vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge pull request #36145 from Alexoswin/bug/refresh-token

Browse source 
fix: OAuth2 refresh_token grant yields 403 forbidden
This commit is contained in:
Aarol D'Souza 2026-01-28 20:59:01 +05:30 • committed by GitHub
commit 05b1174fa0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
frappe/oauth.py
View file

@ -253,7 +253,9 @@ class OAuthWebRequestValidator(RequestValidator):
# return its scopes, these will be passed on to the refreshed
# access token if the client did not specify a scope during the
# request.
obearer_token = frappe.get_doc("OAuth Bearer Token", {"refresh_token": refresh_token})
obearer_token = frappe.get_doc(
"OAuth Bearer Token", {"refresh_token": refresh_token}, ignore_permissions=True
)
return obearer_token.scopes
def revoke_token(self, token, token_type_hint, request, *args, **kwargs):
@ -291,11 +293,17 @@ class OAuthWebRequestValidator(RequestValidator):
- Refresh Token Grant
"""
otoken = frappe.get_doc("OAuth Bearer Token", {"refresh_token": refresh_token, "status": "Active"})
otoken = frappe.get_doc(
"OAuth Bearer Token",
{"refresh_token": refresh_token, "status": "Active"},
ignore_permissions=True,
)
if not otoken:
return False
else:
# Set request.user to the user associated with the refresh token
request.user = otoken.user
return True
# OpenID Connect