From 094b81f70d65551150c8d8b01d7c3d346452d587 Mon Sep 17 00:00:00 2001
From: Justin Spahr-Summers <justin@anthropic.com>
Date: Fri, 21 Feb 2025 11:55:46 +0000
Subject: [PATCH] Throw error if scopes are requested and client has none

---
 src/server/auth/handlers/authorize.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/server/auth/handlers/authorize.ts b/src/server/auth/handlers/authorize.ts
index 6580563d..3e9a336b 100644
--- a/src/server/auth/handlers/authorize.ts
+++ b/src/server/auth/handlers/authorize.ts
@@ -120,9 +120,9 @@ export function authorizationHandler({ provider, rateLimit: rateLimitConfig }: A
 
       // Validate scopes
       let requestedScopes: string[] = [];
-      if (scope !== undefined && client.scope !== undefined) {
+      if (scope !== undefined) {
         requestedScopes = scope.split(" ");
-        const allowedScopes = new Set(client.scope.split(" "));
+        const allowedScopes = new Set(client.scope?.split(" "));
 
         // Check each requested scope against allowed scopes
         for (const scope of requestedScopes) {