fix(diff-scope): authoriz/authenticat mid-word and a leading oauth are auth paths (granted fix round, GST-1065)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

bin/gstack-diff-scope

@@ -129,17 +129,19 @@ _session_data() {
 }
 
 # An auth path holds a token, split the way lib/review-risk.ts tokens() splits
-# paths (camelCase, then every non-alphanumeric run), that starts or ends with
-# auth (GST-1065): auth.ts, /auth/, authn, authz, auth0, authguard, oauth,
-# basicauth, nextauth, oauth2 and authorize match; a token starting with author
-# (author-spec.md, AUTHORS, authority.ts) does not unless it is authoriz*.
+# paths (camelCase, then every non-alphanumeric run), that names auth
+# (GST-1065): authoriz or authenticat anywhere in it (unauthenticated,
+# deauthorize), oauth at its start (oauth2client), or auth at its start or end
+# (auth.ts, /auth/, authn, authz, auth0, basicauth, nextauth). A token starting
+# with author (author-spec.md, AUTHORS, authority.ts) is not auth, and oauth
+# inside a word (coauthors) is not either.
 _auth_path() {
   local s="$1" t r=1
   while [[ "$s" =~ ^(.*[a-z0-9])([A-Z].*)$ ]]; do s="${BASH_REMATCH[1]} ${BASH_REMATCH[2]}"; done
   shopt -s nocasematch
   for t in ${s//[^a-zA-Z0-9]/ }; do
     case "$t" in
-      authoriz*|oauth2) r=0; break ;;
+      *authoriz*|*authenticat*|oauth*) r=0; break ;;
       author*) ;;
       auth*|*auth) r=0; break ;;
     esac

test/diff-scope.test.ts

@@ -237,7 +237,8 @@ describe('gstack-diff-scope', () => {
   //   why_new=GST-1065 and its review (the first word-only matcher dropped glued tokens the old glob caught); seam=bin/gstack-diff-scope
   for (const file of ['src/auth.ts', 'app/auth/login.rb', 'lib/oauth.ts', 'src/oauth2/token.ts', 'lib/authn/check.go', 'src/authz.py', 'src/authService.ts',
     'src/useAuth.ts', 'lib/OAuthClient.ts', 'lib/authentication.rb', 'lib/authorization_policy.rb', 'src/Authorize.tsx', 'config/AUTH_KEYS.md', 'pkg/auth-middleware.go',
-    'lib/auth0.ts', 'src/basicauth.go', 'src/authguard.ts', 'lib/reauth.ts', 'pages/api/nextauth.ts', 'src/authtoken.ts', 'lib/preauth.rb', 'src/HTTPAuth.ts']) {
+    'lib/auth0.ts', 'src/basicauth.go', 'src/authguard.ts', 'lib/reauth.ts', 'pages/api/nextauth.ts', 'src/authtoken.ts', 'lib/preauth.rb', 'src/HTTPAuth.ts',
+    'src/unauthenticated.ts', 'lib/reauthentication.ts', 'src/deauthorize.ts', 'app/oauth2client.py', 'api/HTTPAuthorization.ts']) {
     test(`${file} is an auth path`, () => {
       expect(runScope(createRepo([file])).SCOPE_AUTH).toBe('true');
     });