fix(drupal): grant the OAuth consent permission during provisioning

[Decipher]

A provisioned site logs in fine as admin and refuses every real account.
User 1 bypasses permission checks, so the gap only shows for the users the
starterkit is actually for.

The failure

simple_oauth guards the consent form with grant simple_oauth codes
(Oauth2AuthorizeForm.php:140, Oauth2AuthorizeController.php:177).
Provisioning grants access druxt resources to anonymous and nothing else,
so pressing Allow returns to the form with:

The 'grant simple_oauth codes' permission is required.

Anonymous JSON:API works, the site looks healthy, and only login fails. It is
the same shape as the two consumer bugs this script already guards against
(empty client_id, empty grant_types).

The fix

Line	Why
drush('role:perm:add authenticated %s', 'grant simple_oauth codes')	The role matches the granularity of the scope this script already creates
A php-eval that reads the permission back and throws	Same reasoning as the consumer's validate() call: a silent OAuth failure has shipped twice already

Verification

Against a live provisioned site (Drupal 11.4.5, simple_oauth 6.1.1):

Step	Result
Login as a non-admin without the permission	Consent form returns to itself with the error, no token issued
Grant it, retry	Full authorization-code flow completes, tokens issued, refresh works
Guard with the permission present	drush exits 0
Guard with the permission revoked	drush exits 1, so provision fails loudly

The existing site was not reprovisioned: another session is using that
backend, so the grant and the guard were exercised against it directly rather
than through a destructive reinstall.

npm run lint:js, lint:cspell and lint:private are clean.

Not included

scripts/check-oauth.mjs cannot see this: it probes over HTTP as an
anonymous client, and the permission only bites once a user has signed in.
The assertion belongs where the permission is set, which is where it now is.

Found while verifying token refresh for the druxt-auth docs; the module's own
README gains the matching setup step in that repo.

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 48ee54c6-a269-449e-991e-9aefc15506de

📥 Commits

Reviewing files that changed from the base of the PR and between 1fb12c6 and 140a9cc.

📒 Files selected for processing (1)

• drupal/.devtools/provision

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.70%. Comparing base (1fb12c6) to head (140a9cc).

Additional details and impacted files

@@                       Coverage Diff                        @@
##           fix/vue-jest-deasync-install     #164      +/-   ##
================================================================
- Coverage                         91.02%   90.70%   -0.32%     
================================================================
  Files                                13       13              
  Lines                              2217     2217              
  Branches                            104      104              
================================================================
- Hits                               2018     2011       -7     
- Misses                              196      201       +5     
- Partials                              3        5       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.