[RaphaelFakhri]

Changes

OidcUtils.includeRequiredScope appends openid when the requested scope does not contain it. It lowercased every scope to run that check and then built the result from the lowercased list, so a scope such as profile read:Messages became profile read:messages openid. Scope values are case-sensitive, so mixed-case API permissions were requested under a different name and not granted.

This change runs the case-insensitive openid check without modifying the scopes, and appends openid to the scopes as the caller passed them. Requests that already include openid are unchanged.

No public classes or methods are added, removed or changed. The fix applies to every caller of includeRequiredScope: ParameterBuilder.setScope, Request.addParameter/addParameters with a scope value, and WebAuthProvider.login(...).withScope(...).

References

• Issue: Requested scopes are lowercased when the SDK appends the openid scope #1101
• RFC 6749, section 3.3: scope strings are case-sensitive.

Testing

ParameterBuilderTest.shouldKeepScopeCaseWhenAddingRequiredScope sets profile read:Messages and asserts the result is profile read:Messages openid. The test fails on main (profile read:messages openid) and passes with this change.

./gradlew :auth0:testReleaseUnitTest --tests "com.auth0.android.authentication.ParameterBuilderTest"
./gradlew :auth0:testReleaseUnitTest :auth0:lintRelease

• This change adds unit test coverage

• This change adds integration test coverage

• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines

• I have read the Auth0 Code of Conduct

• All existing and new tests complete without errors

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of the required openid scope when scopes use varying capitalization.
  • Preserved the original capitalization of existing scopes while appending openid when needed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ee9d51e-e41e-48c9-990f-d559833b5753

📥 Commits

Reviewing files that changed from the base of the PR and between acf4068 and 2136bf2.

📒 Files selected for processing: 2

• auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt
• auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

includeRequiredScope now checks for openid without lowercasing existing scopes. A test verifies that adding the required scope preserves the casing of the original scopes.

Changes: Scope casing

Layer / File(s)	Summary
Required scope check and test auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt, auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java	The required-scope check uses a case-insensitive comparison without lowercasing the parsed scopes. The test verifies that profile read:Messages remains unchanged when openid is appended.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Possibly related issues

• Auth0.Android issue 1101 describes the scope-casing behavior addressed here: existing scope values retain their casing when openid is appended.

Suggested reviewers: lbalmaceda

Merge Risk: ⚪ Minimal · up to 2136b

No actionable merge-blocking risk remains.

Security architecture risk: ⚪ Minimal · up to 2136b

The fix preserves caller-requested permission names without adding an entrypoint or weakening request controls. The previous implementation already allowed the same mixed-case permissions when callers included openid. No material security risk introduced or worsened by this change was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The effective change is confined to existing helper consumers receiving mixed-case scopes without an openid match. Such requests can now name the intended case-sensitive permission rather than a lowercased permission; this changes requested permission identity, not the caller's authority to choose scope strings.

Security Findings and Attack Paths

• inferred — No new scope-based authorization bypass is established by the change. Before this PR, a caller could already produce the same mixed-case scope request by including openid explicitly, causing the helper to return the string unchanged.

Trust Boundaries and Controls

• observed — The inspected request path retains validation before network execution. Scope processing still writes only request parameters; it does not select a destination or replace the networking client.

Resilience and Maintainability Implications

• inferred — The transformation remains synchronous, side-effect-free and idempotent. Direct callers compute its result before updating their parameter storage, and map-based insertion first copies the input map. The change introduces no additional partial-write interval, persistence transition or recovery protocol.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: preserving scope casing when appending the required openid scope.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}