feat: oauth2 scopes for authentication

[SoulPancake]

Description

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

• Documentation

  • Clarified OAuth2 Client Credentials configuration requirements, specifying that apiAudience and scopes are optional parameters while apiTokenIssuer must be the full token endpoint URL.

• Changes

  • Updated credential validation to make apiAudience optional.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9f1a8f64-b99f-4859-aff8-52ecc04b7791

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This pull request makes the apiAudience parameter optional in OAuth2 client credentials configuration. The validation logic in ClientCredentials.assertValid() was relaxed to no longer require apiAudience, while documentation was updated to clarify the supported OAuth2 client credentials flow and parameter expectations.

Changes

Cohort / File(s)	Summary
Documentation README.md	Updated OAuth2 credentials section header and added descriptive paragraph clarifying parameter requirements; noted that apiAudience is optional and apiTokenIssuer must be the full token endpoint URL.
Implementation src/main/java/dev/openfga/sdk/api/configuration/ClientCredentials.java	Removed validation assertion requiring apiAudience to be present, making it optional while keeping clientId, clientSecret, and apiTokenIssuer as required.
Tests src/test/java/dev/openfga/sdk/api/configuration/ClientCredentialsTest.java	Added two new test cases: one verifying assertValid() succeeds when apiAudience is null, and another verifying assertValid() succeeds with scopes parameter.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• rhamzeh
• jimmyjames

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: oauth2 scopes for authentication' directly reflects the main change—making OAuth2 scopes optional for authentication and updating related documentation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/oauth2-scopes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.09%. Comparing base (2565cc8) to head (4bf791a).

❌ Your project status has failed because the head coverage (38.09%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #326      +/-   ##
============================================
+ Coverage     38.05%   38.09%   +0.03%     
- Complexity     1259     1261       +2     
============================================
  Files           198      198              
  Lines          7646     7645       -1     
  Branches        885      885              
============================================
+ Hits           2910     2912       +2     
+ Misses         4598     4595       -3     
  Partials        138      138              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rhamzeh]

We generally use abc.fga.example for all URLs

• Consistent
• We're sure it will never resolve

[coderabbitai]

🧹 Nitpick comments (1)

README.md (1)

211-213: Clarify optionality in the first client-credentials sample.

Line 225 documents apiAudience as optional, but Line 212 in the first example reads as required. Consider adding an inline “optional” note there to avoid mixed signals across sections.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` around lines 211 - 213, The first client-credentials example shows
.apiAudience(...) inline without indicating it's optional; update that sample to
mark apiAudience as optional (e.g., append " (optional)" to the .apiAudience
call or its comment) so it matches the later documentation that apiAudience is
optional and avoids conflicting signals—ensure the change is applied to the
example lines containing .apiTokenIssuer, .apiAudience, and .clientId.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@README.md`:
- Around line 211-213: The first client-credentials example shows
.apiAudience(...) inline without indicating it's optional; update that sample to
mark apiAudience as optional (e.g., append " (optional)" to the .apiAudience
call or its comment) so it matches the later documentation that apiAudience is
optional and avoids conflicting signals—ensure the change is applied to the
example lines containing .apiTokenIssuer, .apiAudience, and .clientId.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3992b200-a74f-4f2a-bfc3-38aea84f33c2

📥 Commits

Reviewing files that changed from the base of the PR and between 2565cc8 and 56d908b.

📒 Files selected for processing (3)

• README.md
• src/main/java/dev/openfga/sdk/api/configuration/ClientCredentials.java
• src/test/java/dev/openfga/sdk/api/configuration/ClientCredentialsTest.java

💤 Files with no reviewable changes (1)

• src/main/java/dev/openfga/sdk/api/configuration/ClientCredentials.java

[Copilot]

Pull request overview

Adds support/documentation for OAuth2 client-credentials scopes and relaxes validation to allow OAuth2 providers where audience is optional, aligning SDK configuration with standard OAuth2 behavior.

Changes:

• Make apiAudience optional in ClientCredentials.assertValid().
• Add tests covering missing apiAudience and providing scopes.
• Update README OAuth2 client-credentials documentation and examples (including clarifying apiTokenIssuer).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/main/java/dev/openfga/sdk/api/configuration/ClientCredentials.java	Removes required validation for apiAudience during client-credentials validation.
src/test/java/dev/openfga/sdk/api/configuration/ClientCredentialsTest.java	Adds test cases for optional apiAudience and for setting scopes.
README.md	Updates OAuth2 client-credentials section and examples, including issuer/scopes guidance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rhamzeh]

Sorry - very minor