byjp.me / quickslice
forked from slices.network/quickslice
Auto-indexing service and GraphQL API for AT Protocol Records
fork atom

fix(oauth): correct test expectation for invalid scope error handling

Per OAuth 2.0 spec (RFC 6749 Section 4.1.2.1), once redirect_uri is
validated, errors like invalid scope should redirect to the client
rather than return HTTP 400.

chadtmiller.com 66d69e8b 47f2d32f

+4 -3
unified split
+4 -3
server/test/oauth/authorize_test.gleam
··· 30 30 response.status |> should.equal(400) 31 31 } 32 32 33 - pub fn authorize_invalid_scope_returns_400_test() { 33 + pub fn authorize_invalid_scope_redirects_with_error_test() { 34 34 let assert Ok(cache) = did_cache.start() 35 35 let assert Ok(conn) = sqlight.open(":memory:") 36 36 let assert Ok(_) = tables.create_oauth_client_table(conn) ··· 76 76 None, 77 77 ) 78 78 79 - // Should return 400 due to invalid scope format 80 - response.status |> should.equal(400) 79 + // Per OAuth 2.0 spec (RFC 6749 Section 4.1.2.1), once redirect_uri is validated, 80 + // errors should be redirected to the client, not returned as 400 81 + response.status |> should.equal(303) 81 82 }