feature/INT-1697 - Oauth scopes review

[david-ruiz-cko]

This pull request updates the OAuthScopes constants in the SDK to match the latest Checkout.com API specification. It adds missing scopes, removes deprecated ones, and ensures naming consistency with the API and other SDKs. The integration and test code is updated to use the correct, current scope constants, and new tests are added to verify completeness, uniqueness, and ordering of the scope constants.

OAuth Scopes synchronization and improvements:

• Added 23 missing OAuth scope constants to OAuthScopes, including entire scope families (e.g., card management, issuing, vault, compliance requests, payment sessions, and more), and ensured all constants are declared in alphabetical order. Deprecated scopes are removed, and comments clarify distinctions between similar scopes and document any specification oddities.
• Updated integration and test code to use new or renamed scope constants, such as replacing MARKETPLACE with ACCOUNTS, and CARD_METADATA with VAULT_CARD_METADATA, and removing deprecated issuing scopes in favor of the new ISSUING_CARD_MANAGEMENT_* constants. [1] [2] [3]

Testing and validation enhancements:

• Added comprehensive tests to ensure all documented scopes are exposed as constants, including those only referenced in per-operation security requirements, and that no wire value is duplicated across constants. Tests also verify that all constants are non-blank, declared in alphabetical order, and that the set of constants matches the source file.

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/oauth_scopes.rb
• security_sensitive_path:spec/checkout_sdk/oauth_scopes_spec.rb

Operational gates

• ✅ jira_ticket (INT-1697)
• ✅ independent_review

Files analysed: 5

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/oauth_scopes.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — spec/checkout_sdk/oauth_scopes_spec.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

This PR synchronizes OAuthScopes constants with the current API spec, adds 23 missing scopes, retains 5 legacy scopes with documentation, and adds comprehensive tests. The change is technically well-executed, but a live production concern — whether replacing MARKETPLACE with ACCOUNTS in sandbox_test_fixture.rb is safe — requires operational verification.

For you to decide

• accounts_integration_spec.rb explicitly keeps MARKETPLACE because that payout-schedule client is provisioned for marketplace and rejects accounts with invalid_scope; sandbox_test_fixture.rb switches to ACCOUNTS in the same PR — if the same provisioning constraint applies to the clients used by other test fixtures this will break those integration tests in CI.
• VAULT_CARD_METADATA replaces CARD_METADATA in sandbox_test_fixture.rb; the wire value is stated to be unchanged, but the truncated diff means VAULT_CARD_METADATA's actual string value cannot be verified here — a reviewer should confirm it is still 'vault:card-metadata' in the full diff.
• ISSUING_DISPUTES has wire value 'issuing-disputes' (hyphen, no colon) while ISSUING_DISPUTES_READ/WRITE use 'issuing:disputes-read/write' (colon); this inconsistency looks intentional per spec but a reviewer should confirm it is not a typo in the constant definition.
• PAYMENT_CONTEXT = 'Payment Context' (space, capital letter) is flagged as a likely spec defect but mirrored verbatim — a reviewer should confirm whether the live authorization server actually accepts this value before it gets used in production calls.
• The issuing_helper.rb change drops ISSUING_CLIENT and ISSUING_CARD_MGMT in favour of ISSUING_CARD_MANAGEMENT_READ/WRITE; if the sandbox issuing client is not yet provisioned for the new scopes, every issuing integration test will fail until reprovisioning occurs.
• The alphabetical-order and completeness tests that enumerate constants via reflection are a strong correctness guardrail and look correct from what is visible.

⚠️ The diff was too large to read in full, so this review covers only part of the change.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/oauth_scopes.rb
• security_sensitive_path:spec/checkout_sdk/oauth_scopes_spec.rb

Operational gates

• ✅ jira_ticket (INT-1697)
• ✅ independent_review

Files analysed: 5

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/oauth_scopes.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — spec/checkout_sdk/oauth_scopes_spec.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/oauth_scopes.rb
• security_sensitive_path:spec/checkout_sdk/oauth_scopes_spec.rb

Operational gates

• ✅ jira_ticket (INT-1697)
• ✅ independent_review

Files analysed: 5

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/oauth_scopes.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — spec/checkout_sdk/oauth_scopes_spec.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/oauth_scopes.rb
• security_sensitive_path:spec/checkout_sdk/oauth_scopes_spec.rb

Operational gates

• ✅ jira_ticket (INT-1697)
• ✅ independent_review

Files analysed: 5

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/oauth_scopes.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — spec/checkout_sdk/oauth_scopes_spec.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud