FriendsOfSymfony/oauth2-php — pull request #25 by chuanma (2013-04-28 23:50:02+00:00)
Title: Honor request's scope value

In the OAuth2 spec on granting an access token, "the authorization server MAY fully or partially ignore the scope requested by the client based on the authorization server policy or the resource owner's instructions".

So OAuth2 spec doesn't have an opinion on how scope is being handled. But oauth2-php currently has an opinion: fully ignores the request's scope value.

As a result, there is at least one use case that's impossible:
1. a client with a 'client_credentials' grant type has both 'read' and 'write' scope.
2. the client wants to get an access token that can ONLY 'read' data.

With this PR, the client can ask for an access token of 'read' scope by passing in 'scope=read' in the request.