test: re-enable the OAuth2 protocol suite excluded by its *TestCase.php filename

tests/OAuth2ProtocolTestCase.php (23 tests covering the auth-code, PKCE,
implicit, client-credentials, refresh and revocation flows) never ran in the
Application Test Suite: PHPUnit's directory discovery only picks up *Test.php,
and the file has carried the *TestCase.php suffix since the Laravel 11 upgrade
(ae24738). Renamed file + class to OAuth2ProtocolTest so the suite discovers
it again.

Two latent problems surfaced by re-enabling it, both fixed:

- OAUTH2_VALIDATE_RESOURCE_SERVER_IP was unset in the testing env, so the
  resource-server IP allow-list check (ValidateBearerTokenResourceServerStrategy)
  silently no-oped and testResourceServerIntrospectionNotValidIP got 200 where
  it asserts 400. Enabled via phpunit.xml <env>.
- With the gate on, the caller IP came from $_SERVER['REMOTE_ADDR'], which is
  unset under the PHPUnit CLI unless an earlier test happened to assign it and
  leak it (OAuth2LoginStrategyTest::setUp does) - the same tests passed or
  failed depending on suite order. tests/bootstrap.php now pins
  REMOTE_ADDR=127.0.0.1 for the whole run.

Full Application suite: 196 tests / 1004 assertions, 0 failures (was 173 -
the 23 protocol tests now run).

Author: smarcet

phpunit.xml

@@ -25,5 +25,10 @@
   </testsuites>
   <php>
     <env name="APP_ENV" value="testing"/>
+    <!-- the resource-server IP allow-list check (ValidateBearerTokenResourceServerStrategy) no-ops
+         when this is off, silently passing introspection calls that must be rejected (see
+         OAuth2ProtocolTest::testResourceServerIntrospectionNotValidIP). Deterministic caller IP
+         comes from tests/bootstrap.php (REMOTE_ADDR=127.0.0.1). -->
+    <env name="OAUTH2_VALIDATE_RESOURCE_SERVER_IP" value="true"/>
   </php>
 </phpunit>

tests/OAuth2EndSessionTest.php

@@ -17,9 +17,6 @@
 
 /**
  * Class OAuth2EndSessionTest
- * NOTE: deliberately NOT placed in OAuth2ProtocolTestCase.php - that file's *TestCase.php suffix
- * keeps it OUT of the Application Test Suite (PHPUnit only auto-discovers *Test.php), so a test
- * added there would never run in CI.
  * @package Tests
  */
 final class OAuth2EndSessionTest extends OpenStackIDBaseTestCase

tests/OAuth2ProtocolTestCase.php tests/OAuth2ProtocolTest.phptests/OAuth2ProtocolTestCase.php renamed to tests/OAuth2ProtocolTest.php

@@ -23,7 +23,7 @@
  * Class OAuth2ProtocolTest
  * Test Suite for OAuth2 Protocol
  */
-final class OAuth2ProtocolTestCase extends OpenStackIDBaseTestCase
+final class OAuth2ProtocolTest extends OpenStackIDBaseTestCase
 {
 
     private $current_realm;

tests/bootstrap.php

@@ -3,6 +3,12 @@
 
 require dirname(__DIR__).'/bootstrap/autoload.php';
 
+// PHPUnit runs from the CLI, where REMOTE_ADDR is unset. Code under test reads it directly
+// (UserIPHelperProvider), so without a deterministic value here the resource-server IP checks
+// depended on whichever earlier test happened to set $_SERVER['REMOTE_ADDR'] and leak it -
+// the same suite passed or failed depending on test order.
+$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+
 
 use Symfony\Component\ErrorHandler\ErrorHandler;