suaveplan/openspec/changes/enterprise-testing-contract/specs/oauth-client/spec.md

ADDED Requirements

Requirement: Consumer-side pact recording

The @suaveplan/oauth-client package SHALL ship a oauth-client.contract.test.ts that uses recordPactInteraction from @suaveplan/testing-contract to record at minimum the following interactions against any conforming OAuth 2.0 / OIDC provider: OIDC discovery (GET /.well-known/openid-configuration), Authorization Code token exchange (POST /token with grant_type=authorization_code), Client Credentials token exchange (POST /token with grant_type=client_credentials), token refresh (POST /token with grant_type=refresh_token). The resulting pact file MUST be committed to pacts/oauth-client__oidc-issuer.json.

Scenario: Pact file committed

• WHEN the consumer-side test suite runs
• THEN pacts/oauth-client__oidc-issuer.json is produced AND its interactions[] covers discovery, authorization-code exchange, client-credentials exchange, and refresh

Scenario: Wire-format drift is reviewable

• WHEN an oauth-client change alters a request body field name
• THEN the diff against pacts/oauth-client__oidc-issuer.json is non-empty AND surfaces in PR review

Requirement: Injectable fetch surfaces pact wrapping

The package's public functions accepting { fetch?: FetchLike } SHALL accept the recordPactInteraction(fetch) wrapper without requiring any public-API change.

Scenario: Wrapped fetch records all token endpoint traffic

• WHEN the consumer test wraps the package's injectable fetch via recordPactInteraction AND drives an Authorization Code exchange
• THEN every request the package issues is captured into the pact file