Support claims containing dots in OAuth2 additional_scopes_key

[sunfinite]

Proposed Changes

Implements changes for #16947

OAuth2 additional_scopes_key currently supports nested claims separated by dots. This prevents it from accessing claims whose names contain dots such as URIs.

This PR uses cuttlefish_variable:tokenize/1 for the value, which treats \. as a literal dot. The path is now tokenized once at config parse time and not per-token. Keys set directly via advanced.config as binaries keep the current behavior.

auth_oauth2.additional_scopes_key = https://example\.com/claims.roles

Types of Changes

What types of changes does your code introduce to this project?

• Bug fix (non-breaking change which fixes issue #NNNN)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause an observable behavior change in existing systems)
• Documentation improvements (corrections, new content, etc)
• Cosmetic change (whitespace, formatting, etc)
• Build system and/or CI

Checklist

• Mandatory: I (or my employer/client) have have signed the CA (see https://github.com/rabbitmq/cla)
• I have read the CONTRIBUTING.md document
• I have added tests that prove my fix is effective or that my feature works
• All tests pass locally with my changes
• If relevant, I have added necessary documentation to https://github.com/rabbitmq/rabbitmq-website
• If relevant, I have added this change to the first version(s) in release-notes that I expect to introduce it

Further Comments

Breaking case: Claim names that end with a \ followed by nesting work today but will be treated as a single token after this change. This does seem unlikely to affect anyone in practice, and any affected users can get the old behavior by setting the key in advanced.config directly.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[lukebakken]

Reviewed the change to support dot-containing claims in additional_scopes_key. The design is sound: the [[binary()]] shape correctly encodes an outer list of space-separated paths, each pre-tokenized into segment binaries, which is necessary once \. escaping means dots can no longer be re-split at runtime. Backward compatibility is preserved via the untouched is_binary clause, and there are no consumers of the field outside the plugin.

I ran the three relevant suites locally: rabbit_oauth2_schema_SUITE (22 ok), unit_SUITE (45 ok), and config_schema_SUITE (1 ok), all passing with the new tokenizer and escaped-dot coverage exercised.

I also pushed a single follow-up commit, 370e08d, adding a comment that documents the expected [[binary()]] shape of the tokenized value on the list clause of extract_scopes_from_additional_scopes_key/2.

[MarcialRosales]

Thank you for the PR!

Could we preserve backward compatibility for the original binary format of extra_scopes_source?

Since some legacy or direct Erlang configurations might still define this as a flat binary (e.g., {extra_scopes_source, <<"roles">>}), it would be ideal if the validation code and the test suite supported both the original binary format and the new list-of-lists/array-of-arrays format.

I noticed {extra_scopes_source, <<"roles">>} had to be changed to {extra_scopes_source, [[<<"roles">>]]} for the existing tests to pass. Allowing the translation layer and the test cases to accept both the legacy binary and the nested list structure would be highly appreciated.