### Question:
AuthorizationServer { public String issueAuthorizationCode(HttpRequest req) throws OAuthException { AuthRequest authRequest = new AuthRequest(req); log.debug("received client_id:" + authRequest.getClientId()); ClientCredentials activeClientCredentials = getActiveClientCredentials(authRequest.getClientId()); if (activeClientCredentials == null) { throw new OAuthException(Response.INVALID_CLIENT_ID, HttpResponseStatus.BAD_REQUEST); } authRequest.validate(); String scope = scopeService.getValidScope(authRequest.getScope(), authRequest.getClientId()); if (scope == null) { throw new OAuthException(Response.SCOPE_NOK_MESSAGE, HttpResponseStatus.BAD_REQUEST); } AuthCode authCode = new AuthCode(generateCode(), authRequest.getClientId(), authRequest.getRedirectUri(), authRequest.getState(), scope, authRequest.getResponseType(), authRequest.getUserId()); log.debug("authCode: {}", authCode.getCode()); db.storeAuthCode(authCode); String redirectUri = authRequest.getRedirectUri(); if (redirectUri == null) { redirectUri = activeClientCredentials.getUri(); } QueryStringEncoder enc = new QueryStringEncoder(redirectUri); enc.addParam("code", authCode.getCode()); if(authCode.getState()!=null){ enc.addParam("state", authCode.getState()); } return enc.toString(); }  ClientCredentials issueClientCredentials(HttpRequest req); String issueAuthorizationCode(HttpRequest req); AccessToken issueAccessToken(HttpRequest req); static String [] getBasicAuthorizationClientCredentials(HttpRequest req); AccessToken isValidToken(String token); ApplicationInfo getApplicationInfo(String clientId); boolean revokeUserAccessTokens(HttpRequest req); boolean revokeToken(HttpRequest req); boolean updateClientApp(HttpRequest req, String clientId);  }### Answer:
@Test public void when_issue_auth_code_with_invalid_scope_return_error() throws Exception { HttpRequest req = mock(HttpRequest.class); String clientId = "203598599234220"; String scope = "nonexist"; ClientCredentials client = mock(ClientCredentials.class); given(client.getStatus()).willReturn(ClientCredentials.ACTIVE_STATUS); given(authServer.db.findClientCredentials(clientId)).willReturn(client); given(req.getUri()) .willReturn( "http: + clientId + "&scope=" + scope); willReturn(null).given(authServer.scopeService).getValidScope(scope, clientId); String errorMsg = null; Integer httpStatus = null; try { authServer.issueAuthorizationCode(req); } catch (OAuthException e) { errorMsg = e.getMessage(); httpStatus = e.getHttpStatus().getCode(); } assertEquals(errorMsg, Response.SCOPE_NOK_MESSAGE); assertTrue(httpStatus == HttpStatus.SC_BAD_REQUEST); }
@Test public void when_client_id_not_registered_return_error_invalid_client_id() { HttpRequest req = mock(HttpRequest.class); HttpResponseStatus status = null; String message = null; try { authServer.issueAuthorizationCode(req); } catch (OAuthException e) { status = e.getHttpStatus(); message = e.getMessage(); } assertEquals(status, HttpResponseStatus.BAD_REQUEST); assertEquals(message, Response.INVALID_CLIENT_ID); }