fix menu

id.saladeaula.digital/app/config.py

@@ -13,5 +13,11 @@ OAUTH2_SCOPES_SUPPORTED: list[str] = [
     'apps:studio',
     'apps:insights',
 ]
+OAUTH2_DEFAULT_SCOPES = {
+    'email',
+    'offline_access',
+    'openid',
+    'profile',
+}
 
 SESSION_EXPIRES_IN = 86_400 * 30  # 30 days

id.saladeaula.digital/app/oauth2.py

@@ -21,7 +21,7 @@ from layercake.dynamodb import (
 from layercake.funcs import omit, pick
 
 from boto3clients import dynamodb_client
-from config import ISSUER, OAUTH2_SCOPES_SUPPORTED, OAUTH2_TABLE
+from config import ISSUER, OAUTH2_DEFAULT_SCOPES, OAUTH2_SCOPES_SUPPORTED, OAUTH2_TABLE
 from integrations.apigateway_oauth2.authorization_server import (
     AuthorizationServer,
 )
@@ -191,10 +191,11 @@ class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
                 rename_key='scope',
             ),
         )
+        scope = set(user.get('scope', [])) | OAUTH2_DEFAULT_SCOPES
 
         return User(
             **pick(('id', 'name', 'email', 'email_verified'), user),
-            scope=' '.join(user['scope']) if 'scope' in user else None,
+            scope=' '.join(scope),
         )
 
 

id.saladeaula.digital/app/routes/authorize.py

@@ -5,13 +5,14 @@ from aws_lambda_powertools.event_handler.api_gateway import Router
 from aws_lambda_powertools.event_handler.exceptions import (
     BadRequestError,
     ForbiddenError,
+    NotFoundError,
     ServiceError,
 )
 from joserfc.errors import JoseError
 from layercake.dynamodb import DynamoDBPersistenceLayer, KeyPair, SortKey
 
 from boto3clients import dynamodb_client
-from config import OAUTH2_TABLE
+from config import OAUTH2_DEFAULT_SCOPES, OAUTH2_TABLE
 from oauth2 import server
 from util import parse_cookies
 
@@ -20,6 +21,9 @@ logger = Logger(__name__)
 dyn = DynamoDBPersistenceLayer(OAUTH2_TABLE, dynamodb_client)
 
 
+class SessionNotFoundError(NotFoundError): ...
+
+
 @router.get('/authorize')
 def authorize():
     current_event = router.current_event
@@ -27,20 +31,20 @@ def authorize():
     session = cookies.get('SID')
 
     if not session:
-        raise BadRequestError('Missing session')
+        raise BadRequestError('Session cookie (SID) is required')
 
     try:
-        sid, sub = session.split(':')
+        session_id, user_id = session.split(':')
         # Raise if session is not found
         dyn.collection.get_item(
-            KeyPair('SESSION', sid),
-            exc_cls=InvalidSession,
+            KeyPair('SESSION', session_id),
+            exc_cls=SessionNotFoundError,
         )
         grant = server.get_consent_grant(
             request=router.current_event,
-            end_user=sub,
+            end_user=user_id,
         )
-        user_scopes = _user_scopes(sub)
+        user_scopes = _user_scopes(user_id)
         client_scopes = set(scope_to_list(grant.client.scope))
 
         # Deny authorization if user lacks scopes requested by client
@@ -49,7 +53,7 @@ def authorize():
 
         response = server.create_authorization_response(
             request=router.current_event,
-            grant_user=sub,
+            grant_user=user_id,
             grant=grant,
         )
     except JoseError as err:
@@ -65,18 +69,16 @@ def authorize():
         return response
 
 
-def _user_scopes(sub: str) -> set:
-    return set(
+def _user_scopes(user_id: str) -> set:
+    return OAUTH2_DEFAULT_SCOPES | set(
         scope_to_list(
             dyn.collection.get_item(
                 KeyPair(
-                    pk=sub,
+                    pk=user_id,
                     sk=SortKey(sk='SCOPE', path_spec='scope'),
                 ),
-                exc_cls=BadRequestError,
+                raise_on_error=False,
+                default='',
             )
         )
     )
-
-
-class InvalidSession(BadRequestError): ...

id.saladeaula.digital/app/routes/register.py

@@ -88,7 +88,9 @@ def _create_user(*, user: User, password: str):
             item={
                 'sk': '0',
                 'email_verified': False,
-                'created_at': now_,
+                'createdDate': now_,
+                # Post-migration (users): uncomment the folloing line
+                # 'created_at': now_,
             }
             | asdict(user),
         )
@@ -116,6 +118,7 @@ def _create_user(*, user: User, password: str):
                 # Post-migration (users): rename `cpf` to `CPF`
                 'id': 'cpf',
                 'sk': user.cpf,
+                'user_id': user.id,
                 'created_at': now_,
             },
             cond_expr='attribute_not_exists(sk)',
@@ -126,6 +129,7 @@ def _create_user(*, user: User, password: str):
                 # Post-migration (users): rename `email` to `EMAIL`
                 'id': 'email',
                 'sk': user.email,
+                'user_id': user.id,
                 'created_at': now_,
             },
             cond_expr='attribute_not_exists(sk)',