Persist scopes in Github provider and add it to the auth response. Fix serialization for Set type in locaStorage.

plugins/auth-backend/src/lib/OAuthProvider.ts

@@ -33,6 +33,7 @@ export type Options = {
   providerId: string;
   secure: boolean;
   disableRefresh?: boolean;
+  persistScopes?: boolean;
   baseUrl: string;
   appOrigin: string;
   tokenIssuer: TokenIssuer;
@@ -105,6 +106,10 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
       throw new InputError('missing scope parameter');
     }
 
+    if (this.options.persistScopes) {
+      this.setScopesCookie(res, scope);
+    }
+
     const nonce = crypto.randomBytes(16).toString('base64');
     // set a nonce cookie before redirecting to oauth provider
     this.setNonceCookie(res, nonce);
@@ -137,6 +142,14 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
         req,
       );
 
+      if (this.options.persistScopes) {
+        const grantedScopes = this.getScopesFromCookie(
+          req,
+          this.options.providerId,
+        );
+        response.providerInfo.scope = grantedScopes;
+      }
+
       if (!this.options.disableRefresh) {
         // throw error if missing refresh token
         if (!refreshToken) {
@@ -241,6 +254,21 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
     });
   };
 
+  private setScopesCookie = (res: express.Response, scope: string) => {
+    res.cookie(`${this.options.providerId}-scope`, scope, {
+      maxAge: TEN_MINUTES_MS,
+      secure: this.options.secure,
+      sameSite: 'none',
+      domain: this.domain,
+      path: `${this.basePath}/${this.options.providerId}/handler`,
+      httpOnly: true,
+    });
+  };
+
+  private getScopesFromCookie = (req: express.Request, providerId: string) => {
+    return req.cookies[`${providerId}-scope`];
+  };
+
   private setRefreshTokenCookie = (
     res: express.Response,
     refreshToken: string,

plugins/auth-backend/src/providers/github/provider.ts

@@ -115,6 +115,7 @@ export function createGithubProvider(
 
     envProviders[env] = new OAuthProvider(new GithubAuthProvider(opts), {
       disableRefresh: true,
+      persistScopes: true,
       providerId: 'github',
       secure,
       baseUrl,