/*
 * oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
 *
 * Copyright (c) 2014, Gluu
 */

package org.xdi.oxauth.model.authorize;

import java.util.HashSet;
import java.util.Set;

import javax.ejb.Stateless;
import javax.inject.Inject;
import javax.inject.Named;

import org.apache.commons.lang.StringUtils;
import org.slf4j.Logger;
import org.xdi.oxauth.model.registration.Client;
import org.xdi.oxauth.service.ScopeService;

/**
 * Validates the scopes received for the authorize web service.
 *
 * @author Yuriy Zabrovarnyy
 * @author Yuriy Movchan
 * @version June 3, 2015
 */
@Stateless
@Named("scopeChecker")
public class ScopeChecker {

    @Inject
    private Logger log;

    @Inject
    private ScopeService scopeService;

    public Set<String> checkScopesPolicy(Client client, String scope) {
        log.debug("Checking scopes policy for: " + scope);
        Set<String> grantedScopes = new HashSet<String>();

        final String[] scopesRequested = scope.split(" ");
        final String[] scopesAllowed = client.getScopes();

        for (String scopeRequested : scopesRequested) {
            if (StringUtils.isNotBlank(scopeRequested)) {
                for (String scopeAllowedDn : scopesAllowed) {
                    org.xdi.oxauth.model.common.Scope scopeAllowed = scopeService.getScopeByDnSilently(scopeAllowedDn);
                    if (scopeAllowed != null) {
                        String scopeAllowedName = scopeAllowed.getDisplayName();
                        if (scopeRequested.equals(scopeAllowedName)) {
                            grantedScopes.add(scopeRequested);
                        }
                    }
                }
            }
        }

        log.debug("Granted scopes: " + grantedScopes);

        return grantedScopes;
    }

}
@@ -184,141 +184,8 @@
 e;%0A%0A
-import java.util.HashSet;%0Aimport java.util.Set;%0A%0Aimport javax.ejb.Stateless;%0Aimport javax.inject.Inject;%0Aimport javax.inject.Named;%0A%0A
 impo
@@ -343,16 +343,148 @@
 rvice;%0A%0A
+import javax.ejb.Stateless;%0Aimport javax.inject.Inject;%0Aimport javax.inject.Named;%0Aimport java.util.HashSet;%0Aimport java.util.Set;%0A%0A
 /**%0A * V
@@ -600,16 +600,45 @@
 Movchan%0A
+ * @author Javier Rojas Blum%0A
  * @vers
@@ -646,19 +646,23 @@
 on J
-une
+anuary
  3
+0
 , 201
-5
+8
 %0A */
@@ -1001,24 +1001,116 @@
 String%3E();%0A%0A
+        if (scope == null %7C%7C client == null) %7B%0A            return grantedScopes;%0A        %7D%0A%0A
         fina

oxAuth #739 Fix the list of scopes in the authorization page #739