Token introspection verification & integration tests

[stevenvegt]

Parent PRD

#4144

Implementation Spec

Overview

Final PR in the mixed OAuth2 scopes feature. Adds end-to-end integration tests that exercise the dynamic scope policy path with a real AuthZen HTTP client (via httptest.NewServer), validating the full HTTP roundtrip that mock-based unit tests skip over.

No production code changes.

Key files

• auth/api/iam/integration_test.go (new) — E2E integration tests for dynamic scope policy

Design decisions

Scope narrowed during self-review. The spec suggested a broad set of integration tests covering all scope policies and introspection behavior. On review, many would duplicate existing unit tests or test trivial pointer pass-through. The final test suite is focused on what actually requires integration:

• Real HTTP roundtrip for dynamic scope policy — exercises request serialization, response parsing, and end-to-end wiring that mock-based unit tests don't reach.
• Security-critical path — PDP denying the credential profile scope over real HTTP.

Tests explicitly not included (and why):

• HTTP 500 / network errors — already covered by policy/authzen/client_test.go
• Profile-only / passthrough integration — already covered by s2s_vptoken_test.go unit tests
• Multi-scope introspection — introspection is Scope: &token.Scope (pointer pass-through); no multi-scope logic exists
• Backwards compatibility — no version-specific code path to test

Tests added

TestIntegration_DynamicScopePolicy_AuthZenEndToEnd — uses real authzen.Client pointing at httptest.NewServer:

1. PDP approves all scopes — asserts the token contains all scopes AND that the HTTP request body had the correct shape over the wire (subject.type=organization, action.name=request_scope, context.policy, ordered evaluations)
2. PDP partial denial — denied scopes excluded from the token
3. PDP denies credential profile scope — request rejected with access_denied, no token issued

Deviations from original spec

• Dropped 6 proposed test cases as duplicative or trivial (see design decisions)
• Added access_denied integration test (originally not in spec but identified as security-critical during review)
• Consolidated to 3 focused tests instead of 6

Acceptance Criteria

• Integration tests cover the dynamic scope policy end-to-end (real HTTP)
• Security-critical paths (access_denied) validated over real HTTP
• Request serialization verified on the wire
• No production code changes needed (confirmed: introspection passes token.Scope through unchanged)
• Multi-scope introspection tests — dropped: no multi-scope-specific code exists to test
• Profile-only/passthrough integration tests — dropped: covered by existing unit tests

[qltysh]

Coverage Impact

⬇️ Merging this pull request will decrease total coverage on 4144-4-server-side-flow by 0.01%.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.