Problem/Motivation

In the consumers module, i have opened issue #3436723
Once it lands, we could use it to check if a consumer is active or not, and in the case a consumer is invalidated, then it cannot be used until its status is restored

Proposed resolution

Use the new 'status' field wherever is needed for checking if it is active before granting access to users

Remaining tasks

  • Wait for a new release of consumers
  • Increase dependency version on consumers in composer.json: "drupal/consumers": "^1.18"
  • Rerun tests of this MR to see if it passes

User interface changes

-

API changes

-

Data model changes

-

Issue fork simple_oauth-3436728

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

gorkagr created an issue. See original summary.

gorkagr opened merge request !123

gorkagr’s picture

gorkagr commented
Status: Active » Needs work

Hi!

I believe that is the place to check if a consumer is active/inactive in combination with the Consumers' MR mentioned in the issue.
Best

gorkagr’s picture

gorkagr commented
Status: Needs work » Needs review
gorkagr’s picture

gorkagr commented
Status: Needs review » Needs work

I forgot that tests could fail as the patch is using code that does not exist in the consumers module. So back to "needs work" until consumers has a new release with the proposed MR

thnks

gorkagr’s picture

gorkagr commented
Issue summary: View changes
idebr’s picture

idebr commented
Status: Needs work » Postponed
Related issues: +#3436723: Add a status/published field in a consumer

Postponed on #3436723: Add a status/published field in a consumer

claudiu.cristea’s picture

claudiu.cristea
Primary language Romanian
Location Arad 🇷🇴
commented
Title: Check the status of a consumer » [PP-1] Check the status of a consumer

Title to show is blocked

claudiu.cristea’s picture

claudiu.cristea
Primary language Romanian
Location Arad 🇷🇴
commented
Title: [PP-1] Check the status of a consumer » Check the status of a consumer
Status: Postponed » Needs work

The blocker has been merged #3436723: Add a status/published field in a consumer. Let's unblock this

bojan_dev’s picture

bojan_dev commented

We already have checks in the controllers to verify that $client_entity is not empty, which will return an invalid_client error if it is. We could update the getClientEntity() method to only load consumers that are published. This feature would require test coverage before it can be merged.

gorkagr’s picture

gorkagr commented

Hi!

I believe we still need a release of the consumers' module in order to apply this feature on this module.
Once the release is there, the MR can be edited to add the condition in the loadByProperties() within getClientEntity() indeed.

Best

bojan_dev’s picture

bojan_dev commented

I have released 1.23 on the consumers module.

scott falconer’s picture

scott falconer commented
Issue tags: +AI Initiative Sprint, +ai::outside
attilatilman’s picture

attilatilman commented
Assigned: Unassigned » attilatilman

attilatilman opened merge request !234

attilatilman’s picture

attilatilman commented
Assigned: attilatilman » Unassigned
Status: Needs work » Needs review

Filters unpublished consumers from getClientEntity() by passing status => 1 to loadByProperties(), so disabled clients are treated as non-existent and cannot obtain tokens. Bumps the minimum drupal/consumers requirement to ^1.24 where the status field already present, and updates core_version_requirement to ^10.3 || ^11 to match.

Also fixes several pre-existing issues found while working on the branch:

  • Missing string type hints on getScopeEntityByIdentifier() in both scope repositories 9.x.
  • Mismatched deprecation message strings in Oauth2ScopePluginManagerLegacyTest.
  • Compatibility issue with user_pass_reset_url() deprecated in Drupal 11.4 — the test now uses user.one_time_authentication when available and falls back for older Drupal versions.

Kernel test coverage is added for the unpublished client case across the client credentials and refresh token grant types.

attilatilman’s picture

attilatilman commented
Assigned: Unassigned » attilatilman
Status: Needs review » Needs work
attilatilman’s picture

attilatilman commented
Assigned: attilatilman » Unassigned
Status: Needs work » Needs review
scott falconer’s picture

scott falconer commented

Thanks @attilatilman, tested and it now catches removal of the check and the bearer requests behave as expected.

mglaman’s picture

mglaman
Primary language English
Location WI, USA
commented
Status: Needs review » Reviewed & tested by the community

I'm happy with the MR! RTBC

bojan_dev changed the visibility of the branch 3436728-check-consumer-status to hidden.

bojan_dev changed the visibility of the branch 3436728-check-consumer-status to active.

bojan_dev’s picture

bojan_dev commented
Version: 6.0.x-dev » 6.1.x-dev
Status: Reviewed & tested by the community » Fixed

Great work!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.