Scope bug

[sm2017]

In document https://oauth2-server.readthedocs.io/en/latest/model/spec.html#validatescope-user-client-scope-callback

To accept partially valid scopes:

// list of valid scopes
const VALID_SCOPES = ['read', 'write'];

function validateScope(user, client, scope) {
  return scope
    .split(' ')
    .filter(s => VALID_SCOPES.indexOf(s) >= 0)
    .join(' ');
}

Note that the example above will still reject completely invalid scopes, since validateScope returns an empty string if all scopes are filtered out.

If you see https://github.com/oauthjs/node-oauth2-server/blob/master/lib/grant-types/password-grant-type.js#L107-L109 the scope passed to generateAccessToken and generateRefreshToken is requested scope not scope that partially accepted