feat: Add support for MSC4484

src/web/pages/components/mod.rs

@@ -2,11 +2,11 @@ use std::{collections::BTreeSet, time::SystemTime};
 
 use askama::{Template, filters::HtmlSafe};
 use conduwuit_core::utils;
-use conduwuit_service::{
-	Services,
-	oauth::{client_metadata::ClientMetadata, grant::Scope},
+use conduwuit_service::{Services, oauth::client_metadata::ClientMetadata};
+use ruma::{
+	OwnedDeviceId, OwnedUserId, UserId,
+	api::{OAuthClientScope, client::device::Device},
 };
-use ruma::{OwnedDeviceId, OwnedUserId, UserId, api::client::device::Device};
 
 pub(super) mod form;
 
@@ -202,7 +202,7 @@ impl DeviceCard {
 #[derive(Debug, Template)]
 #[template(path = "_components/client_scopes.html.j2")]
 pub(super) struct ClientScopes {
-	pub scopes: BTreeSet<Scope>,
+	pub scopes: BTreeSet<OAuthClientScope>,
 }
 
 impl HtmlSafe for ClientScopes {}

src/web/pages/oauth/grant.rs

@@ -6,9 +6,9 @@ use axum::{
 };
 use conduwuit_service::oauth::{
 	client_metadata::ClientMetadata,
-	grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery, Prompt},
+	grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery, Prompt, RequestedScope},
 };
-use ruma::OwnedUserId;
+use ruma::{OwnedUserId, api::OAuthClientScope};
 use serde::{Deserialize, de::IgnoredAny};
 
 use crate::{
@@ -102,7 +102,13 @@ async fn route_authorization_code(
 		return Err(WebError::BadRequest("Invalid client ID".to_owned()));
 	};
 
-	let scopes = query.scope.to_scopes().map_err(WebError::BadRequest)?;
+	let scopes = query
+		.scope
+		.to_scopes()
+		.map_err(WebError::BadRequest)?
+		.iter()
+		.filter_map(RequestedScope::as_client_scope)
+		.collect();
 
 	let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 
@@ -183,6 +189,12 @@ async fn route_device_code(
 				));
 			};
 
+			let scopes = grant_info
+				.requested_scopes
+				.iter()
+				.filter_map(RequestedScope::as_client_scope)
+				.collect();
+
 			let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 
 			response!(Grant::new(
@@ -196,7 +208,7 @@ async fn route_device_code(
 				user_id,
 				user_avatar,
 				grant_info.client_metadata,
-				ClientScopes { scopes: grant_info.requested_scopes },
+				ClientScopes { scopes },
 				Some(grant_info.device_code),
 			))
 		},

src/web/pages/templates/_components/client_scopes.html.j2

@@ -1,10 +1,12 @@
 <ul>
     {% for scope in scopes %}
         {% match scope %}
-            {% when Scope::ClientApi %}
-                <li>Send messages and interact with chatrooms on your behalf</li>
-            {% when Scope::Device(_) %}
-                <li>Access your Matrix account</li>
+            {% when OAuthClientScope::ApiFullAccess %}
+                <li>Access and control all features of your Matrix account</li>
+            {% when OAuthClientScope::ServerAdministration %}
+                <li><em class="danger">Access your homeserver's administrator tools</em></li>
+            {% when _ %}
+                <li>missingno</li>
         {% endmatch %}
     {% endfor %}
 </ul>

src/web/pages/templates/grant.html.j2

@@ -21,14 +21,26 @@ Authorize client
         </div>
         {{ Avatar::for_client(client_metadata) }}
     </div>
+
     <div class="identity">
         Signed in as <code>{{ user_id }}</code>. <a href="{{ crate::ROUTE_PREFIX }}/account/logout?{{ logout_query }}">Switch accounts</a>
     </div>
+
     <p>
         <b>{{ client_name }}</b> (<a href="{{ client_metadata.client_uri }}">{{ client_metadata.client_uri.domain().unwrap() }}</a>) would like
         your permission to:
+
         {{ scopes }}
     </p>
+
+    {% if scopes.scopes.contains(&OAuthClientScope::ServerAdministration) %}
+        <p class="card danger">
+            ⚠️ {{ client_name }} wants to be able to administrate your homeserver. If it is untrustworthy,
+            it could use its administrator powers to cause severe damage to your homeserver's users and rooms.
+            Make sure you trust it fully before you continue.
+        </p>
+    {% endif %}
+
     {% match (&client_metadata.policy_uri, &client_metadata.tos_uri) %}
         {% when (Some(policy_uri), Some(tos_uri)) %}
             <p>