Add integration test for default audience without resource parameter#4818
Add integration test for default audience without resource parameter#4818
Conversation
The fix in #4805 defaults the aud claim to the sole AllowedAudiences entry when clients omit the RFC 8707 resource parameter, but only included unit tests. Add an end-to-end integration test that verifies the full OAuth flow (authorize -> callback -> token exchange -> JWT validation) produces the correct audience when resource is omitted. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — clean integration test following existing patterns.
Extended reasoning...
Overview
Single new test function added to . No production code is changed.
Security risks
None. This is a test-only change; it exercises an existing code path (default audience selection when the RFC 8707 resource parameter is omitted) without introducing any new logic or external surface area.
Level of scrutiny
Low. The change is purely additive, follows the established pattern of every other TestIntegration_FullPKCEFlow* test in the file (same helpers, same JWT-parsing approach, same assertion style), and the exchangeCodeForTokens helper already had the //nolint:unparam annotation to accommodate callers that pass an empty resource string.
Other factors
No existing reviewer comments outstanding. No CODEOWNER-sensitive files touched. The test directly validates the fix from PR #4805 (empty aud claim regression) as described.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4818 +/- ##
==========================================
- Coverage 69.09% 69.05% -0.04%
==========================================
Files 530 530
Lines 55375 55375
==========================================
- Hits 38260 38240 -20
- Misses 14172 14191 +19
- Partials 2943 2944 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
2 participants
Summary
PR #4805 fixed the empty
audclaim when clients omit the RFC 8707resourceparameter, but only included unit tests. This adds an end-to-end integration test that verifies the full OAuth flow (authorize -> callback -> token exchange -> JWT validation) produces the correct audience whenresourceis omitted and the server has a single allowed audience.Follows up on #4805 / Fixes #4794 (test coverage gap).
Type of change
Test plan
TestIntegration_FullPKCEFlow_DefaultAudiencepassesTestIntegration_FullPKCEFlow*tests still passtask lint-fixcleanGenerated with Claude Code