From 712f5deed15fb5e1f9867a9bdfe469e289bd39fe Mon Sep 17 00:00:00 2001
From: garrytan <garrytan@gmail.com>
Date: Tue, 3 Nov 2026 02:30:20 +0000
Subject: [PATCH] fix(diff-scope): authoriz/authenticat mid-word and a leading
 oauth are auth paths (granted fix round, GST-1065)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---
 bin/gstack-diff-scope   | 12 +++++++-----
 test/diff-scope.test.ts |  3 ++-
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/bin/gstack-diff-scope b/bin/gstack-diff-scope
index ea7281284..8ae89637e 100755
--- a/bin/gstack-diff-scope
+++ b/bin/gstack-diff-scope
@@ -129,17 +129,19 @@ _session_data() {
 }
 
 # An auth path holds a token, split the way lib/review-risk.ts tokens() splits
-# paths (camelCase, then every non-alphanumeric run), that starts or ends with
-# auth (GST-1065): auth.ts, /auth/, authn, authz, auth0, authguard, oauth,
-# basicauth, nextauth, oauth2 and authorize match; a token starting with author
-# (author-spec.md, AUTHORS, authority.ts) does not unless it is authoriz*.
+# paths (camelCase, then every non-alphanumeric run), that names auth
+# (GST-1065): authoriz or authenticat anywhere in it (unauthenticated,
+# deauthorize), oauth at its start (oauth2client), or auth at its start or end
+# (auth.ts, /auth/, authn, authz, auth0, basicauth, nextauth). A token starting
+# with author (author-spec.md, AUTHORS, authority.ts) is not auth, and oauth
+# inside a word (coauthors) is not either.
 _auth_path() {
   local s="$1" t r=1
   while [[ "$s" =~ ^(.*[a-z0-9])([A-Z].*)$ ]]; do s="${BASH_REMATCH[1]} ${BASH_REMATCH[2]}"; done
   shopt -s nocasematch
   for t in ${s//[^a-zA-Z0-9]/ }; do
     case "$t" in
-      authoriz*|oauth2) r=0; break ;;
+      *authoriz*|*authenticat*|oauth*) r=0; break ;;
       author*) ;;
       auth*|*auth) r=0; break ;;
     esac
diff --git a/test/diff-scope.test.ts b/test/diff-scope.test.ts
index e74292e35..82c67f15b 100644
--- a/test/diff-scope.test.ts
+++ b/test/diff-scope.test.ts
@@ -237,7 +237,8 @@ describe('gstack-diff-scope', () => {
   //   why_new=GST-1065 and its review (the first word-only matcher dropped glued tokens the old glob caught); seam=bin/gstack-diff-scope
   for (const file of ['src/auth.ts', 'app/auth/login.rb', 'lib/oauth.ts', 'src/oauth2/token.ts', 'lib/authn/check.go', 'src/authz.py', 'src/authService.ts',
     'src/useAuth.ts', 'lib/OAuthClient.ts', 'lib/authentication.rb', 'lib/authorization_policy.rb', 'src/Authorize.tsx', 'config/AUTH_KEYS.md', 'pkg/auth-middleware.go',
-    'lib/auth0.ts', 'src/basicauth.go', 'src/authguard.ts', 'lib/reauth.ts', 'pages/api/nextauth.ts', 'src/authtoken.ts', 'lib/preauth.rb', 'src/HTTPAuth.ts']) {
+    'lib/auth0.ts', 'src/basicauth.go', 'src/authguard.ts', 'lib/reauth.ts', 'pages/api/nextauth.ts', 'src/authtoken.ts', 'lib/preauth.rb', 'src/HTTPAuth.ts',
+    'src/unauthenticated.ts', 'lib/reauthentication.ts', 'src/deauthorize.ts', 'app/oauth2client.py', 'api/HTTPAuthorization.ts']) {
     test(`${file} is an auth path`, () => {
       expect(runScope(createRepo([file])).SCOPE_AUTH).toBe('true');
     });