fix: Disallow invalid scopes (#12099)

server/utils/oauth/OAuthInterface.test.ts

@@ -347,5 +347,11 @@ describe("OAuthInterface", () => {
       const result = await OAuthInterface.validateScope(user, client, scope);
       expect(result).toBe(false);
     });
+
+    it("should reject if any requested scope is invalid", async () => {
+      const scope = [Scope.Read, "*"];
+      const result = await OAuthInterface.validateScope(user, client, scope);
+      expect(result).toBe(false);
+    });
   });
 });

server/utils/oauth/OAuthInterface.ts

@@ -395,7 +395,7 @@ export const OAuthInterface: RefreshTokenModel &
     const scopes = Array.isArray(scope) ? scope : [scope];
     const validAccessScopes = Object.values(Scope);
 
-    return scopes.some((s: string) => {
+    return scopes.every((s: string) => {
       if (validAccessScopes.includes(s as Scope)) {
         return true;
       }