Default OIDC and Google connections to openid email profile scopes

[JayaShakthi97]

Purpose

Connections created without an explicit scopes property only received the bare openid scope, even for OIDC and Google. This left the email and profile claims unavailable until an admin added them manually, even though the docs already describe openid email profile as the expected scopes for a Google connection.

Approach

Default OIDC and Google connections to openid email profile when no scopes are supplied, while still only ensuring openid is present when the caller provides their own scope list (existing scopes are never force-extended with email/profile). OAuth and GitHub connections are unaffected, since they don't use OIDC scopes.

Related Issues

• Fixes Default OIDC/Google connections to openid email profile scopes #4320

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Bug Fixes
  • OIDC and Google connections now default to the standard scopes: openid,email,profile when no scopes are provided.
  • Existing custom scopes are preserved, and required scope inclusion behavior is now aligned with the full default scope set.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e11967f-31f4-49d8-9f35-9e5a359b2a99

📥 Commits

Reviewing files that changed from the base of the PR and between cb1a43f and 641ed62.

📒 Files selected for processing (3)

• backend/internal/idp/constants.go
• backend/internal/idp/utils.go
• backend/internal/idp/utils_test.go

🚧 Files skipped from review as they are similar to previous changes (3)

• backend/internal/idp/constants.go
• backend/internal/idp/utils_test.go
• backend/internal/idp/utils.go

---

📝 Walkthrough

Walkthrough

OIDC and Google connections now use openid,email,profile when scopes are absent or empty. Tests update expectations for default, empty, and whitespace scope cases.

Changes

OIDC scope defaults

Layer / File(s)	Summary
Default scope handling and validation backend/internal/idp/constants.go, backend/internal/idp/utils.go, backend/internal/idp/utils_test.go	Adds the shared openid,email,profile default, applies it when scopes are missing or empty, and updates related tests to require the complete scope string.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: thamindudilshan

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: defaulting OIDC and Google connections to the expected scopes.
Description check	✅ Passed	The description follows the template and includes purpose, approach, related issues, checklist, and security checks.
Linked Issues check	✅ Passed	The changes implement #4320 by defaulting OIDC/Google scopes to openid,email,profile when none are provided.
Out of Scope Changes check	✅ Passed	The edits are limited to the scope-default logic and matching tests, with no unrelated changes introduced.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ThaminduDilshan]

Can we add email and profile for all the oidc providers or should it be only for known ones like Google?

[JayaShakthi97]

It is valid for Google and Custom OIDC providers and is gated by IdP type. When we are bringing new IdPs (not custom), we can update the gate to selectively provide default scopes to them.
Every mainstream OIDC platform supports these three, hence keeping for custom OIDC providers is fine IMO.