@Test
    void verifyScopeUnauthorized() throws Throwable {
        val service = getRegisteredService(UUID.randomUUID().toString(), UUID.randomUUID().toString(), CLIENT_SECRET);
        service.setScopes(Set.of("openid", "profile"));
        servicesManager.save(service);

        val code = addCode(RegisteredServiceTestUtils.getPrincipal(), service, service.getScopes());
        val request = new MockHttpServletRequest();
        request.addParameter(OAuth20Constants.GRANT_TYPE, OAuth20GrantTypes.AUTHORIZATION_CODE.getType());
        request.addParameter(OAuth20Constants.CLIENT_ID, service.getClientId());
        request.addParameter(OAuth20Constants.CLIENT_SECRET, CLIENT_SECRET);
        request.addParameter(OAuth20Constants.CODE, code.getId());
        request.addParameter(OAuth20Constants.SCOPE, "email");

        assertThrows(OAuth20UnauthorizedScopeRequestException.class,
            () -> extractor.extract(new JEEContext(request, new MockHttpServletResponse())));

        request.removeParameter(OAuth20Constants.SCOPE);
        var result = extractor.extract(new JEEContext(request, new MockHttpServletResponse()));
        assertEquals(result.getScopes(), code.getScopes());
        assertEquals(result.getScopes(), service.getScopes());

        request.addParameter(OAuth20Constants.SCOPE, "openid");
        result = extractor.extract(new JEEContext(request, new MockHttpServletResponse()));
        assertEquals(1, result.getScopes().size());
        assertEquals("openid", result.getScopes().iterator().next());
    }
This is {@link AccessTokenAuthorizationCodeGrantRequestExtractorTests}.

@author Misagh Moayyed
@since 6.3.0
support/cas-server-support-oauth/src/test/java/org/apereo/cas/support/oauth/web/response/accesstoken/ext/AccessTokenAuthorizationCodeGrantRequestExtractorTests.java