Client Auth: Scope Selection & Challenge Handling #32

Description

@pcarleton

Overview

Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

Specification References

Key Requirements from Specification

Scope Selection (SHOULD)

  • Clients SHOULD follow principle of least privilege
  • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
  • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
  • Omit scope parameter if scopes_supported is undefined

Scope Challenge Handling

  • Servers SHOULD respond with HTTP 403 for insufficient scope errors
  • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
  • Servers SHOULD include scope parameter with required scopes
  • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
  • Clients SHOULD implement retry limits for scope upgrade attempts

401 Handling on Non-Initialize (MUST)

  • Clients MUST parse WWW-Authenticate headers
  • Clients MUST respond appropriately to HTTP 401 responses
  • Authorization MUST be included in every HTTP request

Scenarios to Cover

Positive Tests

  1. Client correctly uses scope from WWW-Authenticate header
  2. Client falls back to scopes_supported when scope not in header
  3. Client handles HTTP 403 with insufficient_scope error
  4. Client performs step-up authorization flow successfully
  5. Client handles 401 on non-initialize requests

Negative Tests

  1. Client fails to include scope from WWW-Authenticate header
  2. Client requests excessive scopes beyond what's needed
  3. Client doesn't retry after insufficient_scope error
  4. Client enters infinite retry loop on scope challenges
  5. Client fails to handle 401 on non-initialize requests

Implementation Notes

  • Register spec references in src/scenarios/client/auth/spec-references.ts
  • Build on existing auth scenarios in src/scenarios/client/auth/
  • Follow patterns from basic-dcr.ts and basic-metadata.ts
  • Include at least one negative test scenario per requirement

Acceptance Criteria

  • Test scenarios cover scope selection strategy per spec
  • Test scenarios cover scope challenge handling per spec
  • Tests validate 401 response handling on non-initialize requests
  • Tests verify client can complete scope challenge flow
  • At least one negative test included for each major requirement
  • Spec references registered in check definitions file
  • All checks properly documented and follow existing patterns

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
      }
      } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
      })();
      (function(){
      try {
      var __m = "github.com";
      var __re = new RegExp('^' + "github\\.com" + '
      
      Skip to content

      Client Auth: Scope Selection & Challenge Handling #32

      Description

      @pcarleton

      Overview

      Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

      Specification References

      Key Requirements from Specification

      Scope Selection (SHOULD)

      • Clients SHOULD follow principle of least privilege
      • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
      • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
      • Omit scope parameter if scopes_supported is undefined

      Scope Challenge Handling

      • Servers SHOULD respond with HTTP 403 for insufficient scope errors
      • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
      • Servers SHOULD include scope parameter with required scopes
      • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
      • Clients SHOULD implement retry limits for scope upgrade attempts

      401 Handling on Non-Initialize (MUST)

      • Clients MUST parse WWW-Authenticate headers
      • Clients MUST respond appropriately to HTTP 401 responses
      • Authorization MUST be included in every HTTP request

      Scenarios to Cover

      Positive Tests

      1. Client correctly uses scope from WWW-Authenticate header
      2. Client falls back to scopes_supported when scope not in header
      3. Client handles HTTP 403 with insufficient_scope error
      4. Client performs step-up authorization flow successfully
      5. Client handles 401 on non-initialize requests

      Negative Tests

      1. Client fails to include scope from WWW-Authenticate header
      2. Client requests excessive scopes beyond what's needed
      3. Client doesn't retry after insufficient_scope error
      4. Client enters infinite retry loop on scope challenges
      5. Client fails to handle 401 on non-initialize requests

      Implementation Notes

      • Register spec references in src/scenarios/client/auth/spec-references.ts
      • Build on existing auth scenarios in src/scenarios/client/auth/
      • Follow patterns from basic-dcr.ts and basic-metadata.ts
      • Include at least one negative test scenario per requirement

      Acceptance Criteria

      • Test scenarios cover scope selection strategy per spec
      • Test scenarios cover scope challenge handling per spec
      • Tests validate 401 response handling on non-initialize requests
      • Tests verify client can complete scope challenge flow
      • At least one negative test included for each major requirement
      • Spec references registered in check definitions file
      • All checks properly documented and follow existing patterns

      Activity

      Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

      Metadata

      Metadata

      Assignees

      No one assigned

        Labels

        No labels
        No labels

        Type

        No type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
          Skip to content

          Client Auth: Scope Selection & Challenge Handling #32

          Description

          @pcarleton

          Overview

          Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

          Specification References

          Key Requirements from Specification

          Scope Selection (SHOULD)

          • Clients SHOULD follow principle of least privilege
          • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
          • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
          • Omit scope parameter if scopes_supported is undefined

          Scope Challenge Handling

          • Servers SHOULD respond with HTTP 403 for insufficient scope errors
          • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
          • Servers SHOULD include scope parameter with required scopes
          • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
          • Clients SHOULD implement retry limits for scope upgrade attempts

          401 Handling on Non-Initialize (MUST)

          • Clients MUST parse WWW-Authenticate headers
          • Clients MUST respond appropriately to HTTP 401 responses
          • Authorization MUST be included in every HTTP request

          Scenarios to Cover

          Positive Tests

          1. Client correctly uses scope from WWW-Authenticate header
          2. Client falls back to scopes_supported when scope not in header
          3. Client handles HTTP 403 with insufficient_scope error
          4. Client performs step-up authorization flow successfully
          5. Client handles 401 on non-initialize requests

          Negative Tests

          1. Client fails to include scope from WWW-Authenticate header
          2. Client requests excessive scopes beyond what's needed
          3. Client doesn't retry after insufficient_scope error
          4. Client enters infinite retry loop on scope challenges
          5. Client fails to handle 401 on non-initialize requests

          Implementation Notes

          • Register spec references in src/scenarios/client/auth/spec-references.ts
          • Build on existing auth scenarios in src/scenarios/client/auth/
          • Follow patterns from basic-dcr.ts and basic-metadata.ts
          • Include at least one negative test scenario per requirement

          Acceptance Criteria

          • Test scenarios cover scope selection strategy per spec
          • Test scenarios cover scope challenge handling per spec
          • Tests validate 401 response handling on non-initialize requests
          • Tests verify client can complete scope challenge flow
          • At least one negative test included for each major requirement
          • Spec references registered in check definitions file
          • All checks properly documented and follow existing patterns

          Activity

          Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

          Metadata

          Metadata

          Assignees

          No one assigned

            Labels

            No labels
            No labels

            Type

            No type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              Client Auth: Scope Selection & Challenge Handling #32

              Description

              @pcarleton

              Overview

              Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

              Specification References

              Key Requirements from Specification

              Scope Selection (SHOULD)

              • Clients SHOULD follow principle of least privilege
              • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
              • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
              • Omit scope parameter if scopes_supported is undefined

              Scope Challenge Handling

              • Servers SHOULD respond with HTTP 403 for insufficient scope errors
              • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
              • Servers SHOULD include scope parameter with required scopes
              • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
              • Clients SHOULD implement retry limits for scope upgrade attempts

              401 Handling on Non-Initialize (MUST)

              • Clients MUST parse WWW-Authenticate headers
              • Clients MUST respond appropriately to HTTP 401 responses
              • Authorization MUST be included in every HTTP request

              Scenarios to Cover

              Positive Tests

              1. Client correctly uses scope from WWW-Authenticate header
              2. Client falls back to scopes_supported when scope not in header
              3. Client handles HTTP 403 with insufficient_scope error
              4. Client performs step-up authorization flow successfully
              5. Client handles 401 on non-initialize requests

              Negative Tests

              1. Client fails to include scope from WWW-Authenticate header
              2. Client requests excessive scopes beyond what's needed
              3. Client doesn't retry after insufficient_scope error
              4. Client enters infinite retry loop on scope challenges
              5. Client fails to handle 401 on non-initialize requests

              Implementation Notes

              • Register spec references in src/scenarios/client/auth/spec-references.ts
              • Build on existing auth scenarios in src/scenarios/client/auth/
              • Follow patterns from basic-dcr.ts and basic-metadata.ts
              • Include at least one negative test scenario per requirement

              Acceptance Criteria

              • Test scenarios cover scope selection strategy per spec
              • Test scenarios cover scope challenge handling per spec
              • Tests validate 401 response handling on non-initialize requests
              • Tests verify client can complete scope challenge flow
              • At least one negative test included for each major requirement
              • Spec references registered in check definitions file
              • All checks properly documented and follow existing patterns

              Activity

              Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

              Metadata

              Metadata

              Assignees

              No one assigned

                Labels

                No labels
                No labels

                Type

                No type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions

                  , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
                  Skip to content

                  Client Auth: Scope Selection & Challenge Handling #32

                  Description

                  @pcarleton

                  Overview

                  Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

                  Specification References

                  Key Requirements from Specification

                  Scope Selection (SHOULD)

                  • Clients SHOULD follow principle of least privilege
                  • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
                  • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
                  • Omit scope parameter if scopes_supported is undefined

                  Scope Challenge Handling

                  • Servers SHOULD respond with HTTP 403 for insufficient scope errors
                  • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
                  • Servers SHOULD include scope parameter with required scopes
                  • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
                  • Clients SHOULD implement retry limits for scope upgrade attempts

                  401 Handling on Non-Initialize (MUST)

                  • Clients MUST parse WWW-Authenticate headers
                  • Clients MUST respond appropriately to HTTP 401 responses
                  • Authorization MUST be included in every HTTP request

                  Scenarios to Cover

                  Positive Tests

                  1. Client correctly uses scope from WWW-Authenticate header
                  2. Client falls back to scopes_supported when scope not in header
                  3. Client handles HTTP 403 with insufficient_scope error
                  4. Client performs step-up authorization flow successfully
                  5. Client handles 401 on non-initialize requests

                  Negative Tests

                  1. Client fails to include scope from WWW-Authenticate header
                  2. Client requests excessive scopes beyond what's needed
                  3. Client doesn't retry after insufficient_scope error
                  4. Client enters infinite retry loop on scope challenges
                  5. Client fails to handle 401 on non-initialize requests

                  Implementation Notes

                  • Register spec references in src/scenarios/client/auth/spec-references.ts
                  • Build on existing auth scenarios in src/scenarios/client/auth/
                  • Follow patterns from basic-dcr.ts and basic-metadata.ts
                  • Include at least one negative test scenario per requirement

                  Acceptance Criteria

                  • Test scenarios cover scope selection strategy per spec
                  • Test scenarios cover scope challenge handling per spec
                  • Tests validate 401 response handling on non-initialize requests
                  • Tests verify client can complete scope challenge flow
                  • At least one negative test included for each major requirement
                  • Spec references registered in check definitions file
                  • All checks properly documented and follow existing patterns

                  Activity

                  Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

                  Metadata

                  Metadata

                  Assignees

                  No one assigned

                    Labels

                    No labels
                    No labels

                    Type

                    No type

                    Projects

                    No projects

                      Milestone

                      No milestone

                      Relationships

                      None yet

                      Development

                      No branches or pull requests

                      Issue actions

                      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                      Skip to content

                      Client Auth: Scope Selection & Challenge Handling #32

                      Description

                      @pcarleton

                      Overview

                      Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

                      Specification References

                      Key Requirements from Specification

                      Scope Selection (SHOULD)

                      • Clients SHOULD follow principle of least privilege
                      • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
                      • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
                      • Omit scope parameter if scopes_supported is undefined

                      Scope Challenge Handling

                      • Servers SHOULD respond with HTTP 403 for insufficient scope errors
                      • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
                      • Servers SHOULD include scope parameter with required scopes
                      • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
                      • Clients SHOULD implement retry limits for scope upgrade attempts

                      401 Handling on Non-Initialize (MUST)

                      • Clients MUST parse WWW-Authenticate headers
                      • Clients MUST respond appropriately to HTTP 401 responses
                      • Authorization MUST be included in every HTTP request

                      Scenarios to Cover

                      Positive Tests

                      1. Client correctly uses scope from WWW-Authenticate header
                      2. Client falls back to scopes_supported when scope not in header
                      3. Client handles HTTP 403 with insufficient_scope error
                      4. Client performs step-up authorization flow successfully
                      5. Client handles 401 on non-initialize requests

                      Negative Tests

                      1. Client fails to include scope from WWW-Authenticate header
                      2. Client requests excessive scopes beyond what's needed
                      3. Client doesn't retry after insufficient_scope error
                      4. Client enters infinite retry loop on scope challenges
                      5. Client fails to handle 401 on non-initialize requests

                      Implementation Notes

                      • Register spec references in src/scenarios/client/auth/spec-references.ts
                      • Build on existing auth scenarios in src/scenarios/client/auth/
                      • Follow patterns from basic-dcr.ts and basic-metadata.ts
                      • Include at least one negative test scenario per requirement

                      Acceptance Criteria

                      • Test scenarios cover scope selection strategy per spec
                      • Test scenarios cover scope challenge handling per spec
                      • Tests validate 401 response handling on non-initialize requests
                      • Tests verify client can complete scope challenge flow
                      • At least one negative test included for each major requirement
                      • Spec references registered in check definitions file
                      • All checks properly documented and follow existing patterns

                      Activity

                      Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

                      Metadata

                      Metadata

                      Assignees

                      No one assigned

                        Labels

                        No labels
                        No labels

                        Type

                        No type

                        Projects

                        No projects

                          Milestone

                          No milestone

                          Relationships

                          None yet

                          Development

                          No branches or pull requests

                          Issue actions

                          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                          Skip to content

                          Client Auth: Scope Selection & Challenge Handling #32

                          Description

                          @pcarleton

                          Overview

                          Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

                          Specification References

                          Key Requirements from Specification

                          Scope Selection (SHOULD)

                          • Clients SHOULD follow principle of least privilege
                          • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
                          • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
                          • Omit scope parameter if scopes_supported is undefined

                          Scope Challenge Handling

                          • Servers SHOULD respond with HTTP 403 for insufficient scope errors
                          • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
                          • Servers SHOULD include scope parameter with required scopes
                          • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
                          • Clients SHOULD implement retry limits for scope upgrade attempts

                          401 Handling on Non-Initialize (MUST)

                          • Clients MUST parse WWW-Authenticate headers
                          • Clients MUST respond appropriately to HTTP 401 responses
                          • Authorization MUST be included in every HTTP request

                          Scenarios to Cover

                          Positive Tests

                          1. Client correctly uses scope from WWW-Authenticate header
                          2. Client falls back to scopes_supported when scope not in header
                          3. Client handles HTTP 403 with insufficient_scope error
                          4. Client performs step-up authorization flow successfully
                          5. Client handles 401 on non-initialize requests

                          Negative Tests

                          1. Client fails to include scope from WWW-Authenticate header
                          2. Client requests excessive scopes beyond what's needed
                          3. Client doesn't retry after insufficient_scope error
                          4. Client enters infinite retry loop on scope challenges
                          5. Client fails to handle 401 on non-initialize requests

                          Implementation Notes

                          • Register spec references in src/scenarios/client/auth/spec-references.ts
                          • Build on existing auth scenarios in src/scenarios/client/auth/
                          • Follow patterns from basic-dcr.ts and basic-metadata.ts
                          • Include at least one negative test scenario per requirement

                          Acceptance Criteria

                          • Test scenarios cover scope selection strategy per spec
                          • Test scenarios cover scope challenge handling per spec
                          • Tests validate 401 response handling on non-initialize requests
                          • Tests verify client can complete scope challenge flow
                          • At least one negative test included for each major requirement
                          • Spec references registered in check definitions file
                          • All checks properly documented and follow existing patterns

                          Activity

                          Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

                          Metadata

                          Metadata

                          Assignees

                          No one assigned

                            Labels

                            No labels
                            No labels

                            Type

                            No type

                            Projects

                            No projects

                              Milestone

                              No milestone

                              Relationships

                              None yet

                              Development

                              No branches or pull requests

                              Issue actions

                              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                              Skip to content

                              Client Auth: Scope Selection & Challenge Handling #32

                              Description

                              @pcarleton

                              Overview

                              Add conformance tests for OAuth scope selection strategies and scope challenge handling in client authentication flows.

                              Specification References

                              Key Requirements from Specification

                              Scope Selection (SHOULD)

                              • Clients SHOULD follow principle of least privilege
                              • Clients SHOULD use scope parameter from WWW-Authenticate header if provided
                              • If scope not available, use all scopes from scopes_supported in Protected Resource Metadata
                              • Omit scope parameter if scopes_supported is undefined

                              Scope Challenge Handling

                              • Servers SHOULD respond with HTTP 403 for insufficient scope errors
                              • Servers SHOULD include WWW-Authenticate header with error="insufficient_scope"
                              • Servers SHOULD include scope parameter with required scopes
                              • Clients SHOULD respond by requesting new token with increased scopes via step-up authorization
                              • Clients SHOULD implement retry limits for scope upgrade attempts

                              401 Handling on Non-Initialize (MUST)

                              • Clients MUST parse WWW-Authenticate headers
                              • Clients MUST respond appropriately to HTTP 401 responses
                              • Authorization MUST be included in every HTTP request

                              Scenarios to Cover

                              Positive Tests

                              1. Client correctly uses scope from WWW-Authenticate header
                              2. Client falls back to scopes_supported when scope not in header
                              3. Client handles HTTP 403 with insufficient_scope error
                              4. Client performs step-up authorization flow successfully
                              5. Client handles 401 on non-initialize requests

                              Negative Tests

                              1. Client fails to include scope from WWW-Authenticate header
                              2. Client requests excessive scopes beyond what's needed
                              3. Client doesn't retry after insufficient_scope error
                              4. Client enters infinite retry loop on scope challenges
                              5. Client fails to handle 401 on non-initialize requests

                              Implementation Notes

                              • Register spec references in src/scenarios/client/auth/spec-references.ts
                              • Build on existing auth scenarios in src/scenarios/client/auth/
                              • Follow patterns from basic-dcr.ts and basic-metadata.ts
                              • Include at least one negative test scenario per requirement

                              Acceptance Criteria

                              • Test scenarios cover scope selection strategy per spec
                              • Test scenarios cover scope challenge handling per spec
                              • Tests validate 401 response handling on non-initialize requests
                              • Tests verify client can complete scope challenge flow
                              • At least one negative test included for each major requirement
                              • Spec references registered in check definitions file
                              • All checks properly documented and follow existing patterns

                              Activity

                              Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

                              Metadata

                              Metadata

                              Assignees

                              No one assigned

                                Labels

                                No labels
                                No labels

                                Type

                                No type

                                Projects

                                No projects

                                  Milestone

                                  No milestone

                                  Relationships

                                  None yet

                                  Development

                                  No branches or pull requests

                                  Issue actions