From 63671b439707b0366d225e8dd6df938ff3122b13 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Wed, 17 Jun 2026 21:36:03 +0200 Subject: [PATCH] test(auth): assert userinfo tokens have empty scopes (contract guard) Address claude-review round 10 (Option B): pin the empty-scope contract for userinfo-validated tokens in test_mgmt_opaque_userinfo_fallback_accepted_despite_allowlist, so a future @require_scopes on a management endpoint that would silently reject cross-client callers is caught by a test rather than only the docstring. Co-Authored-By: Claude Opus 4.8 (1M context) --- tests/unit/test_unified_verifier.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/unit/test_unified_verifier.py b/tests/unit/test_unified_verifier.py index a290f7b0..3a94c133 100644 --- a/tests/unit/test_unified_verifier.py +++ b/tests/unit/test_unified_verifier.py @@ -704,6 +704,9 @@ class TestUserinfoFallback: assert result is not None assert result.resource == "testuser" assert result.client_id == "" # userinfo provides no client_id + # Contract: userinfo tokens carry empty scopes — management endpoints + # must not gate on scopes for this path (per-user authz is the gate). + assert result.scopes == [] async def test_introspection_cannot_forge_userinfo_bypass( self, monkeypatch, userinfo_settings