Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

test(oidc): unit-test the provider guards the core now precedes

The provider re-checks the response type and the nonce of every OpenID
request. The core now refuses those requests first: it bounds the nonce
of every request, and the provider serves no implicit flow, while a
handler built from Server() is not mounted for OpenID requests. So no
request reaches the two refusals any more. They stay as the provider's
own defense in depth and are now tested directly, as the package already
does for its token-response client check.

Audit: STORE-01, OAUTH-I4.