#913 Support RFC 8693 (OAuth 2.0 Token Exchange) for the "scope" claim in ScopesAuthorizer

[mehyaa]

Fixes #913

• AllowedScopes does not match string array in JWT scope claim #913

Scopes can be a space separated list in a single claim. Include this possibility on allowed scopes check.

Proposed Changes

• Split user scopes if scope claim value is a single space-separated claim

[mehyaa]

The build is broken, it fails on irrelevant part from this PR. #1436 fixes is I think.

[PatrickDelancy]

This is still an issue. Adding my 👍 to get this small and valuable PR merged.

[raman-m]

Mehmet,
Thanks for resolving of merge conflicts!

Unfortunately the last build is failed: 5 acceptance tests have failed!

Why is your PR code so unstable?

[mehyaa]

I haven't found out the reason why the tests failed with a quick look. I couldn't figure out the tests structure. When I have time I'll look into it.

[raman-m]

@mehyaa
The feature branch has been rebased onto ThreeMammals:develop successfully!
The build has failed with 5 tests!
Code review will start after fixing of these failed tests.
Also, some new tests should cover your proposed changes in the ScopesAuthorizer class.

Could you add me as collaborator to your forked repo please? I will fix develop branch because now it has the diff, but both develop branches should be identical.

[mehyaa]

@raman-m I've fixed the tests. Failing tests were written for the bug that requires one of allowed scopes. I've changed the claims and allowed scopes on tests so they can test the correct conditions.

For adding new tests to test ScopesAuthorizer, the current tests seem pretty sufficient.

[mehyaa]

@raman-m I've added you as collaborator on my fork, you can fix the diff or guide me to how-to.

[mehyaa]

Interestingly some irrelevant tests fail irregularly.

[raman-m]

@mehyaa commented on Sep 14, 11:38 AM

Thanks for fixing of failed tests!

---

For adding new tests to test ScopesAuthorizer, the current tests seem pretty sufficient.

No, at least one new test should cover claims logic having them multiple in the related config property.
Simultaneously, we should update current tests to be green. Because each test covers specific atomic feature.

Come on! We've changed the logic from single Scope to multiple ones! And it is definitely right time to cover these changes.

I have idea: let's write tests for each linked issue:

• a test for AllowedScopes does not match string array in JWT scope claim #913 where you can ask @fsmullinslc to help you
• a test for Switching between a scope's matching strategies #1066 where you can ask @papugamichal to help you

Sounds good?

[raman-m]

@mehyaa commented on Sep 15

Don't worry! This is unstable scenario: Ocelot.AcceptanceTests.ConfigurationReloadTests.should_reload_config_on_change
The next run fixes the build usually.
Truly speaking, I am tired of this test too. I will create bug issue soon for this test.

[raman-m]

@mehyaa
Why not to continue working? Firstly resolving all merge conflicts and merging from develop...

[raman-m]

TO: @mehyaa

Mehmet,
Why did you include tests that are failing?

You wrote the tests with the help of AI but didn’t review them manually in the IDE. The tests failed, and it might surprise you that this is also a violation of the development process, as all AI-generated code must be double-checked, which you didn’t do.

What are you doing in our repo? If this is meant as a contribution to the product, I would prefer not to have it, as it feels like a waste of time.
The next step is to fix the tests, as they seem incomplete or the feature might not be functioning as expected.

🟥 Red card penalty❗

You have received a red card for using AI tools. It appears that you and/or the engineers at your company, where you serve as CTO or Lead Engineer, are utilizing AI tools for JavaScript website development. AI vibe-coding approach does not work well with the Ocelot .NET product, as every small detail is crucial.

P.S. A red card means that if you continue using AI tools to push commits or open new PRs with a help of AI in our repo, your account will be banned. This is the official notice!

CC: @ggnaegi @RaynaldM

[raman-m]

Why are there 18 commits for a single file 10-lines change along with 2 test files?
It might be worth rebasing the feature branch onto develop.

[mehyaa]

TO: @mehyaa

Mehmet, Why did you include tests that are failing? You wrote the tests with the help of AI but didn’t review them manually in the IDE. The tests failed, and it might surprise you that this is also a violation of the development process, as all AI-generated code must be double-checked, which you didn’t do.

What are you doing in our repo? If this is meant as a contribution to the product, I would prefer not to have it, as it feels like a waste of time. The next step is to fix the tests, as they seem incomplete or the feature might not be functioning as expected.

🟥 Red card penalty❗

You have received a red card for using AI tools. It appears that you and/or the engineers at your company, where you serve as CTO or Lead Engineer, are utilizing AI tools for JavaScript website development. AI vibe-coding approach does not work well with the Ocelot .NET product, as every small detail is crucial.

P.S. A red card means that if you continue using AI tools to push commits or open new PRs with a help of AI in our repo, your account will be banned. This is the official notice!

CC: @ggnaegi @RaynaldM

I give up.

I just wanted to fix a bug in the product that I've already fixed in my own implementation. I don't strictly need the fix to be merged, thanks to the flexibility of the project (being able to register your own implementation).

I added the tests manually at first, but the codebase changed dramatically over time. My merge attempts failed, and you had to take over the branch, after which the PR went stale. When I recently returned to finish this work, I implemented the tests with Copilot, verified them, and pushed. However, in the meantime, the acceptance test structure was refactored again, making the PR unmergeable.

I tried fixing the tests manually to match the existing ones so I could build, but I couldn't make them pass (the token endpoint returns 404). I suspected my environment, so I wanted to see the results in the actions; that is why I pushed it.

I know I may not have followed your exact workflow, so you have every right to criticize. I have no intention of bloating or breaking your product; I like and use Ocelot. My sole intention was to fix a minor bug. If my work isn't suitable, I'm stepping away from it plain and simple, with no hard feelings.

Sorry for taking up your time. Thank you and all the contributors for this great product.

[raman-m]

Don't give up! As a CTO and IT manager, you know that software development is an iterative process.

I like and use Ocelot. My sole intention was to fix a minor bug.

This is the goal! If you really want to enhance Ocelot, please address my code review issues, fix the tests, and then the PR will reach over 75% Dev Complete readiness. The remaining work, such as code polishing and updating documentation, is my responsibility.

[raman-m]

Since this is a bug-fixing PR and you want to give up, but I don't want you to, I've decided to include it in the next .NET 10 release due to its bug-fixing nature.
I'll revisit this PR once the .NET 10 milestone begins.

[ggnaegi]

Why userScopes.Count == 1 ?

[mehyaa]

Why userScopes.Count == 1 ?

That will be a error if a provider supplied scope claim as an array that some of the values are space-separated.

[raman-m]

I like this, guys! Let's close the PR and open once again 🤣

[raman-m]

Oops, I've changed my mind. I forgot that PR is now part of the .NET 10 milestone.

[mehyaa]

@raman-m the last close/open was by mistake, my bad.

I've figured out the acceptance tests' problem, the token server was misconfigured. I've added a fix there too. You need to review.

On my machine Http20CLient_DirectConnection_ShouldConnect test keeps failing but it seem nothing to do with my changes and I didn't see the test in recent actions as well. Can you look into it?

The tests are passing now.

[ggnaegi]

Why userScopes.Count == 1 ?

That will be a error if a provider supplied scope claim as an array that some of the values are space-separated.

@mehyaa could you just comment this in code please. It's fine for me and i will approve your PR.

[mehyaa]

Why userScopes.Count == 1 ?

That will be a error if a provider supplied scope claim as an array that some of the values are space-separated.

@mehyaa could you just comment this in code please. It's fine for me and i will approve your PR.

Added a comment to the code.

[raman-m]

The code looks much better now, with some minor but valuable suggestions noted below.

It seems acceptance testing is complete, and I will review unit testing and code coverage later.

[raman-m]

Ready for delivery ✅

• Code review ✔️ ✔️
• Unit testing ✔️ ✔️
• Acceptance testing ✔️
• Updated docs ✔️

[raman-m]

@mehyaa Congrats, Mehmet! 🥳
After more than 4 years, we finally made it!
This is your first contribution to the project, and we truly appreciate it 👍
Thanks for being available online this weekend.