Merge 2a81398656 into bcc2283694

server/oauth2.go

@@ -14,6 +14,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -481,6 +482,15 @@ func (s *Server) parseAuthorizationRequest(r *http.Request) (*storage.AuthReques
 		unrecognized  []string
 		invalidScopes []string
 	)
+
+	if len(client.DefaultScopes) > 0 {
+		for _, scope := range client.DefaultScopes {
+			if !slices.Contains(scopes, scope) {
+				scopes = append(scopes, scope)
+			}
+		}
+	}
+
 	hasOpenIDScope := false
 	for _, scope := range scopes {
 		switch scope {

storage/storage.go

@@ -171,6 +171,9 @@ type Client struct {
 	// Name and LogoURL used when displaying this client to the end user.
 	Name    string `json:"name" yaml:"name"`
 	LogoURL string `json:"logoURL" yaml:"logoURL"`
+
+	// The set of OAuth2 scopes requested by default.
+	DefaultScopes []string `json:"defaultScopes" yaml:"defaultScopes"`
 }
 
 // Claims represents the ID Token claims supported by the server.