From 140a9ccc71c82f4d2fe48cba9591f4f4e563a411 Mon Sep 17 00:00:00 2001
From: Stuart Clark <stu@rtclark.net>
Date: Fri, 4 Sep 2026 01:29:21 +0000
Subject: [PATCH] fix(drupal): grant the OAuth consent permission during
 provisioning

---
 drupal/.devtools/provision | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drupal/.devtools/provision b/drupal/.devtools/provision
index 6aae287..80b7f14 100755
--- a/drupal/.devtools/provision
+++ b/drupal/.devtools/provision
@@ -194,6 +194,24 @@ PHP);
 dotenv_write_var('OAUTH_CLIENT_ID', $client_id);
 PASS('Consumer created (client ID %s); OAUTH_CLIENT_ID written to ../.env.', $client_id);
 
+TASK('Granting the OAuth consent permission.');
+// simple_oauth refuses the consent form to anyone without this, so the
+// authorize step returns to itself with "The 'grant simple_oauth codes'
+// permission is required." and no login can complete. User 1 bypasses
+// permission checks, which is why a site provisioned without it still logs
+// in as admin while every real account fails. The role matches the scope's
+// granularity above.
+drush('role:perm:add authenticated %s', 'grant simple_oauth codes');
+// Read it back. This is the same class of silent failure as the consumer's
+// empty client_id: everything else works, and only login breaks.
+drush('php-eval %s', <<<'PHP'
+$role = \Drupal\user\Entity\Role::load("authenticated");
+if (!$role || !$role->hasPermission("grant simple_oauth codes")) {
+  throw new \RuntimeException("The authenticated role cannot grant OAuth2 codes - the consent screen will refuse every login.");
+}
+PHP);
+PASS('authenticated can grant OAuth2 codes.');
+
 echo PHP_EOL;
 echo '===============================' . PHP_EOL;
 echo '   🚀 PROVISION COMPLETE  ✅  ' . PHP_EOL;