Add integration tests for invalid_scope error handling - #4874
Merged
sahandilshan merged 1 commit intoAug 13, 2026
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdded an OAuth integration suite that provisions test resources and validates invalid-scope behavior for refresh tokens, token exchange, client credentials, and authorization flows. Added a raw refresh-token utility that returns status and response data for successful and failed requests. ChangesOAuth invalid-scope validation
Estimated code review effort: 4 (Complex) | ~45 minutes Mergeability Score: ⚪ Minimal · up to The PR adds integration coverage and a raw test helper without changing production behavior; no actionable merge-blocking risk remains, so it is merge-ready after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant InvalidScopeTestSuite
participant AuthorizationEndpoint
participant TokenEndpoint
InvalidScopeTestSuite->>AuthorizationEndpoint: Request authorization code or direct authentication
AuthorizationEndpoint-->>InvalidScopeTestSuite: Return authorization response and code
InvalidScopeTestSuite->>TokenEndpoint: Submit refresh, exchange, or client-credentials request
TokenEndpoint-->>InvalidScopeTestSuite: Return token status, body, or decoded token
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/integration/oauth/token/invalid_scope_test.go`:
- Around line 497-533: Update the successful refresh-token tests to assert the
exact granted scope set: in TestRefreshToken_SubsetScope_Succeeds require only
“read”, in TestRefreshToken_SameScopes_Succeeds require “openid read write”, and
in TestRefreshToken_NoScopeParam_GrantsOriginalScopes require the original
“openid read write” scopes. Replace the current partial or absent scope checks
with complete equality assertions.
In `@tests/integration/testutils/oauth2_utils.go`:
- Line 759: Update refreshAccessToken to call req.SetBasicAuth only when
clientID is non-empty. Preserve the existing request behavior while ensuring no
Authorization header is sent for an empty client ID.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 59606867-5270-4ee3-90bb-2a5749b06fe8
📒 Files selected for processing (2)
tests/integration/oauth/token/invalid_scope_test.gotests/integration/testutils/oauth2_utils.go
sahandilshan
force-pushed
the
test/invalid-scope-integration
branch
from
August 12, 2026 08:43
9700902 to
5a86fa5
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/integration/oauth/token/invalid_scope_test.go`:
- Around line 587-591: Update all listed silent-drop assertions in
tests/integration/oauth/token/invalid_scope_test.go:587-591, 602-605, 623-626,
639-643, 652-656, and 665-669 to use ElementsMatch with the specified exact
scope sets; at 613-616, always extract scopeStr and assert
strings.Fields(scopeStr) is empty. If responses legitimately include extra
default scopes, retain membership assertions and document those expected extras
in a comment.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 34e55d65-49eb-47ed-8a77-889c37bf5cb4
📒 Files selected for processing (2)
tests/integration/oauth/token/invalid_scope_test.gotests/integration/testutils/oauth2_utils.go
sahandilshan
added
the
skip-changelog
Cover all invalid_scope code paths that previously had zero integration test coverage: refresh token scope escalation (RFC 6749 §6) and token exchange with scopeless subject tokens. Also add tests verifying the silent scope-drop behavior for client_credentials and authorize endpoints when scopes are undefined on the resource server or unauthorized via RBAC. Signed-off-by: Sahan Dilshan <sahandilshan222@gmail.com>
sahandilshan
force-pushed
the
test/invalid-scope-integration
branch
from
August 13, 2026 10:05
5a86fa5 to
2590381
Compare
sahandilshan
added
the
trigger-pr-builder
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
thiva-k
approved these changes
Aug 13, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
invalid_scopeerror handling at/oauth2/tokenand scope silent-drop behavior at/oauth2/authorizeRefreshAccessTokenRawtest helper that returns raw HTTP status + body (enabling assertion on error JSON for non-200 responses) with optionalscopeparameterTest groups
invalid_scopeerror=invalid_scope(RFC 6749 §6); subset/same/omitted scope succeedsinvalid_scopeerror=invalid_scope; scoped subject with excess scopes silently filtersCoverage verification
All target code paths confirmed hit via coverage-instrumented build:
refresh_token.go:454-459(invalid_scope error return)token_exchange.go:476-482(scopeless subject escalation guard)resourceindicators.go:241-244(DownscopeToResourceServer filter)client_credentials.go:177-184(filterAuthorizedScopes)Test plan
go vet ./oauth/token/... && go vet ./testutils/...passesmake test_integration PACKAGE=./oauth/token/... RUN=TestInvalidScopeTestSuite🤖 Generated with Claude Code
Summary by CodeRabbit