Release 2.2.1 - Oauth scopes review - #204

[david-ruiz-cko]

This release updates the OAuthScopes constants in the SDK to match the latest Checkout.com API specification. It adds missing scopes, removes deprecated ones, and ensures naming consistency with the API and other SDKs. The integration and test code is updated to use the correct, current scope constants, and new tests are added to verify completeness, uniqueness, and ordering of the scope constants.

OAuth Scopes synchronization and improvements:

• Added 23 missing OAuth scope constants to OAuthScopes, including entire scope families (e.g., card management, issuing, vault, compliance requests, payment sessions, and more), and ensured all constants are declared in alphabetical order. Deprecated scopes are removed, and comments clarify distinctions between similar scopes and document any specification oddities.
• Updated integration and test code to use new or renamed scope constants, such as replacing MARKETPLACE with ACCOUNTS, and CARD_METADATA with VAULT_CARD_METADATA, and removing deprecated issuing scopes in favor of the new ISSUING_CARD_MANAGEMENT_* constants. [1] [2] [3]

Testing and validation enhancements:

• Added comprehensive tests to ensure all documented scopes are exposed as constants, including those only referenced in per-operation security requirements, and that no wire value is duplicated across constants. Tests also verify that all constants are non-blank, declared in alphabetical order, and that the set of constants matches the source file.

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• no_low_class_matched
• prod_source_modified

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

This diff only shows the version bump from 2.2.0 to 2.2.1 in version.rb; the substantial OAuth scopes changes described in the PR body are not visible in the provided diff.

For you to decide

• The diff is partial — only version.rb is shown, so none of the claimed OAuthScopes constant additions/removals, test additions, or integration code updates can be verified against the stated intent.
• A human reviewer needs to confirm the full diff (OAuthScopes constants file, test files, integration code) is actually present in the PR and matches the description before approving the version bump.
• The version increment from 2.2.0 to 2.2.1 is consistent with a patch/minor release, which is appropriate if the changes are purely additive scope constants and renames with no breaking API surface changes — but that claim cannot be verified from this diff alone.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud