update t p

id.saladeaula.digital/client/app/routes/authorize.ts

@@ -30,6 +30,12 @@ export async function loader({ request, context }: Route.LoaderArgs) {
       redirect: 'manual'
     })
 
+    console.log('Issuer response', {
+      json: await r.json(),
+      headers: r.headers,
+      status: r.status
+    })
+
     if (r.status === httpStatus.FOUND) {
       return new Response(await r.text(), {
         status: r.status,
@@ -37,11 +43,15 @@ export async function loader({ request, context }: Route.LoaderArgs) {
       })
     }
 
-    console.log('Issuer response', {
-      json: await r.json(),
-      headers: r.headers,
-      status: r.status
-    })
+    // Deny authorization if user lacks scopes requested by client
+    if (r.status === httpStatus.FORBIDDEN) {
+      return new Response(null, {
+        status: httpStatus.FOUND,
+        headers: {
+          Location: new URL('/deny', url.origin).toString()
+        }
+      })
+    }
 
     return new Response(null, {
       status: httpStatus.FOUND,