From c974a59f41ed7a17076e07ac91f6cf6635a749b6 Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Tue, 16 Mar 2021 12:32:20 +0100
Subject: [PATCH 1/3] MDL-71119 core_badges: Initialise scopes param in
 backpack-connect.php

The scopes parameter should be passed when creating the OAuth2 badges
client. As it is an optional parameter, when it's empty, it will
be initilised with the supported scopes for the backpack issuer.

It will happen, for instance, when a call is done to oauth2callback.php
because, as defined in RFC6749, OAuth2 authorization response only
supports code and state.
---
 badges/backpack-connect.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/badges/backpack-connect.php b/badges/backpack-connect.php
index ff77f490ee5..0dceb336a8a 100644
--- a/badges/backpack-connect.php
+++ b/badges/backpack-connect.php
@@ -43,6 +43,10 @@ if ($persistedissuer) {
     $returnurl = new moodle_url('/badges/backpack-connect.php',
         ['action' => 'authorization', 'sesskey' => sesskey(), 'backpackid' => $backpackid]);
 
+    // If scope is not passed as parameter, use the issuer supported scopes.
+    if (empty($scope)) {
+        $scope = $issuer->get('scopessupported');
+    }
     $client = new core_badges\oauth2\client($issuer, $returnurl, $scope, $externalbackpack);
     if ($client) {
         if (!$client->is_logged_in()) {

From c1649591a21c53aaf45c17327a857bb9463e8ddf Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Tue, 16 Mar 2021 12:43:39 +0100
Subject: [PATCH 2/3] MDL-71119 core_badges: Use basicauth and remove urlencode

Basic authorization header is required to get token. Besides, client
id and secret shouldn't call urlencode.
---
 badges/classes/oauth2/client.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/badges/classes/oauth2/client.php b/badges/classes/oauth2/client.php
index 575985b796d..e7bc270e481 100644
--- a/badges/classes/oauth2/client.php
+++ b/badges/classes/oauth2/client.php
@@ -222,6 +222,7 @@ class client extends \core\oauth2\client {
         $callbackurl = self::callback_url();
 
         if ($granttype == 'authorization_code') {
+            $this->basicauth = true;
             $params = array('code' => $code,
                 'grant_type' => $granttype,
                 'redirect_uri' => $callbackurl->out(false),
@@ -236,7 +237,7 @@ class client extends \core\oauth2\client {
             );
         }
         if ($this->basicauth) {
-            $idsecret = urlencode($this->clientid) . ':' . urlencode($this->clientsecret);
+            $idsecret = $this->clientid . ':' . $this->clientsecret;
             $this->setHeader('Authorization: Basic ' . base64_encode($idsecret));
         } else {
             $params['client_id'] = $this->clientid;

From 24ff49f68113c791afb276af068d6788548719c8 Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Wed, 14 Apr 2021 10:52:34 +0200
Subject: [PATCH 3/3] MDL-71119 core_badges: Add more information to errors

Some errors raised when calling external services were ignored.
Displaying this information helps to debug and find the real reasons
why some action, like connecting to an external backpack, can't be
done.
---
 badges/classes/oauth2/client.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/badges/classes/oauth2/client.php b/badges/classes/oauth2/client.php
index e7bc270e481..8e635bcec03 100644
--- a/badges/classes/oauth2/client.php
+++ b/badges/classes/oauth2/client.php
@@ -245,11 +245,13 @@ class client extends \core\oauth2\client {
         }
         // Requests can either use http GET or POST.
         $response = $this->post($this->token_url(), $this->build_post_data($params));
-        $r = json_decode($response);
         if ($this->info['http_code'] !== 200) {
-            throw new moodle_exception('Could not upgrade oauth token');
+            $debuginfo = !empty($this->error) ? $this->error : $response;
+            throw new moodle_exception('oauth2refreshtokenerror', 'core_error', '', $this->info['http_code'], $debuginfo);
         }
 
+        $r = json_decode($response);
+
         if (is_null($r)) {
             throw new moodle_exception("Could not decode JSON token response");
         }