<commit_before>package tokens

import (
	"encoding/json"
	"fmt"
	"net/http"

	"github.com/pivotal-cf-experimental/warrant/internal/server/common"
	"github.com/pivotal-cf-experimental/warrant/internal/server/domain"
)

type urlFinder interface {
	URL() string
}

type tokenHandler struct {
	clients    *domain.Clients
	users      *domain.Users
	urlFinder  urlFinder
	privateKey string
}

func (h tokenHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
	// TODO: actually check the basic auth values
	clientID, _, ok := req.BasicAuth()
	if !ok {
		common.JSONError(w, http.StatusUnauthorized, "An Authentication object was not found in the SecurityContext", "unauthorized")
		return
	}

	client, ok := h.clients.Get(clientID)
	if !ok {
		common.JSONError(w, http.StatusUnauthorized, fmt.Sprintf("No client with requested id: %s", clientID), "invalid_client")
		return
	}

	err := req.ParseForm()
	if err != nil {
		panic(err)
	}

	var t domain.Token
	if req.Form.Get("grant_type") == "client_credentials" {
		t.ClientID = clientID
		t.Scopes = client.Scope
		t.Audiences = []string{"scim", "password"}
		t.Issuer = fmt.Sprintf("%s/oauth/token", h.urlFinder.URL())
	} else {
		user, ok := h.users.GetByName(req.Form.Get("username"))
		if !ok {
			common.JSONError(w, http.StatusNotFound, fmt.Sprintf("User %s does not exist", req.Form.Get("username")), "scim_resource_not_found")
			return
		}

		t.ClientID = clientID
		t.Scopes = client.Scope
		t.UserID = user.ID
	}

	response, err := json.Marshal(t.ToDocument(h.privateKey))
	if err != nil {
		panic(err)
	}

	w.Write(response)
}
<commit_msg>The token should inherit authorities<commit_after>package tokens

import (
	"encoding/json"
	"fmt"
	"net/http"

	"github.com/pivotal-cf-experimental/warrant/internal/server/common"
	"github.com/pivotal-cf-experimental/warrant/internal/server/domain"
)

type urlFinder interface {
	URL() string
}

type tokenHandler struct {
	clients    *domain.Clients
	users      *domain.Users
	urlFinder  urlFinder
	privateKey string
}

func (h tokenHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
	// TODO: actually check the basic auth values
	clientID, _, ok := req.BasicAuth()
	if !ok {
		common.JSONError(w, http.StatusUnauthorized, "An Authentication object was not found in the SecurityContext", "unauthorized")
		return
	}

	client, ok := h.clients.Get(clientID)
	if !ok {
		common.JSONError(w, http.StatusUnauthorized, fmt.Sprintf("No client with requested id: %s", clientID), "invalid_client")
		return
	}

	err := req.ParseForm()
	if err != nil {
		panic(err)
	}

	var t domain.Token
	if req.Form.Get("grant_type") == "client_credentials" {
		t.ClientID = clientID
		t.Scopes = client.Scope
		t.Authorities = client.Authorities
		t.Audiences = []string{"scim", "password"}
		t.Issuer = fmt.Sprintf("%s/oauth/token", h.urlFinder.URL())
	} else {
		user, ok := h.users.GetByName(req.Form.Get("username"))
		if !ok {
			common.JSONError(w, http.StatusNotFound, fmt.Sprintf("User %s does not exist", req.Form.Get("username")), "scim_resource_not_found")
			return
		}

		t.ClientID = clientID
		t.Scopes = client.Scope
		t.UserID = user.ID
	}

	response, err := json.Marshal(t.ToDocument(h.privateKey))
	if err != nil {
		panic(err)
	}

	w.Write(response)
}

{'fraction_non_alphanumeric': 0.13914373088685014, 'fraction_numerical': 0.0, 'mean_word_length': 4.1269592476489025, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5614831', 'n_tokens_mistral': 1217, 'n_tokens_neox': 1157, 'n_words': 254}