When setting oauth2 'admin' scope, only the access_token scope is analyzed, returning error if the 'admin' scope is missing.
Woluld be better to, also, analyze user's role. Didn't quite get how to use Doorkeeper's admin_authenticator option from initializer, so just changed your method like this and it works:
def valid_doorkeeper_token?(*scopes) doorkeeper_token && doorkeeper_token.accessible? && (doorkeeper_token.includes_scope(*scopes) || User.find(doorkeeper_token.resource_owner_id).admin?) end
When setting oauth2 'admin' scope, only the access_token scope is analyzed, returning error if the 'admin' scope is missing.
Woluld be better to, also, analyze user's role. Didn't quite get how to use Doorkeeper's admin_authenticator option from initializer, so just changed your method like this and it works:
def valid_doorkeeper_token?(*scopes) doorkeeper_token && doorkeeper_token.accessible? && (doorkeeper_token.includes_scope(*scopes) || User.find(doorkeeper_token.resource_owner_id).admin?) end