Fall back when Parcel2Go profile scope is denied

app/Services/Parcel2Go.php

@@ -2,17 +2,29 @@
 
 namespace App\Services;
 
+use Illuminate\Http\Client\Response;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
 use RuntimeException;
 
 class Parcel2Go
 {
+    private ?string $token = null;
+
+    private ?string $activeScope = null;
+
+    private bool $reducedScope = false;
+
     public function __construct(private IntegrationSettings $settings) {}
 
     public function hasScope(string $scope): bool
     {
-        return in_array($scope, explode(' ', (string) ($this->settings->for('parcel2go')['scope'] ?? 'public-api')), true);
+        return in_array($scope, explode(' ', $this->activeScope ?? (string) ($this->settings->for('parcel2go')['scope'] ?? 'public-api')), true);
+    }
+
+    public function scopeWasReduced(): bool
+    {
+        return $this->reducedScope;
     }
 
     public function verifyCredentials(): void
@@ -107,22 +119,41 @@ class Parcel2Go
 
     private function accessToken(): string
     {
+        if ($this->token !== null) {
+            return $this->token;
+        }
+
         $settings = $this->settings->for('parcel2go');
         if (! $settings['client_id'] || ! $settings['client_secret'] || ! $settings['auth_url']) {
             throw new RuntimeException('Parcel2Go credentials are not configured.');
         }
 
-        $token = Http::asForm()->timeout(10)->post($settings['auth_url'], [
-            'grant_type' => 'client_credentials',
-            'scope' => $settings['scope'] ?? 'public-api',
-            'client_id' => $settings['client_id'],
-            'client_secret' => $settings['client_secret'],
-        ])->throw()->json('access_token');
+        $scope = (string) ($settings['scope'] ?? 'public-api');
+        $response = $this->tokenResponse($settings, $scope);
+        if ($scope !== 'public-api' && $response->status() === 400 && $response->json('error') === 'invalid_scope') {
+            $scope = 'public-api';
+            $response = $this->tokenResponse($settings, $scope);
+            $this->reducedScope = true;
+        }
 
+        $token = $response->throw()->json('access_token');
         if (! $token) {
             throw new RuntimeException('Parcel2Go did not return an access token.');
         }
 
-        return $token;
+        $this->activeScope = $scope;
+
+        return $this->token = $token;
+    }
+
+    /** @param array{auth_url: string, client_id: string, client_secret: string} $settings */
+    private function tokenResponse(array $settings, string $scope): Response
+    {
+        return Http::asForm()->timeout(10)->post($settings['auth_url'], [
+            'grant_type' => 'client_credentials',
+            'scope' => $scope,
+            'client_id' => $settings['client_id'],
+            'client_secret' => $settings['client_secret'],
+        ]);
     }
 }