4be33d00d2
League\OAuth2\Server\Exception\OAuthServerException with a status below 500 (invalid/missing/expired bearer tokens, invalid_grant, etc.) represents a client error, not an application failure, but Passport's TokenGuard explicitly calls report() on every failed bearer-token check. This was flooding Nightwatch with 401 noise from bots probing the public MCP endpoint. Actual server_error (500) responses are still reported.
26 lines
952 B
PHP
26 lines
952 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use Illuminate\Contracts\Debug\ExceptionHandler;
|
|
use League\OAuth2\Server\Exception\OAuthServerException;
|
|
|
|
test('client-error oauth exceptions are not reported', function () {
|
|
$handler = app(ExceptionHandler::class);
|
|
|
|
expect($handler->shouldReport(OAuthServerException::accessDenied()))->toBeFalse()
|
|
->and($handler->shouldReport(OAuthServerException::invalidGrant()))->toBeFalse()
|
|
->and($handler->shouldReport(OAuthServerException::invalidRequest('grant_type')))->toBeFalse();
|
|
});
|
|
|
|
test('server-error oauth exceptions are still reported', function () {
|
|
$handler = app(ExceptionHandler::class);
|
|
|
|
expect($handler->shouldReport(OAuthServerException::serverError('unexpected failure')))->toBeTrue();
|
|
});
|
|
|
|
test('unrelated exceptions are unaffected', function () {
|
|
$handler = app(ExceptionHandler::class);
|
|
|
|
expect($handler->shouldReport(new RuntimeException('boom')))->toBeTrue();
|
|
});
|