这不是问题的答案,而是一些可能有价值的附加信息。
GetAPIPRoductInfo 获取产品的范围列表。相反,GetOAuthV2Info 策略获取有关 OAUthV2 令牌的信息。假设你有一个令牌,你可以这样做:
<GetOAuthV2Info name='GetOAuthV2Info-TokenScopes'>
<!-- use one of the following: a referenced variable or -->
<!-- an explicitly passed access_token -->
<AccessToken ref='access_token'/>
<!--
On Success, the following flow variables will be set.
oauthv2accesstoken.{policy_name}.access_token
oauthv2accesstoken.{policy_name}.scope
oauthv2accesstoken.{policy_name}.refresh_token
oauthv2accesstoken.{policy_name}.accesstoken.{custom_attribute_name}
oauthv2accesstoken.{policy_name}.developer.id
oauthv2accesstoken.{policy_name}.developer.app.name
oauthv2accesstoken.{policy_name}.expires_in
oauthv2accesstoken.{policy_name}.status
-->
</GetOAuthV2Info>
然后,您可以在后续的 JS 标注中使用该信息来检查令牌的范围是否符合您的任何要求:
// checkScope.js
// ------------------------------------------------------------------
var varname = 'oauthv2accesstoken.GetOAuthV2Info-TokenScopes.scope',
approvedScopes = context.getVariable(varname),
check = false;
approvedScopes = approvedScopes.split(' ');
// approvedScopes is now a JavaScript array of strings, that lists
// the scopes the user approved for the requesting client (app).
//
// You can now compare that list against the scopes required
// for an operation or resource, and then set a variable
// determining whether the token is good for the request.
context.setVariable('scopeCheck.ok', check);