supabase / auth / 19426873690

Pull #2250

github

feat(oauthserver): add oauth scope support for oidc (#2253)

## Summary

This PR adds comprehensive OIDC scope support to the OAuth server
implementation, enabling proper scope-based access control and claim
filtering per the OpenID Connect Core specification.

## Changes:
- **Scope-based claim filtering**: Claims are only included in ID tokens
and UserInfo responses when the corresponding scope is granted
    - `openid` → `sub` (subject identifier)
    - `email` → `email`, `email_verified`
    - `profile` → `name`, `picture`, `preferred_username`, `updated_at`
    - `phone` → `phone_number`, `phone_number_verified`
- **Conditional ID token generation**: ID tokens are only generated when
the `openid` scope is requested

155 of 280 new or added lines in 11 files covered. (55.36%)

14163 of 20746 relevant lines covered (68.27%)

78.39 hits per line