24+ endpoints return 403 insufficient_scope despite valid OAuth token

[sharabash]

Summary

After completing OAuth2 authorization via Hydra (prelive-oauth2.quran.foundation), 24+ endpoints return 403 Forbidden with insufficient_scope, while other endpoints on the same services work fine with the same token.

Observed behavior

Response: 403 Forbidden

{
  "message": "The access token does not have the required scopes",
  "type": "insufficient_scope",
  "success": false
}

Affected endpoints

/auth/v1 service — Goals, Activity, Streaks

Method	Endpoint	Operation
POST	/auth/v1/goals	Create goal
PUT	/auth/v1/goals/:id	Update goal
DELETE	/auth/v1/goals/:id	Delete goal
GET	/auth/v1/goals/get-todays-plan	Get today's plan
GET	/auth/v1/goals/estimate	Estimate goal timeline
GET	/auth/v1/activity-days	Get activity days
POST	/auth/v1/activity-days	Log activity day
GET	/auth/v1/activity-days/estimate-reading-time	Estimate reading time
GET	/auth/v1/streaks	Get streaks
GET	/auth/v1/streaks/current-streak-days	Get current streak

/quran-reflect/v1 service — Posts, Rooms, Tags

Method	Endpoint	Operation
GET	/quran-reflect/v1/posts/feed	Get posts feed
GET	/quran-reflect/v1/posts/by-verse/:verse_key	Get posts by verse
POST	/quran-reflect/v1/posts	Create post
GET	/quran-reflect/v1/posts/:id	Get post
GET	/quran-reflect/v1/posts/my-posts	Get my posts
GET	/quran-reflect/v1/posts/user-posts/:user_id	Get user's posts
POST	/quran-reflect/v1/posts/:id/toggle-like	Toggle like post
GET	/quran-reflect/v1/posts/:id/all-comments	Get all post comments
GET	/quran-reflect/v1/rooms/search	Search rooms
GET	/quran-reflect/v1/rooms/:id	Get room by ID
POST	/quran-reflect/v1/rooms/groups	Create group
GET	/quran-reflect/v1/rooms/joined-rooms	Get joined rooms
GET	/quran-reflect/v1/tags	Search tags
POST	/quran-reflect/v1/users/featured/follow-all	Follow all featured users

Working endpoints (same token, same session)

These endpoints return 200 OK with the same access token:

• GET /quran-reflect/v1/users/profile ✓
• PUT /quran-reflect/v1/users/profile ✓
• PATCH /quran-reflect/v1/users/profile ✓
• GET /quran-reflect/v1/users/:id ✓
• GET /quran-reflect/v1/users/search ✓
• GET /quran-reflect/v1/users/:id/followers ✓
• GET /quran-reflect/v1/users/:id/following ✓
• GET /quran-reflect/v1/users/:id/rooms ✓ (via /quran-reflect/v1/users/my-rooms)
• GET /auth/v1/bookmarks ✓
• GET /auth/v1/notes ✓
• GET /auth/v1/collections ✓
• GET /auth/v1/preferences ✓
• POST /auth/v1/preferences ✓
• GET /auth/v1/reading-sessions ✓
• POST /auth/v1/reading-sessions ✓

Context

The OAuth client is registered on Hydra with parent scopes (e.g., user). It appears the failing endpoints require child scopes (e.g., user.goals.read, user.posts.read) that are not registered on the client. The working endpoints likely fall under scopes already granted.

This suggests the Hydra client configuration needs to include the full set of child scopes, or the API should accept parent scopes as encompassing their children.

Tested against: https://apis-prelive.quran.foundation
OAuth provider: https://prelive-oauth2.quran.foundation

[basit3407]

Retested issue #75 end-to-end with a valid token/client generated with parent scopes (bookmark collection reading_session preference activity_day goal streak user post comment room tag note ...).

Result:

• I tested the full endpoint list in this issue.
• For all endpoints except one, insufficient_scope does not reproduce.
• Those endpoints are working as expected (or return normal validation/business responses such as 400/404/422 depending on request data), not scope failures.

The only endpoint where 403 insufficient_scope was reproducible:

• POST /quran-reflect/v1/users/featured/follow-all

Root cause was in API Gateway scope mapping (route missing from scope map), and a fix PR is now open:

• https://github.com/quran/qf-api-gateway/pull/61

PR scope:

• Adds missing mapping for POST /v1/users/featured/follow-all with scopes [user.follow, user] (consistent with other follow actions).

So this issue appears to be partially valid: one real scope-mapping gap, not a broad 24+ endpoint scope failure.