            ['user_id', '=', $user->getAuthIdentifier()],
            ['revoked', '=', false],
            ['expires_at', '>', Date::now()],
        ])->pluck('scopes')->flatten();

        return $tokensScopes->isNotEmpty() &&
            collect($scopes)->pluck('id')->diff($tokensScopes)->isEmpty();
    }

does not work if you have not set any scope or if scope is *

I understand that scopes is for security issues; but could someone please enlighten me as to why were checking for tokens to be active?

[hafezdivandari]

Would you please write a failing test so I can reproduce easier? You may check current related tests on these 2 files:

• AuthorizationCodeGrantTest.php
• AuthorizationCodeGrantWithPkceTest.php

I understand that scopes is for security issues; but could someone please enlighten me as to why were checking for tokens to be active?

As the description of the hasGrantedScopes method explains, this method determines if the given user has already granted the client access to the scopes, by listing the scopes of user's active tokens for this client and comapring them to the list of requested scopes.

[hafezdivandari]

You may check PR #1825

does not work if you have not set any scope or if scope is *

'scope' => '*' is not supported for "authorization_code" grant type. The * scope will be considered as invalid and omitted from the list so it would be the same as 'scope' => ''.

passport/src/Bridge/ScopeRepository.php

Lines 42 to 46 in 988779d

	->unless(in_array($grantType, ['password', 'personal_access', 'client_credentials']),
	fn (Collection $scopes): Collection => $scopes->reject(
	fn (ScopeEntityInterface $scope): bool => $scope->getIdentifier() === '*'
	)
	)