From 56d626d1988520c596bfb97c2f3af05d410d09aa Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Sat, 3 Oct 2026 17:12:57 -0500
Subject: [PATCH 1/6] Explain OAuth client scope consent failures

---
 docs/docs/api/index.md                        |  26 +++
 .../Services/OAuthService.cs                  |   9 +-
 .../ClientApp/e2e/tests/oauth-consent.e2e.ts  |  61 +++++++
 .../(auth)/oauth/authorize/+page.svelte       |  18 +-
 .../authorize/authorize-page.svelte.test.ts   | 132 +++++++++++++++
 .../oauth/authorize/oauth-error.test.ts       |  22 +++
 .../(auth)/oauth/authorize/oauth-error.ts     |  17 ++
 .../Api/Endpoints/OAuthEndpointTests.cs       |  93 ++++++++++
 .../OAuthAuthorizationValidationTests.cs      | 159 ++++++++++++++++++
 9 files changed, 523 insertions(+), 14 deletions(-)
 create mode 100644 src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
 create mode 100644 src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts
 create mode 100644 src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts
 create mode 100644 src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts
 create mode 100644 tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs

diff --git a/docs/docs/api/index.md b/docs/docs/api/index.md
index 9a74360c85..1f9ab86f43 100644
--- a/docs/docs/api/index.md
+++ b/docs/docs/api/index.md
@@ -8,6 +8,32 @@ Our [API](https://api.exceptionless.io) utilizes Swagger and Swashbuckle to auto
 
 To view the full API documentation, visit <https://api.exceptionless.io> and click on the `API Documentation` link to be taken to the API documentation. With Swagger, you will have examples for all endpoints that include required parameters and potential responses.
 
+## MCP OAuth access
+
+OAuth discovery advertises the scopes the server supports. Each OAuth application has its own allowed scopes, and each authorization grant contains only the scopes and organizations approved by the user. Discovery does not grant every advertised permission to an application.
+
+For the MCP resource, `mcp:read` is required to connect. `projects:read`, `stacks:read`, and `events:read` permit the corresponding read tools. `stacks:write` permits changing stack status (open, fixed, ignored, or discarded), snoozing stacks, changing whether future occurrences are critical, and adding or removing reference links. It does not grant global administration or access to organizations outside the grant and the user's current membership.
+
+`offline_access` permits refresh token issuance so the client can obtain another access token without a new interactive authorization. It adds no read or write permission. Access tokens default to one hour and refresh tokens to 30 days; self-hosted administrators can configure these lifetimes with `OAuthServer:AccessTokenLifetimeMinutes` and `OAuthServer:RefreshTokenLifetimeDays`.
+
+Dynamic registration without a scope uses `mcp:read projects:read stacks:read events:read offline_access`. It excludes `stacks:write`. An explicit registration scope is retained, so a client registered with only the four read scopes also lacks `offline_access`.
+
+### Resolving a scope error after registration
+
+If authorization reports scopes that are not allowed for the application, restart the client's authorization flow requesting an allowed subset. Keep `mcp:read` for MCP access. Changing checkboxes on a failed consent page does not validate a new request.
+
+To enable additional scopes, a **global administrator** must:
+
+1. Open **System → OAuth Apps** (`/next/system/oauth-applications` in version 8.10.0; `/system/oauth-applications` after the Svelte app moves to the root).
+2. Change the default **Authorized** filter to **Not authorized** or **All applications** if the application has never completed consent.
+3. Find the application using the exact client ID from the authorization request, then select **Edit application**.
+4. Review and select **Stacks Write** and/or **Offline Access** as needed, then select **Save Changes**.
+5. Restart authorization using the **same client ID**, request the newly allowed scopes, and approve the appropriate organizations.
+
+Ordinary members can consent to access for their own organizations but cannot change global OAuth application configuration. Account **Applications** lists and revokes the user's grants; it does not enable client scopes. A global administrator's OAuth grant also receives only its approved scopes, without the administrator role.
+
+Enabling a scope on an application does not expand existing access or refresh tokens. Refreshing an existing grant keeps its original scopes intersected with the application's currently allowed scopes. Fresh consent is required to add write access, or to obtain refresh tokens for a grant originally created without `offline_access`.
+
 ---
 
 [Next > Getting Started](/docs/api/api-getting-started)
diff --git a/src/Exceptionless.Core/Services/OAuthService.cs b/src/Exceptionless.Core/Services/OAuthService.cs
index 77e7cb1446..03e6dab361 100644
--- a/src/Exceptionless.Core/Services/OAuthService.cs
+++ b/src/Exceptionless.Core/Services/OAuthService.cs
@@ -361,7 +361,14 @@ public async Task<OAuthValidationResult> ValidateAuthorizationRequestAsync(OAuth
 
         var allowedScopes = GetAllowedScopes(client);
         if (requestedScopes.Any(s => !allowedScopes.Contains(s, StringComparer.Ordinal)))
-            return OAuthValidationResult.Invalid("invalid_scope", "One or more scopes are not allowed for this client.");
+        {
+            // Only name server-supported scopes; do not reflect arbitrary request values.
+            var disallowedScopes = SupportedScopes.Where(s => requestedScopes.Contains(s, StringComparer.Ordinal) && !allowedScopes.Contains(s, StringComparer.Ordinal)).ToArray();
+            string description = disallowedScopes.Length > 0
+                ? $"Scopes not allowed for this application: {String.Join(", ", disallowedScopes)}."
+                : "One or more scopes are not allowed for this application.";
+            return OAuthValidationResult.Invalid("invalid_scope", $"{description} Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.");
+        }
 
         if (resourceDefinition.RequiredScopes.Any(s => !requestedScopes.Contains(s, StringComparer.Ordinal)))
             return OAuthValidationResult.Invalid("invalid_scope", "One or more required resource scopes are missing.");
diff --git a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
new file mode 100644
index 0000000000..e1077cad2d
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
@@ -0,0 +1,61 @@
+import { expect, test } from '@playwright/test';
+
+test('OAuth consent displays scope-policy errors and validates a restarted request before approval', async ({ page }) => {
+    const errorDescription =
+        'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.';
+    let consentRequests = 0;
+    let authorizationRequests = 0;
+    await page.addInitScript(() => window.localStorage.setItem('satellizer_token', 'test-consent-session'));
+    // This browser regression exercises the production page and FetchClient with HTTP responses.
+    // Service policy and issuance are covered separately by OAuthEndpointTests.
+    await page.route('**/api/v2/**', async (route) => {
+        const path = new URL(route.request().url()).pathname;
+        if (path.endsWith('/users/me')) {
+            await route.fulfill({ json: { email_address: 'member@example.test', full_name: 'Member' } });
+        } else if (path.endsWith('/organizations')) {
+            await route.fulfill({ json: [{ id: '000000000000000000000001', name: 'Test Organization' }] });
+        } else if (path.endsWith('/oauth/authorize/consent')) {
+            consentRequests++;
+            const body = route.request().postDataJSON() as { scope: string };
+            if (body.scope.includes('stacks:write')) {
+                await route.fulfill({ json: { error: 'invalid_scope', error_description: errorDescription }, status: 400 });
+            } else {
+                await route.fulfill({ json: { client_name: 'Test Client', required_scopes: ['mcp:read'], scopes: body.scope.split(' ') } });
+            }
+        } else if (path.endsWith('/oauth/authorize')) {
+            authorizationRequests++;
+            await route.fulfill({ json: { error: 'invalid_scope', error_description: errorDescription }, status: 400 });
+        } else {
+            await route.abort();
+        }
+    });
+
+    const parameters = new URLSearchParams({
+        client_id: 'test-client',
+        code_challenge: 'a'.repeat(43),
+        code_challenge_method: 'S256',
+        redirect_uri: 'http://localhost/callback',
+        resource: 'http://localhost/mcp',
+        response_type: 'code',
+        scope: 'mcp:read projects:read stacks:read stacks:write events:read offline_access'
+    });
+    await page.goto(`/oauth/authorize?${parameters}`);
+    await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
+    await expect(page.getByText('Required', { exact: true })).toHaveCount(1);
+    await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+    await page.getByRole('checkbox', { name: /Stacks Write/ }).click();
+    await page.getByRole('checkbox', { name: /Offline Access/ }).click();
+    await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+    expect(consentRequests).toBe(1);
+    expect(authorizationRequests).toBe(0);
+    await page.screenshot({ fullPage: true, path: test.info().outputPath('scope-error.png') });
+
+    parameters.set('scope', 'mcp:read');
+    await page.goto(`/oauth/authorize?${parameters}`);
+    await expect(page.getByText('Test Client', { exact: true })).toBeVisible();
+    await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+    expect(consentRequests).toBe(2);
+    await page.getByRole('button', { exact: true, name: 'Approve' }).click();
+    await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
+    expect(authorizationRequests).toBe(1);
+});
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
index 307732eb24..89ec2296a1 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
@@ -18,6 +18,8 @@
     import { useFetchClient } from '@foundatiofx/fetchclient';
     import { SvelteSet } from 'svelte/reactivity';
 
+    import { getOAuthErrorMessage } from './oauth-error';
+
     interface OAuthAuthorizeConsentResponse {
         client_id?: string;
         client_name?: string;
@@ -194,12 +196,7 @@
             return;
         }
 
-        errorMessage =
-            response.data?.error_description ||
-            response.data?.error ||
-            response.problem?.detail ||
-            response.problem?.title ||
-            'Unable to authorize application.';
+        errorMessage = getOAuthErrorMessage(response, 'Unable to authorize application.');
     }
 
     function cancelAuthorization() {
@@ -252,7 +249,7 @@
 
     function getRequiredScopes(resourceValue: string): string[] {
         if (resourceValue.endsWith('/mcp')) {
-            return [mcpReadScope, offlineAccessScope];
+            return [mcpReadScope];
         }
 
         return [];
@@ -290,12 +287,7 @@
         }
 
         consentDetails = null;
-        consentErrorMessage =
-            response.data?.error_description ||
-            response.data?.error ||
-            response.problem?.detail ||
-            response.problem?.title ||
-            'Unable to load application details.';
+        consentErrorMessage = getOAuthErrorMessage(response, 'Unable to load application details.');
     }
 
     async function redirectToLogin(): Promise<void> {
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts
new file mode 100644
index 0000000000..7020631420
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts
@@ -0,0 +1,132 @@
+import { FetchClient } from '@foundatiofx/fetchclient';
+import { fireEvent, render, screen, waitFor } from '@testing-library/svelte';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import AuthorizePage from './+page.svelte';
+
+const mocks = vi.hoisted(() => ({
+    clearSession: vi.fn(),
+    goto: vi.fn(),
+    page: { url: new URL('http://localhost/oauth/authorize') },
+    useFetchClient: vi.fn()
+}));
+
+vi.mock('$app/environment', () => ({ browser: true }));
+vi.mock('$app/navigation', () => ({ goto: mocks.goto }));
+vi.mock('$app/paths', () => ({ resolve: (path: string) => path.replace('/(auth)', '') }));
+vi.mock('$app/state', () => ({ page: mocks.page }));
+vi.mock('$features/auth/index.svelte', () => ({ accessToken: { current: 'test-token' } }));
+vi.mock('$features/auth/session.svelte', () => ({ clearAuthenticationSession: mocks.clearSession }));
+vi.mock('$features/organizations/api.svelte', () => ({
+    getOrganizationsQuery: () => ({ data: { data: [{ id: 'organization-1', name: 'Test Organization' }] }, isError: false, isLoading: false })
+}));
+vi.mock('$features/users/api.svelte', () => ({
+    getMeQuery: () => ({ data: { email_address: 'member@example.test', full_name: 'Member' }, isError: false, isLoading: false })
+}));
+vi.mock('@foundatiofx/fetchclient', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('@foundatiofx/fetchclient')>()),
+    useFetchClient: mocks.useFetchClient
+}));
+
+const scopeError =
+    'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps.';
+
+function consentResponse() {
+    return jsonResponse({ client_id: 'test-client', client_name: 'Test Client', required_scopes: ['mcp:read'], scopes: ['mcp:read', 'offline_access'] });
+}
+
+function jsonResponse(body: unknown, status = 200) {
+    return new Response(JSON.stringify(body), { headers: { 'Content-Type': 'application/json' }, status });
+}
+
+describe('OAuth authorization', () => {
+    beforeEach(() => {
+        mocks.page.url = new URL(
+            'http://localhost/oauth/authorize?client_id=test-client&redirect_uri=http://localhost/callback&resource=http://localhost/mcp&response_type=code&code_challenge=test&code_challenge_method=S256&scope=mcp:read+offline_access+stacks:write'
+        );
+    });
+
+    it('shows the actual FetchClient OAuth error on failed consent and keeps approval disabled after scope edits', async () => {
+        const fetch = vi.fn().mockResolvedValue(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+        render(AuthorizePage);
+
+        expect(await screen.findByText(scopeError)).toBeVisible();
+        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
+        expect(screen.getAllByText('Required')).toHaveLength(1);
+        await fireEvent.click(screen.getByRole('checkbox', { name: /Stacks Write/ }));
+        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
+        expect(fetch).toHaveBeenCalledOnce();
+    });
+
+    it('shows the actual FetchClient OAuth error when final authorization fails', async () => {
+        const fetch = vi
+            .fn()
+            .mockResolvedValueOnce(consentResponse())
+            .mockResolvedValueOnce(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+        render(AuthorizePage);
+        await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
+        await fireEvent.click(screen.getByRole('button', { name: 'Approve' }));
+
+        expect(await screen.findByText(scopeError)).toBeVisible();
+        expect(fetch).toHaveBeenCalledTimes(2);
+    });
+
+    it.each(['consent', 'approval'])('returns to login with the original query after session expiry during %s', async (stage) => {
+        const fetch = vi.fn();
+        if (stage === 'approval') {
+            fetch.mockResolvedValueOnce(consentResponse());
+        }
+
+        fetch.mockResolvedValueOnce(jsonResponse({}, 401));
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+        render(AuthorizePage);
+        if (stage === 'approval') {
+            await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
+            await fireEvent.click(screen.getByRole('button', { name: 'Approve' }));
+        }
+
+        await waitFor(() => expect(mocks.clearSession).toHaveBeenCalledOnce());
+        expect(mocks.goto).toHaveBeenCalledWith(`/login?redirect=${encodeURIComponent(mocks.page.url.pathname + mocks.page.url.search)}`, {
+            replaceState: true
+        });
+    });
+
+    it('sends one authorization request while approval is pending and cancel sends none', async () => {
+        let complete: (response: Response) => void = () => {};
+        const fetch = vi
+            .fn()
+            .mockResolvedValueOnce(consentResponse())
+            .mockImplementationOnce(
+                () =>
+                    new Promise<Response>((resolve) => {
+                        complete = resolve;
+                    })
+            );
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+        render(AuthorizePage);
+        const approve = screen.getByRole('button', { name: 'Approve' });
+        await waitFor(() => expect(approve).toBeEnabled());
+        await fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+        expect(await screen.findByText('Authorization canceled. You can close this tab.')).toBeVisible();
+        expect(fetch).toHaveBeenCalledOnce();
+        await fireEvent.click(approve);
+        await fireEvent.click(approve);
+        expect(approve).toBeDisabled();
+        await waitFor(() => expect(fetch).toHaveBeenCalledTimes(2));
+        complete(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
+        expect(await screen.findByText(scopeError)).toBeVisible();
+        expect(fetch).toHaveBeenCalledTimes(2);
+    });
+
+    it('renders an error as text without creating HTML', async () => {
+        const description = '<img src=x onerror=alert(1)>';
+        const fetch = vi.fn().mockResolvedValue(jsonResponse({ error_description: description }, 400));
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+        const { container } = render(AuthorizePage);
+        expect(await screen.findByText(description)).toBeVisible();
+        expect(container.querySelector('img[src="x"]')).toBeNull();
+        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
+    });
+});
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts
new file mode 100644
index 0000000000..9ede6ca18d
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+
+import { getOAuthErrorMessage } from './oauth-error';
+
+describe('OAuth error messages', () => {
+    it.each([
+        [{ error_description: 'OAuth description' }, 'OAuth description'],
+        [{ error: 'invalid_scope' }, 'invalid_scope'],
+        [{ detail: 'Problem detail' }, 'Problem detail'],
+        [{ title: 'Problem title' }, 'Problem title'],
+        [{ detail: 7, error: [], error_description: {}, title: false }, 'Fallback'],
+        [{ detail: 'Problem detail', error_description: '  ' }, 'Problem detail'],
+        [null, 'Fallback'],
+        ['Malformed body', 'Fallback']
+    ])('handles OAuth, ordinary problem details, and malformed bodies: %j', (problem, expected) => {
+        expect(getOAuthErrorMessage({ data: null, problem }, 'Fallback')).toBe(expected);
+    });
+
+    it('retains the description from a parsed response body', () => {
+        expect(getOAuthErrorMessage({ data: { error_description: 'Description' }, problem: { title: 'Title' } }, 'Fallback')).toBe('Description');
+    });
+});
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts
new file mode 100644
index 0000000000..a33e834879
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts
@@ -0,0 +1,17 @@
+export function getOAuthErrorMessage(response: { data: unknown; problem: unknown }, fallback: string): string {
+    for (const body of [response.data, response.problem]) {
+        if (!body || typeof body !== 'object') {
+            continue;
+        }
+
+        const error = body as Record<string, unknown>;
+        for (const key of ['error_description', 'error', 'detail', 'title']) {
+            const value = error[key];
+            if (typeof value === 'string' && value.trim()) {
+                return value;
+            }
+        }
+    }
+
+    return fallback;
+}
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
index adcbce177c..033adf9b90 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
@@ -608,6 +608,22 @@ public async Task CompleteAuthorizeAsync_WithoutOrganizations_ReturnsBadRequest(
         Assert.Equal("Select at least one organization.", error.ErrorDescription);
     }
 
+    [Fact]
+    public async Task CompleteAuthorizeAsync_ForeignOrganization_ReturnsBadRequestWithoutCode()
+    {
+        using var client = CreateHttpClient();
+        using var request = CreateAuthorizeJsonRequest(PkceVerifier, organizationIds: [ObjectId.GenerateNewId().ToString()]);
+
+        var response = await client.SendAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        var error = await response.DeserializeAsync<OAuthErrorResponse>(ensureSuccess: false);
+        Assert.NotNull(error);
+        Assert.Equal("invalid_request", error.Error);
+        Assert.Equal("One or more selected organizations are not available to the current user.", error.ErrorDescription);
+        Assert.DoesNotContain("redirect_uri", await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+    }
+
     [Fact]
     public async Task CompleteAuthorizeAsync_WithoutResource_ReturnsBadRequest()
     {
@@ -735,6 +751,52 @@ public async Task GetAuthorizeConsentAsync_ValidRequest_ReturnsValidatedClientDe
         Assert.Empty(consent.RequiredScopes);
     }
 
+    [Theory]
+    [InlineData(null, "stacks:write")]
+    [InlineData("mcp:read projects:read stacks:read events:read", "stacks:write, offline_access")]
+    [InlineData("mcp:read projects:read stacks:read stacks:write events:read offline_access", null)]
+    public async Task AuthorizeAsync_DynamicClientScopes_ValidatesConsentAndFinalRequest(string? registeredScopes, string? deniedScopes)
+    {
+        // Arrange: reproduce both omitted registration scope and an explicit read-only client.
+        using var client = CreateHttpClient();
+        var registrationResponse = await client.PostAsJsonAsync("oauth/register", new OAuthClientRegistrationRequest
+        {
+            ClientName = "Scope Regression Client",
+            RedirectUris = [RedirectUri],
+            Scope = registeredScopes
+        }, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, registrationResponse.StatusCode);
+        var registration = await DeserializeResponseAsync<OAuthClientRegistrationResponse>(registrationResponse);
+        Assert.NotNull(registration);
+        string requestedScopes = String.Join(' ', OAuthService.SupportedScopes);
+
+        // Act and assert: both endpoints enforce the same client policy before issuing a code.
+        foreach (string endpoint in new[] { "oauth/authorize/consent", "oauth/authorize" })
+        {
+            using var request = CreateAuthorizeJsonRequest(PkceVerifier, clientId: registration.ClientId, scope: requestedScopes, organizationIds: [SampleDataService.TEST_ORG_ID]);
+            request.RequestUri = new Uri(endpoint, UriKind.Relative);
+            var response = await client.SendAsync(request, TestContext.Current.CancellationToken);
+
+            Assert.Equal(deniedScopes is null ? HttpStatusCode.OK : HttpStatusCode.BadRequest, response.StatusCode);
+            if (deniedScopes is not null)
+            {
+                var error = await response.DeserializeAsync<OAuthErrorResponse>(ensureSuccess: false);
+                Assert.NotNull(error);
+                Assert.Equal("invalid_scope", error.Error);
+                Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.", error.ErrorDescription);
+                Assert.DoesNotContain("redirect_uri", await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+            }
+        }
+
+        // An allowed subset works without changing the client's configured scopes and without offline access.
+        var token = await IssueTokenAsync(clientId: registration.ClientId, scope: AuthorizationRoles.McpRead, organizationIds: [SampleDataService.TEST_ORG_ID]);
+        Assert.Null(token.RefreshToken);
+        Assert.Equal(AuthorizationRoles.McpRead, token.Scope);
+        var application = await _oauthApplicationRepository.GetByClientIdAsync(registration.ClientId, o => o.ImmediateConsistency());
+        Assert.NotNull(application);
+        Assert.Equal(registration.Scope.Split(' '), application.Scopes);
+    }
+
     [Fact]
     public async Task CompleteAuthorizeAsync_ClientMetadataDocument_PersistsObservedApplication()
     {
@@ -1316,6 +1378,37 @@ public async Task TokenAsync_RefreshToken_RotatesRefreshToken()
         Assert.Equal(spentToken.GrantId, refreshedStoredToken.GrantId);
     }
 
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task TokenAsync_ExpandedClientScopes_RequiresFreshConsent(bool originalOfflineAccess)
+    {
+        string originalScopes = originalOfflineAccess ? "mcp:read projects:read offline_access" : "mcp:read projects:read";
+        var token = await IssueTokenAsync(scope: originalScopes);
+        Assert.Equal(originalOfflineAccess, token.RefreshToken is not null);
+
+        await SetStoredOAuthApplicationScopesAsync(ClientId, OAuthService.SupportedScopes.ToArray());
+
+        var storedToken = await GetStoredOAuthTokenAsync(token.AccessToken);
+        Assert.NotNull(storedToken);
+        Assert.DoesNotContain(AuthorizationRoles.StacksWrite, storedToken.Scopes);
+        Assert.Equal(originalOfflineAccess, storedToken.RefreshTokenHash is not null);
+        if (originalOfflineAccess)
+        {
+            using var client = CreateHttpClient();
+            using var content = CreateRefreshTokenContent(token.RefreshToken);
+            var response = await client.PostAsync("oauth/token", content, TestContext.Current.CancellationToken);
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            var refreshed = await DeserializeResponseAsync<OAuthTokenResponse>(response);
+            Assert.NotNull(refreshed);
+            Assert.Equal(originalScopes, refreshed.Scope);
+        }
+
+        var freshToken = await IssueTokenAsync(scope: String.Join(' ', OAuthService.SupportedScopes));
+        Assert.Contains(AuthorizationRoles.StacksWrite, freshToken.Scope);
+        Assert.NotNull(freshToken.RefreshToken);
+    }
+
     [Fact]
     public async Task TokenAsync_RecentlyUsedRefreshToken_IssuesNewToken()
     {
diff --git a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
new file mode 100644
index 0000000000..af3882044b
--- /dev/null
+++ b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
@@ -0,0 +1,159 @@
+using System.Reflection;
+using System.Security.Claims;
+using Exceptionless.Core.Authorization;
+using Exceptionless.Core.Configuration;
+using Exceptionless.Core.Extensions;
+using Exceptionless.Core.Models;
+using Exceptionless.Core.Repositories;
+using Exceptionless.Core.Services;
+using Xunit;
+
+namespace Exceptionless.Tests.Services;
+
+public sealed class OAuthAuthorizationValidationTests
+{
+    private const string Resource = "http://localhost/mcp";
+    private const string RedirectUri = "http://localhost/callback";
+    private const string FourReadScopes = "mcp:read projects:read stacks:read events:read";
+    private const string AllScopes = "mcp:read projects:read stacks:read stacks:write events:read offline_access";
+
+    [Theory]
+    [InlineData(false, false)]
+    [InlineData(false, true)]
+    [InlineData(true, false)]
+    [InlineData(true, true)]
+    public void ToIdentity_OAuthGrant_DoesNotInheritGlobalRoleOrForeignOrganization(bool globalAdministrator, bool writeScope)
+    {
+        var user = new User
+        {
+            Id = "user-1",
+            EmailAddress = "member@example.test",
+            Roles = new HashSet<string>(globalAdministrator ? [AuthorizationRoles.User, AuthorizationRoles.GlobalAdmin] : [AuthorizationRoles.User]),
+            OrganizationIds = new HashSet<string>(["organization-1"])
+        };
+        var token = new OAuthToken
+        {
+            Id = "token-1",
+            ClientId = "client-1",
+            Resource = Resource,
+            Scopes = writeScope ? [AuthorizationRoles.McpRead, AuthorizationRoles.StacksWrite, AuthorizationRoles.OfflineAccess] : [AuthorizationRoles.McpRead],
+            OrganizationIds = ["organization-1", "foreign-organization"]
+        };
+
+        var identity = user.ToIdentity(token);
+
+        Assert.DoesNotContain(identity.Claims, claim => claim.Type == ClaimTypes.Role && claim.Value == AuthorizationRoles.GlobalAdmin);
+        Assert.Equal(writeScope, identity.HasClaim(ClaimTypes.Role, AuthorizationRoles.StacksWrite));
+        Assert.Equal("organization-1", identity.FindFirst(IdentityUtils.OrganizationIdsClaim)?.Value);
+        user.OrganizationIds.Clear();
+        Assert.Empty(user.GetActiveOAuthOrganizationIds(token));
+    }
+
+    [Theory]
+    [InlineData(null, AllScopes, "stacks:write")]
+    [InlineData(FourReadScopes, AllScopes, "stacks:write, offline_access")]
+    [InlineData(AllScopes, AllScopes, null)]
+    [InlineData(FourReadScopes, FourReadScopes, null)]
+    [InlineData(FourReadScopes, "mcp:read", null)]
+    public async Task ValidateAuthorizationRequestAsync_ClientScopeCombinations_EnforcesAllowedScopes(string? clientScopes, string requestScopes, string? deniedScopes)
+    {
+        // Arrange
+        var (service, application) = CreateService(clientScopes);
+        string[] originalScopes = application.Scopes.ToArray();
+
+        // Act
+        var result = await service.ValidateAuthorizationRequestAsync(CreateRequest(requestScopes), Resource, OAuthService.McpResource);
+
+        // Assert
+        Assert.Equal(deniedScopes is null, result.IsValid);
+        Assert.Equal(originalScopes, application.Scopes);
+        if (deniedScopes is not null)
+        {
+            Assert.Equal("invalid_scope", result.Error);
+            Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.", result.ErrorDescription);
+            Assert.Empty(result.Scopes);
+        }
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("offline_access")]
+    [InlineData("projects:read")]
+    [InlineData("mcp:read <script>unknown</script>")]
+    public async Task ValidateAuthorizationRequestAsync_InvalidScopes_DeniesWithoutReflectingUnknownScopes(string scopes)
+    {
+        var (service, _) = CreateService(AllScopes);
+
+        var result = await service.ValidateAuthorizationRequestAsync(CreateRequest(scopes), Resource, OAuthService.McpResource);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("invalid_scope", result.Error);
+        Assert.DoesNotContain("<script>", result.ErrorDescription);
+        Assert.Empty(result.Scopes);
+    }
+
+    [Theory]
+    [InlineData("unknown", "invalid_client", "Unknown OAuth client.")]
+    [InlineData("disabled", "invalid_client", "Unknown OAuth client.")]
+    [InlineData("redirect", "invalid_request", "Invalid redirect_uri.")]
+    [InlineData("pkce", "invalid_request", "PKCE S256 is required.")]
+    [InlineData("resource", "invalid_target", "The requested resource is not supported.")]
+    public async Task ValidateAuthorizationRequestAsync_InvalidSecurityParameters_DoesNotDiscloseClientScopeDetails(string scenario, string error, string description)
+    {
+        var (service, application) = CreateService(FourReadScopes);
+        application.IsDisabled = scenario == "disabled";
+        var request = CreateRequest(AllScopes) with
+        {
+            ClientId = scenario == "unknown" ? "unknown" : application.ClientId,
+            RedirectUri = scenario == "redirect" ? "https://attacker.example/callback" : RedirectUri,
+            CodeChallenge = scenario == "pkce" ? "invalid" : new string('a', 43),
+            Resource = scenario == "resource" ? "http://localhost/other" : Resource
+        };
+
+        var result = await service.ValidateAuthorizationRequestAsync(request, Resource, OAuthService.McpResource);
+
+        Assert.False(result.IsValid);
+        Assert.Equal(error, result.Error);
+        Assert.Equal(description, result.ErrorDescription);
+        Assert.Empty(result.Scopes);
+    }
+
+    private static OAuthAuthorizeRequest CreateRequest(string scopes) => new()
+    {
+        ClientId = "test-client",
+        ResponseType = "code",
+        RedirectUri = RedirectUri,
+        CodeChallenge = new string('a', 43),
+        CodeChallengeMethod = OAuthService.CodeChallengeMethod,
+        Resource = Resource,
+        Scope = scopes
+    };
+
+    private static (OAuthService Service, OAuthApplication Application) CreateService(string? scopes)
+    {
+        var application = new OAuthApplication
+        {
+            ClientId = "test-client",
+            Name = "Test Client",
+            RedirectUris = [RedirectUri],
+            Scopes = scopes?.Split(' ') ?? OAuthService.DefaultScopes.ToArray()
+        };
+        var repository = DispatchProxy.Create<IOAuthApplicationRepository, ApplicationRepositoryProxy>();
+        ((ApplicationRepositoryProxy)(object)repository).Application = application;
+        var service = new OAuthService(new OAuthServerOptions(), null!, null!, repository, null!, null!, null!, TimeProvider.System);
+        return (service, application);
+    }
+
+    private class ApplicationRepositoryProxy : DispatchProxy
+    {
+        public OAuthApplication Application { get; set; } = null!;
+
+        protected override object? Invoke(MethodInfo? targetMethod, object?[]? args)
+        {
+            if (targetMethod?.Name == nameof(IOAuthApplicationRepository.GetByClientIdAsync))
+                return Task.FromResult(args?[0] as string == Application.ClientId ? Application : null);
+
+            throw new NotSupportedException($"Unexpected repository call: {targetMethod?.Name}");
+        }
+    }
+}

From 40c0fd56de8b7e4f8c34af59c3676bbe1ca4b441 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Sat, 3 Oct 2026 17:24:28 -0500
Subject: [PATCH 2/6] Revalidate consent state when the authorization query
 changes

---
 .../ClientApp/e2e/tests/oauth-consent.e2e.ts  | 82 ++++++++++++++-----
 .../(auth)/oauth/authorize/+page.svelte       | 13 ++-
 .../Api/Endpoints/OAuthEndpointTests.cs       |  1 +
 3 files changed, 76 insertions(+), 20 deletions(-)

diff --git a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
index e1077cad2d..93deae522f 100644
--- a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
+++ b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
@@ -5,6 +5,7 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
         'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.';
     let consentRequests = 0;
     let authorizationRequests = 0;
+    let completeStaleConsent: (() => void) | undefined;
     await page.addInitScript(() => window.localStorage.setItem('satellizer_token', 'test-consent-session'));
     // This browser regression exercises the production page and FetchClient with HTTP responses.
     // Service policy and issuance are covered separately by OAuthEndpointTests.
@@ -16,7 +17,14 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
             await route.fulfill({ json: [{ id: '000000000000000000000001', name: 'Test Organization' }] });
         } else if (path.endsWith('/oauth/authorize/consent')) {
             consentRequests++;
-            const body = route.request().postDataJSON() as { scope: string };
+            const body = route.request().postDataJSON() as { client_id: string; scope: string };
+            if (body.client_id === 'stale-client') {
+                await new Promise<void>((resolve) => {
+                    completeStaleConsent = resolve;
+                });
+                await route.fulfill({ json: { error: 'invalid_scope', error_description: 'Stale request error' }, status: 400 });
+                return;
+            }
             if (body.scope.includes('stacks:write')) {
                 await route.fulfill({ json: { error: 'invalid_scope', error_description: errorDescription }, status: 400 });
             } else {
@@ -39,23 +47,59 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
         response_type: 'code',
         scope: 'mcp:read projects:read stacks:read stacks:write events:read offline_access'
     });
-    await page.goto(`/oauth/authorize?${parameters}`);
-    await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
-    await expect(page.getByText('Required', { exact: true })).toHaveCount(1);
-    await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
-    await page.getByRole('checkbox', { name: /Stacks Write/ }).click();
-    await page.getByRole('checkbox', { name: /Offline Access/ }).click();
-    await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
-    expect(consentRequests).toBe(1);
-    expect(authorizationRequests).toBe(0);
-    await page.screenshot({ fullPage: true, path: test.info().outputPath('scope-error.png') });
+    try {
+        await page.goto(`/oauth/authorize?${parameters}`);
+        await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
+        await expect(page.getByText('Required', { exact: true })).toHaveCount(1);
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+        await page.getByRole('checkbox', { name: /Stacks Write/ }).click();
+        await page.getByRole('checkbox', { name: /Offline Access/ }).click();
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+        expect(consentRequests).toBe(1);
+        expect(authorizationRequests).toBe(0);
+        await page.screenshot({ fullPage: true, path: test.info().outputPath('scope-error.png') });
+
+        parameters.set('scope', 'mcp:read');
+        await page.goto(`/oauth/authorize?${parameters}`);
+        await expect(page.getByText('Test Client', { exact: true })).toBeVisible();
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+        expect(consentRequests).toBe(2);
+        await page.getByRole('button', { exact: true, name: 'Approve' }).click();
+        await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
+        expect(authorizationRequests).toBe(1);
+
+        async function navigateWithQuery() {
+            await page.evaluate((href) => {
+                document.getElementById('oauth-query-link')?.remove();
+                const link = document.createElement('a');
+                link.id = 'oauth-query-link';
+                link.href = href;
+                link.textContent = 'Change authorization request';
+                document.body.append(link);
+            }, `/oauth/authorize?${parameters}`);
+            await page.getByRole('link', { name: 'Change authorization request' }).click();
+        }
+
+        parameters.set('scope', 'mcp:read projects:read');
+        await navigateWithQuery();
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+        await expect(page.getByText(errorDescription, { exact: true })).toHaveCount(0);
 
-    parameters.set('scope', 'mcp:read');
-    await page.goto(`/oauth/authorize?${parameters}`);
-    await expect(page.getByText('Test Client', { exact: true })).toBeVisible();
-    await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
-    expect(consentRequests).toBe(2);
-    await page.getByRole('button', { exact: true, name: 'Approve' }).click();
-    await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
-    expect(authorizationRequests).toBe(1);
+        parameters.set('client_id', 'stale-client');
+        await navigateWithQuery();
+        await expect.poll(() => Boolean(completeStaleConsent)).toBe(true);
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+        parameters.set('client_id', 'test-client');
+        await navigateWithQuery();
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+        const staleResponse = page.waitForResponse(
+            (response) => response.url().endsWith('/oauth/authorize/consent') && response.request().postDataJSON().client_id === 'stale-client'
+        );
+        completeStaleConsent?.();
+        await (await staleResponse).finished();
+        await expect(page.getByText('Stale request error', { exact: true })).toHaveCount(0);
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+    } finally {
+        completeStaleConsent?.();
+    }
 });
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
index 89ec2296a1..f7fc6e7df5 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
@@ -59,6 +59,7 @@
     let isLoadingConsent = $state(false);
     let loadedConsentKey = $state<null | string>(null);
     let initializedOrganizationSelectionKey = $state<null | string>(null);
+    let consentRequestId = 0;
     const selectedOrganizationIds = new SvelteSet<string>();
     const selectedScopes = new SvelteSet<string>();
 
@@ -87,7 +88,9 @@
     const hasSelectedOrganizations = $derived(selectedOrganizationIds.size > 0);
     const hasSelectedResourceScope = $derived(selectedScopeValues.some((scope) => scope !== offlineAccessScope));
     const hasRequiredScopes = $derived(missingRequiredScopes.length === 0 && requiredScopes.every((scope) => selectedScopes.has(scope)));
-    const canApprove = $derived(!isLoadingConsent && !consentErrorMessage && hasSelectedOrganizations && hasSelectedResourceScope && hasRequiredScopes);
+    const canApprove = $derived(
+        Boolean(consentDetails) && !isLoadingConsent && !consentErrorMessage && hasSelectedOrganizations && hasSelectedResourceScope && hasRequiredScopes
+    );
 
     $effect(() => {
         if (!browser || accessToken.current) {
@@ -264,7 +267,11 @@
     }
 
     async function loadConsentDetails(): Promise<void> {
+        const requestId = ++consentRequestId;
+        const consentKey = page.url.search;
         isLoadingConsent = true;
+        consentDetails = null;
+        errorMessage = null;
         consentErrorMessage = null;
         const client = useFetchClient();
         const response = await client.postJSON<OAuthAuthorizeConsentResponse>(
@@ -275,6 +282,10 @@
             }
         );
 
+        if (requestId !== consentRequestId || consentKey !== page.url.search) {
+            return;
+        }
+
         isLoadingConsent = false;
         if (response.ok && response.data) {
             consentDetails = response.data;
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
index 033adf9b90..ba4be5b8e5 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
@@ -1384,6 +1384,7 @@ public async Task TokenAsync_RefreshToken_RotatesRefreshToken()
     public async Task TokenAsync_ExpandedClientScopes_RequiresFreshConsent(bool originalOfflineAccess)
     {
         string originalScopes = originalOfflineAccess ? "mcp:read projects:read offline_access" : "mcp:read projects:read";
+        await SetStoredOAuthApplicationScopesAsync(ClientId, originalScopes.Split(' '));
         var token = await IssueTokenAsync(scope: originalScopes);
         Assert.Equal(originalOfflineAccess, token.RefreshToken is not null);
 

From 8ed5f29edfb7e4741b20a5d49bd8fa1019a4ab0b Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Sat, 3 Oct 2026 20:28:33 -0500
Subject: [PATCH 3/6] Exercise live OAuth administrator consent and refresh
 flow

---
 .../e2e/tests/oauth-live-consent.e2e.ts       | 224 ++++++++++++++++++
 1 file changed, 224 insertions(+)
 create mode 100644 src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts

diff --git a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts
new file mode 100644
index 0000000000..ff02d8e5af
--- /dev/null
+++ b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts
@@ -0,0 +1,224 @@
+import { createHash, randomBytes } from 'node:crypto';
+
+import type { OAuthApplication } from '../../src/lib/features/admin/models';
+
+import { expect, test } from '../fixtures/e2e-test';
+import { getE2EEnvironment } from '../fixtures/environment';
+import { runCleanupStep, throwIfCleanupFailed } from '../support/cleanup';
+
+interface OAuthTokens {
+    access_token: string;
+    refresh_token?: string;
+    scope: string;
+    token_type: string;
+}
+
+const environment = getE2EEnvironment();
+const hostname = new URL(environment.appUrl).hostname;
+test.skip(
+    environment.isProduction || (!['127.0.0.1', '[::1]', 'localhost'].includes(hostname) && !hostname.endsWith('.localhost')),
+    'This synthetic OAuth journey requires the local development test host.'
+);
+test.use({ e2eUseGeneratedUser: true });
+
+test('a global administrator enables client scopes and a member restarts consent to obtain and refresh only the selected grant', async ({
+    browser,
+    e2eApi,
+    e2eScenario,
+    page,
+    request
+}) => {
+    const readScopes = ['mcp:read', 'projects:read', 'stacks:read', 'events:read'];
+    const allScopes = [...readScopes, 'stacks:write', 'offline_access'];
+    const applicationName = `OAuth live ${e2eScenario.run}`;
+    const administratorToken = await e2eApi.login();
+    const administratorHeaders = { Authorization: `Bearer ${administratorToken}` };
+    const memberHeaders = { Authorization: `Bearer ${e2eScenario.userToken}` };
+    const administratorContext = await browser.newContext({ baseURL: environment.appUrl, ignoreHTTPSErrors: true });
+    let clientId: string | undefined;
+    let applicationId: string | undefined;
+    const issuedTokens: string[] = [];
+
+    async function findApplication() {
+        const response = await request.get(`${environment.apiUrl}/admin/oauth-applications`, {
+            headers: administratorHeaders,
+            params: { criteria: clientId!, limit: 10 }
+        });
+        expect(response.status()).toBe(200);
+        const applications = (await response.json()) as OAuthApplication[];
+        return applications.find((application) => application.client_id === clientId);
+    }
+
+    try {
+        // The existing organization page is the synthetic client's callback. Observe real
+        // browser navigation there; no OAuth, administrator or callback responses are intercepted.
+        const redirectUri = `${environment.appUrl}/organization/${e2eScenario.organizationId}/manage`;
+        const metadataResponse = await request.get(`${environment.appUrl}/.well-known/oauth-protected-resource/mcp`);
+        expect(metadataResponse.status()).toBe(200);
+        const { resource } = (await metadataResponse.json()) as { resource: string };
+
+        await test.step('register a restricted client and show its actual denied-scope response', async () => {
+            const registrationResponse = await request.post(`${environment.apiUrl}/oauth/register`, {
+                data: {
+                    client_name: applicationName,
+                    grant_types: ['authorization_code', 'refresh_token'],
+                    redirect_uris: [redirectUri],
+                    response_types: ['code'],
+                    scope: readScopes.join(' '),
+                    token_endpoint_auth_method: 'none'
+                }
+            });
+            expect(registrationResponse.status()).toBe(201);
+            clientId = ((await registrationResponse.json()) as { client_id: string }).client_id;
+            expect(clientId).toMatch(/^dcr_/);
+            await expect.poll(async () => (applicationId = (await findApplication())?.id)).toBeTruthy();
+
+            const forbidden = await request.put(`${environment.apiUrl}/admin/oauth-applications/${applicationId}`, {
+                data: { client_id: clientId, is_disabled: false, name: applicationName, redirect_uris: [redirectUri], scopes: allScopes },
+                headers: memberHeaders
+            });
+            expect(forbidden.status()).toBe(403);
+
+            await page.goto(authorizationUrl(allScopes));
+            await expect(page.getByText(/^Scopes not allowed for this application: stacks:write, offline_access\./)).toBeVisible();
+            await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+        });
+
+        await administratorContext.addInitScript((token) => window.localStorage.setItem('satellizer_token', token), administratorToken);
+        const administratorPage = await administratorContext.newPage();
+        await test.step('find the failed registration through Not authorized', async () => {
+            await administratorPage.goto(`/system/oauth-applications?criteria=${encodeURIComponent(applicationName)}`);
+            await expect(administratorPage.getByRole('button', { name: 'Filter by authorization' })).toHaveText('Authorized');
+            await expect(administratorPage.getByRole('link', { exact: true, name: applicationName })).toHaveCount(0);
+            await administratorPage.getByRole('button', { name: 'Filter by authorization' }).click();
+            await administratorPage.getByRole('option', { exact: true, name: 'Not authorized' }).click();
+            await expect(administratorPage.getByRole('link', { exact: true, name: applicationName })).toBeVisible();
+            await administratorPage.getByRole('button', { name: `Show details for ${applicationName}` }).click();
+            await expect(administratorPage.getByText(clientId!, { exact: true })).toBeVisible();
+            await administratorPage.getByRole('link', { exact: true, name: 'Edit application' }).click();
+            await expect(administratorPage.getByLabel('Client ID', { exact: true })).toHaveValue(clientId!);
+        });
+
+        const limitedGrant = await test.step('consent to an allowed subset without offline access', async () => {
+            const tokens = await approveAndExchange(readScopes);
+            expect(tokens.refresh_token).toBeUndefined();
+            expect(tokens.scope.split(' ')).toEqual(readScopes);
+            return tokens;
+        });
+
+        await test.step('save the reviewed scopes in the real administrator form without replacing the client', async () => {
+            await expect(administratorPage.getByLabel('Client ID', { exact: true })).toHaveValue(clientId!);
+            for (const label of ['Stacks Write', 'Offline Access']) {
+                const checkbox = administratorPage.getByText(label, { exact: true }).locator('../..').getByRole('checkbox');
+                await expect(checkbox).not.toBeChecked();
+                await checkbox.check();
+            }
+            const savedResponse = administratorPage.waitForResponse(
+                (response) => response.request().method() === 'PUT' && new URL(response.url()).pathname === `/api/v2/admin/oauth-applications/${applicationId}`
+            );
+            await administratorPage.getByRole('button', { exact: true, name: 'Save Changes' }).click();
+            expect((await savedResponse).status()).toBe(200);
+            await expect(administratorPage).toHaveURL((url) => url.pathname === '/system/oauth-applications');
+            const savedApplication = await findApplication();
+            expect(savedApplication?.client_id).toBe(clientId);
+            expect(savedApplication?.scopes.toSorted()).toEqual(allScopes.toSorted());
+            expect(savedApplication?.organizations.map((organization) => organization.id)).toEqual([e2eScenario.organizationId]);
+            const oldGrantRefresh = await request.post(`${environment.apiUrl}/oauth/token`, {
+                form: { client_id: clientId!, grant_type: 'refresh_token', refresh_token: limitedGrant.access_token }
+            });
+            expect(oldGrantRefresh.status()).toBe(400);
+            expect((await oldGrantRefresh.json()).error).toBe('invalid_grant');
+        });
+
+        await test.step('restart with the same client and exchange and rotate the fresh consent grant', async () => {
+            const granted = await approveAndExchange(allScopes);
+            expect(granted.scope.split(' ').toSorted()).toEqual(allScopes.toSorted());
+            expect(granted.refresh_token).toEqual(expect.any(String));
+            const response = await request.post(`${environment.apiUrl}/oauth/token`, {
+                form: { client_id: clientId!, grant_type: 'refresh_token', refresh_token: granted.refresh_token! }
+            });
+            expect(response.status()).toBe(200);
+            const refreshed = (await response.json()) as OAuthTokens;
+            issuedTokens.push(refreshed.access_token);
+            expect(refreshed.access_token).not.toBe(granted.access_token);
+            expect(refreshed.refresh_token).toEqual(expect.any(String));
+            expect(refreshed.refresh_token).not.toBe(granted.refresh_token);
+            expect(refreshed.scope.split(' ').toSorted()).toEqual(allScopes.toSorted());
+            const resourceResponse = await request.get(resource, { headers: { Authorization: `Bearer ${refreshed.access_token}` } });
+            // The stateless MCP endpoint rejects GET only after authenticating the OAuth grant.
+            expect(resourceResponse.status()).toBe(405);
+            const application = await findApplication();
+            expect(application?.organizations.map((organization) => organization.id)).toEqual([e2eScenario.organizationId]);
+        });
+
+        function authorizationUrl(scopes: string[], verifier = randomBytes(32).toString('base64url')) {
+            return `/oauth/authorize?${new URLSearchParams({
+                client_id: clientId!,
+                code_challenge: createHash('sha256').update(verifier).digest('base64url'),
+                code_challenge_method: 'S256',
+                redirect_uri: redirectUri,
+                resource,
+                response_type: 'code',
+                scope: scopes.join(' '),
+                state: e2eScenario.run
+            })}`;
+        }
+
+        async function approveAndExchange(scopes: string[]) {
+            const verifier = randomBytes(32).toString('base64url');
+            await page.goto(authorizationUrl(scopes, verifier));
+            await expect(page.getByRole('checkbox', { exact: true, name: e2eScenario.organizationName })).toBeChecked();
+            await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+            const authorizationResponse = page.waitForResponse(
+                (response) => response.request().method() === 'POST' && new URL(response.url()).pathname === '/api/v2/oauth/authorize'
+            );
+            await page.getByRole('button', { exact: true, name: 'Approve' }).click();
+            const response = await authorizationResponse;
+            expect(response.status()).toBe(200);
+            expect(response.request().postDataJSON()).toMatchObject({
+                client_id: clientId,
+                organization_ids: [e2eScenario.organizationId],
+                scope: scopes.join(' ')
+            });
+            await expect(page).toHaveURL((url) => url.pathname === new URL(redirectUri).pathname && url.searchParams.has('code'));
+            const callback = new URL(page.url());
+            expect(callback.searchParams.get('state')).toBe(e2eScenario.run);
+            const code = callback.searchParams.get('code');
+            expect(code).toBeTruthy();
+            const exchange = await request.post(`${environment.apiUrl}/oauth/token`, {
+                form: {
+                    client_id: clientId!,
+                    code: code!,
+                    code_verifier: verifier,
+                    grant_type: 'authorization_code',
+                    redirect_uri: redirectUri,
+                    resource
+                }
+            });
+            expect(exchange.status()).toBe(200);
+            const tokens = (await exchange.json()) as OAuthTokens;
+            expect(tokens.access_token).toEqual(expect.any(String));
+            expect(tokens.token_type).toBe('Bearer');
+            issuedTokens.push(tokens.access_token);
+            return tokens;
+        }
+    } finally {
+        const cleanupErrors: Error[] = [];
+        await runCleanupStep(cleanupErrors, 'close administrator browser', () => administratorContext.close());
+        for (const token of issuedTokens) {
+            await runCleanupStep(cleanupErrors, 'revoke synthetic OAuth grant', async () => {
+                const response = await request.post(`${environment.apiUrl}/oauth/revoke`, { form: { client_id: clientId!, token } });
+                expect(response.status()).toBe(200);
+            });
+        }
+        if (clientId) {
+            await runCleanupStep(cleanupErrors, 'delete synthetic OAuth application', async () => {
+                applicationId ??= (await findApplication())?.id;
+                expect(applicationId).toBeTruthy();
+                const response = await request.delete(`${environment.apiUrl}/admin/oauth-applications/${applicationId}`, { headers: administratorHeaders });
+                expect([204, 404]).toContain(response.status());
+            });
+        }
+        throwIfCleanupFailed(cleanupErrors);
+    }
+});

From 1338c45a07d2a8411edb2f209cd940250267a004 Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Sun, 4 Oct 2026 21:17:21 -0500
Subject: [PATCH 4/6] Clarify validated OAuth consent controls and reuse
 problem messages

---
 docs/docs/api/index.md                        |   4 +-
 .../ClientApp/e2e/tests/oauth-consent.e2e.ts  |  64 +++++-
 .../e2e/tests/oauth-live-consent.e2e.ts       |  21 +-
 .../lib/features/shared/validation.test.ts    |  91 ++++++---
 .../src/lib/features/shared/validation.ts     |   8 +-
 .../(auth)/oauth/authorize/+page.svelte       |  16 +-
 .../authorize/authorize-page.svelte.test.ts   | 186 +++++++++++++-----
 .../oauth/authorize/oauth-error.test.ts       |  22 ---
 .../(auth)/oauth/authorize/oauth-error.ts     |  17 --
 .../Api/Endpoints/OAuthEndpointTests.cs       | 106 +++++-----
 .../OAuthAuthorizationValidationTests.cs      |  26 ++-
 11 files changed, 380 insertions(+), 181 deletions(-)
 delete mode 100644 src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts
 delete mode 100644 src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts

diff --git a/docs/docs/api/index.md b/docs/docs/api/index.md
index 1f9ab86f43..032da52880 100644
--- a/docs/docs/api/index.md
+++ b/docs/docs/api/index.md
@@ -22,9 +22,9 @@ Dynamic registration without a scope uses `mcp:read projects:read stacks:read ev
 
 If authorization reports scopes that are not allowed for the application, restart the client's authorization flow requesting an allowed subset. Keep `mcp:read` for MCP access. Changing checkboxes on a failed consent page does not validate a new request.
 
-To enable additional scopes, a **global administrator** must:
+Client software should register the scopes it will request. A **global administrator** can review an existing application’s allowed scopes:
 
-1. Open **System → OAuth Apps** (`/next/system/oauth-applications` in version 8.10.0; `/system/oauth-applications` after the Svelte app moves to the root).
+1. Open **System → OAuth Apps** (`/system/oauth-applications`).
 2. Change the default **Authorized** filter to **Not authorized** or **All applications** if the application has never completed consent.
 3. Find the application using the exact client ID from the authorization request, then select **Edit application**.
 4. Review and select **Stacks Write** and/or **Offline Access** as needed, then select **Save Changes**.
diff --git a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
index 93deae522f..4190ea76f1 100644
--- a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
+++ b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
@@ -1,11 +1,14 @@
 import { expect, test } from '@playwright/test';
 
-test('OAuth consent displays scope-policy errors and validates a restarted request before approval', async ({ page }) => {
+test('AuthorizeConsent_InvalidAndRestartedRequests_UsesOnlyCurrentValidation', async ({ page }) => {
+    // Arrange
     const errorDescription =
         'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.';
     let consentRequests = 0;
     let authorizationRequests = 0;
     let completeStaleConsent: (() => void) | undefined;
+    let completeSameQueryConsent: (() => void) | undefined;
+    let sameQueryRequests = 0;
     await page.addInitScript(() => window.localStorage.setItem('satellizer_token', 'test-consent-session'));
     // This browser regression exercises the production page and FetchClient with HTTP responses.
     // Service policy and issuance are covered separately by OAuthEndpointTests.
@@ -18,9 +21,16 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
         } else if (path.endsWith('/oauth/authorize/consent')) {
             consentRequests++;
             const body = route.request().postDataJSON() as { client_id: string; scope: string };
-            if (body.client_id === 'stale-client') {
+            if (body.client_id === 'same-query-client') {
+                sameQueryRequests++;
+            }
+            if (body.client_id === 'stale-client' || (body.client_id === 'same-query-client' && sameQueryRequests === 1)) {
                 await new Promise<void>((resolve) => {
-                    completeStaleConsent = resolve;
+                    if (body.client_id === 'same-query-client') {
+                        completeSameQueryConsent = resolve;
+                    } else {
+                        completeStaleConsent = resolve;
+                    }
                 });
                 await route.fulfill({ json: { error: 'invalid_scope', error_description: 'Stale request error' }, status: 400 });
                 return;
@@ -48,23 +58,31 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
         scope: 'mcp:read projects:read stacks:read stacks:write events:read offline_access'
     });
     try {
+        // Act
         await page.goto(`/oauth/authorize?${parameters}`);
+        // Assert
         await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
         await expect(page.getByText('Required', { exact: true })).toHaveCount(1);
         await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
-        await page.getByRole('checkbox', { name: /Stacks Write/ }).click();
-        await page.getByRole('checkbox', { name: /Offline Access/ }).click();
+        await expect(page.getByRole('checkbox', { name: /Stacks Write/ })).toBeDisabled();
+        await expect(page.getByRole('checkbox', { name: /Offline Access/ })).toBeDisabled();
+        await expect(page.getByRole('checkbox', { name: 'Test Organization' })).toBeDisabled();
         await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
         expect(consentRequests).toBe(1);
         expect(authorizationRequests).toBe(0);
         await page.screenshot({ fullPage: true, path: test.info().outputPath('scope-error.png') });
 
+        // Act: restart with an allowed request.
         parameters.set('scope', 'mcp:read');
         await page.goto(`/oauth/authorize?${parameters}`);
+        // Assert
         await expect(page.getByText('Test Client', { exact: true })).toBeVisible();
+        await expect(page.getByRole('checkbox', { name: 'Test Organization' })).toBeEnabled();
         await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
         expect(consentRequests).toBe(2);
+        // Act
         await page.getByRole('button', { exact: true, name: 'Approve' }).click();
+        // Assert
         await expect(page.getByText(errorDescription, { exact: true })).toBeVisible();
         expect(authorizationRequests).toBe(1);
 
@@ -80,14 +98,21 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
             await page.getByRole('link', { name: 'Change authorization request' }).click();
         }
 
+        // Act: a new query must clear the preceding request's error.
         parameters.set('scope', 'mcp:read projects:read');
         await navigateWithQuery();
         await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+        // Assert
         await expect(page.getByText(errorDescription, { exact: true })).toHaveCount(0);
+        await expect(page.getByRole('checkbox', { name: /Projects Read/ })).toBeEnabled();
 
+        // Act: hold an obsolete request while navigating to another client.
         parameters.set('client_id', 'stale-client');
         await navigateWithQuery();
         await expect.poll(() => Boolean(completeStaleConsent)).toBe(true);
+        // Assert
+        await expect(page.getByRole('checkbox', { name: /Projects Read/ })).toBeDisabled();
+        await expect(page.getByRole('checkbox', { name: 'Test Organization' })).toBeDisabled();
         await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
         parameters.set('client_id', 'test-client');
         await navigateWithQuery();
@@ -95,11 +120,40 @@ test('OAuth consent displays scope-policy errors and validates a restarted reque
         const staleResponse = page.waitForResponse(
             (response) => response.url().endsWith('/oauth/authorize/consent') && response.request().postDataJSON().client_id === 'stale-client'
         );
+        // Act
         completeStaleConsent?.();
         await (await staleResponse).finished();
+        // Assert
+        await expect(page.getByText('Stale request error', { exact: true })).toHaveCount(0);
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+
+        // Arrange: A1 and A2 have identical queries; URL equality cannot reject A1.
+        parameters.set('client_id', 'same-query-client');
+        await navigateWithQuery();
+        await expect.poll(() => Boolean(completeSameQueryConsent)).toBe(true);
+        await expect(page.getByRole('checkbox', { name: /Projects Read/ })).toBeDisabled();
+
+        // Act: navigate A → B → A, letting A2 validate before A1 completes.
+        parameters.set('client_id', 'test-client');
+        await navigateWithQuery();
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+        parameters.set('client_id', 'same-query-client');
+        await navigateWithQuery();
+        await expect.poll(() => sameQueryRequests).toBe(2);
+        await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+        const sameQueryResponse = page.waitForResponse(
+            (response) => response.url().endsWith('/oauth/authorize/consent') && response.request().postDataJSON().client_id === 'same-query-client'
+        );
+        completeSameQueryConsent?.();
+        await (await sameQueryResponse).finished();
+
+        // Assert
         await expect(page.getByText('Stale request error', { exact: true })).toHaveCount(0);
+        await expect(page.getByRole('checkbox', { name: /Projects Read/ })).toBeEnabled();
+        await expect(page.getByRole('checkbox', { name: 'Test Organization' })).toBeEnabled();
         await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
     } finally {
+        completeSameQueryConsent?.();
         completeStaleConsent?.();
     }
 });
diff --git a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts
index ff02d8e5af..af6c70ac6d 100644
--- a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts
+++ b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-live-consent.e2e.ts
@@ -21,13 +21,7 @@ test.skip(
 );
 test.use({ e2eUseGeneratedUser: true });
 
-test('a global administrator enables client scopes and a member restarts consent to obtain and refresh only the selected grant', async ({
-    browser,
-    e2eApi,
-    e2eScenario,
-    page,
-    request
-}) => {
+test('AuthorizeConsent_ExpandedClientRegistration_RequiresFreshMemberGrant', async ({ browser, e2eApi, e2eScenario, page, request }) => {
     const readScopes = ['mcp:read', 'projects:read', 'stacks:read', 'events:read'];
     const allScopes = [...readScopes, 'stacks:write', 'offline_access'];
     const applicationName = `OAuth live ${e2eScenario.run}`;
@@ -58,6 +52,7 @@ test('a global administrator enables client scopes and a member restarts consent
         const { resource } = (await metadataResponse.json()) as { resource: string };
 
         await test.step('register a restricted client and show its actual denied-scope response', async () => {
+            // Act
             const registrationResponse = await request.post(`${environment.apiUrl}/oauth/register`, {
                 data: {
                     client_name: applicationName,
@@ -68,6 +63,7 @@ test('a global administrator enables client scopes and a member restarts consent
                     token_endpoint_auth_method: 'none'
                 }
             });
+            // Assert
             expect(registrationResponse.status()).toBe(201);
             clientId = ((await registrationResponse.json()) as { client_id: string }).client_id;
             expect(clientId).toMatch(/^dcr_/);
@@ -82,12 +78,17 @@ test('a global administrator enables client scopes and a member restarts consent
             await page.goto(authorizationUrl(allScopes));
             await expect(page.getByText(/^Scopes not allowed for this application: stacks:write, offline_access\./)).toBeVisible();
             await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeDisabled();
+            await expect(page.getByRole('checkbox', { name: /Stacks Write/ })).toBeDisabled();
+            await expect(page.getByRole('checkbox', { name: /Offline Access/ })).toBeDisabled();
+            await expect(page.getByRole('checkbox', { exact: true, name: e2eScenario.organizationName })).toBeDisabled();
         });
 
         await administratorContext.addInitScript((token) => window.localStorage.setItem('satellizer_token', token), administratorToken);
         const administratorPage = await administratorContext.newPage();
         await test.step('find the failed registration through Not authorized', async () => {
+            // Act
             await administratorPage.goto(`/system/oauth-applications?criteria=${encodeURIComponent(applicationName)}`);
+            // Assert
             await expect(administratorPage.getByRole('button', { name: 'Filter by authorization' })).toHaveText('Authorized');
             await expect(administratorPage.getByRole('link', { exact: true, name: applicationName })).toHaveCount(0);
             await administratorPage.getByRole('button', { name: 'Filter by authorization' }).click();
@@ -100,7 +101,9 @@ test('a global administrator enables client scopes and a member restarts consent
         });
 
         const limitedGrant = await test.step('consent to an allowed subset without offline access', async () => {
+            // Act
             const tokens = await approveAndExchange(readScopes);
+            // Assert
             expect(tokens.refresh_token).toBeUndefined();
             expect(tokens.scope.split(' ')).toEqual(readScopes);
             return tokens;
@@ -131,7 +134,9 @@ test('a global administrator enables client scopes and a member restarts consent
         });
 
         await test.step('restart with the same client and exchange and rotate the fresh consent grant', async () => {
+            // Act
             const granted = await approveAndExchange(allScopes);
+            // Assert
             expect(granted.scope.split(' ').toSorted()).toEqual(allScopes.toSorted());
             expect(granted.refresh_token).toEqual(expect.any(String));
             const response = await request.post(`${environment.apiUrl}/oauth/token`, {
@@ -169,6 +174,8 @@ test('a global administrator enables client scopes and a member restarts consent
             await page.goto(authorizationUrl(scopes, verifier));
             await expect(page.getByRole('checkbox', { exact: true, name: e2eScenario.organizationName })).toBeChecked();
             await expect(page.getByRole('button', { exact: true, name: 'Approve' })).toBeEnabled();
+            await expect(page.getByRole('checkbox', { name: /Projects Read/ })).toBeEnabled();
+            await expect(page.getByRole('checkbox', { exact: true, name: e2eScenario.organizationName })).toBeEnabled();
             const authorizationResponse = page.waitForResponse(
                 (response) => response.request().method() === 'POST' && new URL(response.url()).pathname === '/api/v2/oauth/authorize'
             );
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts
index 0f810c5241..2fdaa53e16 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts
@@ -3,7 +3,40 @@ import { describe, expect, it } from 'vitest';
 import { getProblemMessage, problemDetailsToFormErrors } from './validation';
 
 describe('getProblemMessage', () => {
-    it('returns the title from a plain problem details payload', () => {
+    it('GetProblemMessage_NonProblemError_ReturnsFallback', () => {
+        // Arrange
+        const error = new Error('boom');
+
+        // Act
+        const actual = getProblemMessage(error, 'Please try again.');
+
+        // Assert
+        expect(actual).toBe('Please try again.');
+    });
+
+    it.each([
+        [{ error_description: 'OAuth description' }, 'OAuth description'],
+        [{ error: 'invalid_scope' }, 'invalid_scope'],
+        [{ error: 'invalid_scope', error_description: 'OAuth description', title: 'Bad Request' }, 'OAuth description'],
+        [{ detail: 'Problem detail' }, 'Problem detail'],
+        [{ title: 'Problem title' }, 'Problem title'],
+        [{ detail: 7, error: [], error_description: {}, title: false }, 'Fallback'],
+        [{ detail: 'Problem detail', error_description: '  ' }, 'Problem detail'],
+        [null, 'Fallback'],
+        ['Malformed body', 'Fallback']
+    ])('GetProblemMessage_OAuthPayload_ReturnsSafeMessage: %j', (problem, expected) => {
+        // Arrange
+        const fallback = 'Fallback';
+
+        // Act
+        const actual = getProblemMessage(problem, fallback);
+
+        // Assert
+        expect(actual).toBe(expected);
+    });
+
+    it('GetProblemMessage_ProblemPayload_ReturnsTitle', () => {
+        // Arrange
         const problem = {
             instance: 'DELETE /api/v2/organizations/6a121886ad40fc0017a40d3c',
             status: 400,
@@ -12,48 +45,52 @@ describe('getProblemMessage', () => {
             type: 'https://tools.ietf.org/html/rfc9110#section-15.5.1'
         };
 
-        expect(getProblemMessage(problem, 'Please try again.')).toBe('An organization cannot be deleted if it has a subscription.');
+        // Act
+        const actual = getProblemMessage(problem, 'Please try again.');
+
+        // Assert
+        expect(actual).toBe('An organization cannot be deleted if it has a subscription.');
     });
 
-    it('prefers validation errors when present', () => {
+    it('GetProblemMessage_ValidationErrors_PrefersValidationMessage', () => {
+        // Arrange
         const problem = {
-            errors: {
-                general: ['The uploaded file is too large.']
-            },
+            errors: { general: ['The uploaded file is too large.'] },
             status: 422,
             title: 'Validation failed.'
         };
 
-        expect(getProblemMessage(problem, 'Please try again.')).toBe('The uploaded file is too large.');
-    });
+        // Act
+        const actual = getProblemMessage(problem, 'Please try again.');
 
-    it('falls back when the error is not problem details shaped', () => {
-        expect(getProblemMessage(new Error('boom'), 'Please try again.')).toBe('Please try again.');
+        // Assert
+        expect(actual).toBe('The uploaded file is too large.');
     });
 });
 
 describe('problemDetailsToFormErrors', () => {
     it.each([{ status: 400 }, { status: 422 }, { errors: {}, status: 422 }, { errors: { version: [] }, status: 422 }])(
-        'shows the problem message when there are no field errors: %j',
+        'ProblemDetailsToFormErrors_NoFieldErrors_ReturnsProblemMessage: %j',
         (details) => {
-            const problem = {
-                ...details,
-                title: 'An organization cannot be deleted if it has a subscription.'
-            };
-
-            expect(problemDetailsToFormErrors(problem as never)).toEqual({
-                form: 'An organization cannot be deleted if it has a subscription.'
-            });
+            // Arrange
+            const problem = { ...details, title: 'An organization cannot be deleted if it has a subscription.' };
+
+            // Act
+            const actual = problemDetailsToFormErrors(problem as never);
+
+            // Assert
+            expect(actual).toEqual({ form: 'An organization cannot be deleted if it has a subscription.' });
         }
     );
 
-    it('preserves specific field errors without adding the generic title', () => {
-        expect(
-            problemDetailsToFormErrors({
-                errors: { version: ['Version is invalid.'] },
-                status: 422,
-                title: 'Validation failed.'
-            } as never)
-        ).toEqual({ fields: { version: 'Version is invalid.' } });
+    it('ProblemDetailsToFormErrors_SpecificFieldErrors_OmitsGenericTitle', () => {
+        // Arrange
+        const problem = { errors: { version: ['Version is invalid.'] }, status: 422, title: 'Validation failed.' };
+
+        // Act
+        const actual = problemDetailsToFormErrors(problem as never);
+
+        // Assert
+        expect(actual).toEqual({ fields: { version: 'Version is invalid.' } });
     });
 });
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts
index 989415d1c5..51439c579a 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts
@@ -10,6 +10,8 @@ export type FieldWithErrors = {
 
 type ProblemDetailsLike = {
     detail?: unknown;
+    error?: unknown;
+    error_description?: unknown;
     errors?: Record<string, unknown>;
     message?: unknown;
     status?: unknown;
@@ -121,7 +123,7 @@ export function getProblemMessage(error: unknown, fallback: string): string {
         return fallback;
     }
 
-    const candidates: unknown[] = [error.message];
+    const candidates: unknown[] = [error.error_description, error.error, error.message];
     for (const value of Object.values(error.errors ?? {})) {
         if (Array.isArray(value)) {
             candidates.push(...value);
@@ -234,7 +236,7 @@ export function problemDetailsToFormErrors(problem: null | ProblemDetails): null
 }
 
 function isNonEmptyString(value: unknown): value is string {
-    return typeof value === 'string' && value.length > 0;
+    return typeof value === 'string' && value.trim().length > 0;
 }
 
 function isProblemDetailsLike(error: unknown): error is ProblemDetailsLike {
@@ -242,5 +244,5 @@ function isProblemDetailsLike(error: unknown): error is ProblemDetailsLike {
         return false;
     }
 
-    return 'title' in error || 'detail' in error || 'errors' in error || 'status' in error;
+    return 'title' in error || 'detail' in error || 'errors' in error || 'status' in error || 'error_description' in error || 'error' in error;
 }
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
index f7fc6e7df5..1a937a7d26 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte
@@ -15,11 +15,10 @@
     import { clearAuthenticationSession } from '$features/auth/session.svelte';
     import { getOrganizationsQuery } from '$features/organizations/api.svelte';
     import { getMeQuery } from '$features/users/api.svelte';
+    import { getProblemMessage } from '$shared/validation';
     import { useFetchClient } from '@foundatiofx/fetchclient';
     import { SvelteSet } from 'svelte/reactivity';
 
-    import { getOAuthErrorMessage } from './oauth-error';
-
     interface OAuthAuthorizeConsentResponse {
         client_id?: string;
         client_name?: string;
@@ -88,6 +87,7 @@
     const hasSelectedOrganizations = $derived(selectedOrganizationIds.size > 0);
     const hasSelectedResourceScope = $derived(selectedScopeValues.some((scope) => scope !== offlineAccessScope));
     const hasRequiredScopes = $derived(missingRequiredScopes.length === 0 && requiredScopes.every((scope) => selectedScopes.has(scope)));
+    const canSelectConsent = $derived(Boolean(consentDetails) && !isLoadingConsent && !consentErrorMessage && !isAuthorizing);
     const canApprove = $derived(
         Boolean(consentDetails) && !isLoadingConsent && !consentErrorMessage && hasSelectedOrganizations && hasSelectedResourceScope && hasRequiredScopes
     );
@@ -199,7 +199,7 @@
             return;
         }
 
-        errorMessage = getOAuthErrorMessage(response, 'Unable to authorize application.');
+        errorMessage = getProblemMessage(response.data, getProblemMessage(response.problem, 'Unable to authorize application.'));
     }
 
     function cancelAuthorization() {
@@ -267,6 +267,7 @@
     }
 
     async function loadConsentDetails(): Promise<void> {
+        // A → B → A navigation can leave an older request with the same query; only the newest response owns this state.
         const requestId = ++consentRequestId;
         const consentKey = page.url.search;
         isLoadingConsent = true;
@@ -298,7 +299,7 @@
         }
 
         consentDetails = null;
-        consentErrorMessage = getOAuthErrorMessage(response, 'Unable to load application details.');
+        consentErrorMessage = getProblemMessage(response.data, getProblemMessage(response.problem, 'Unable to load application details.'));
     }
 
     async function redirectToLogin(): Promise<void> {
@@ -368,6 +369,7 @@
                                 <label class="hover:bg-muted/50 flex min-h-8 items-center gap-2 rounded-sm px-2 text-sm">
                                     <Checkbox
                                         checked={selectedOrganizationIds.has(organization.id)}
+                                        disabled={!canSelectConsent}
                                         onCheckedChange={(checked) => toggleOrganization(organization.id, checked)}
                                     />
                                     <span class="min-w-0 flex-1 truncate font-medium">{organization.name}</span>
@@ -419,7 +421,11 @@
                         {/each}
                         {#each requestedOptionalScopes as scope (scope)}
                             <label class="hover:bg-muted/50 flex min-h-12 items-center gap-2 rounded-sm border px-2 py-1.5 text-sm">
-                                <Checkbox checked={selectedScopes.has(scope)} onCheckedChange={(checked) => toggleScope(scope, checked)} />
+                                <Checkbox
+                                    checked={selectedScopes.has(scope)}
+                                    disabled={!canSelectConsent}
+                                    onCheckedChange={(checked) => toggleScope(scope, checked)}
+                                />
                                 <span class="min-w-0 flex-1">
                                     <span class="block truncate font-medium">{formatScope(scope)}</span>
                                     <span class="text-muted-foreground block truncate font-mono text-xs">{scope}</span>
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts
index 7020631420..40dbbee6be 100644
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/authorize-page.svelte.test.ts
@@ -28,8 +28,7 @@ vi.mock('@foundatiofx/fetchclient', async (importOriginal) => ({
     useFetchClient: mocks.useFetchClient
 }));
 
-const scopeError =
-    'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps.';
+const scopeError = 'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with scopes allowed for this application.';
 
 function consentResponse() {
     return jsonResponse({ client_id: 'test-client', client_name: 'Test Client', required_scopes: ['mcp:read'], scopes: ['mcp:read', 'offline_access'] });
@@ -46,20 +45,39 @@ describe('OAuth authorization', () => {
         );
     });
 
-    it('shows the actual FetchClient OAuth error on failed consent and keeps approval disabled after scope edits', async () => {
-        const fetch = vi.fn().mockResolvedValue(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
+    it('ApproveAuthorization_DuplicateSubmission_SendsOneRequest', async () => {
+        // Arrange
+        let complete: (response: Response) => void = () => {};
+        const fetch = vi
+            .fn()
+            .mockResolvedValueOnce(consentResponse())
+            .mockImplementationOnce(
+                () =>
+                    new Promise<Response>((resolve) => {
+                        complete = resolve;
+                    })
+            );
         mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
         render(AuthorizePage);
+        const approve = screen.getByRole('button', { name: 'Approve' });
+        await waitFor(() => expect(approve).toBeEnabled());
 
+        // Act
+        await fireEvent.click(approve);
+        await fireEvent.click(approve);
+
+        // Assert
+        expect(approve).toBeDisabled();
+        expect(screen.getByRole('checkbox', { name: /Offline Access/ })).toBeDisabled();
+        expect(screen.getByRole('checkbox', { name: 'Test Organization' })).toBeDisabled();
+        await waitFor(() => expect(fetch).toHaveBeenCalledTimes(2));
+        complete(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
         expect(await screen.findByText(scopeError)).toBeVisible();
-        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
-        expect(screen.getAllByText('Required')).toHaveLength(1);
-        await fireEvent.click(screen.getByRole('checkbox', { name: /Stacks Write/ }));
-        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
-        expect(fetch).toHaveBeenCalledOnce();
+        expect(fetch).toHaveBeenCalledTimes(2);
     });
 
-    it('shows the actual FetchClient OAuth error when final authorization fails', async () => {
+    it('ApproveAuthorization_FailedRequest_ShowsOAuthDescription', async () => {
+        // Arrange
         const fetch = vi
             .fn()
             .mockResolvedValueOnce(consentResponse())
@@ -67,66 +85,144 @@ describe('OAuth authorization', () => {
         mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
         render(AuthorizePage);
         await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
+
+        // Act
         await fireEvent.click(screen.getByRole('button', { name: 'Approve' }));
 
+        // Assert
         expect(await screen.findByText(scopeError)).toBeVisible();
         expect(fetch).toHaveBeenCalledTimes(2);
     });
 
-    it.each(['consent', 'approval'])('returns to login with the original query after session expiry during %s', async (stage) => {
-        const fetch = vi.fn();
-        if (stage === 'approval') {
-            fetch.mockResolvedValueOnce(consentResponse());
-        }
-
-        fetch.mockResolvedValueOnce(jsonResponse({}, 401));
-        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
-        render(AuthorizePage);
-        if (stage === 'approval') {
-            await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
-            await fireEvent.click(screen.getByRole('button', { name: 'Approve' }));
-        }
-
-        await waitFor(() => expect(mocks.clearSession).toHaveBeenCalledOnce());
-        expect(mocks.goto).toHaveBeenCalledWith(`/login?redirect=${encodeURIComponent(mocks.page.url.pathname + mocks.page.url.search)}`, {
-            replaceState: true
-        });
-    });
-
-    it('sends one authorization request while approval is pending and cancel sends none', async () => {
-        let complete: (response: Response) => void = () => {};
+    it('ApproveAuthorization_ValidSelection_SubmitsOnlySelectedScopes', async () => {
+        // Arrange
         const fetch = vi
             .fn()
             .mockResolvedValueOnce(consentResponse())
-            .mockImplementationOnce(
-                () =>
-                    new Promise<Response>((resolve) => {
-                        complete = resolve;
-                    })
-            );
+            .mockResolvedValueOnce(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
         mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
         render(AuthorizePage);
         const approve = screen.getByRole('button', { name: 'Approve' });
         await waitFor(() => expect(approve).toBeEnabled());
+        const organization = screen.getByRole('checkbox', { name: 'Test Organization' });
+
+        // Act: removing the last organization must leave its selection editable.
+        await fireEvent.click(organization);
+
+        // Assert
+        expect(approve).toBeDisabled();
+        expect(organization).toBeEnabled();
+
+        // Act: restore membership selection and decline optional offline access.
+        await fireEvent.click(organization);
+        await fireEvent.click(screen.getByRole('checkbox', { name: /Offline Access/ }));
+        await fireEvent.click(approve);
+
+        // Assert
+        await waitFor(() => expect(fetch).toHaveBeenCalledTimes(2));
+        const request = fetch.mock.calls[1]![0] as Request;
+        const body = await request.json();
+        expect(body.scope).toBe('mcp:read');
+        expect(body.organization_ids).toEqual(['organization-1']);
+    });
+
+    it('CancelAuthorization_ValidatedRequest_DoesNotSendAuthorizationRequest', async () => {
+        // Arrange
+        const fetch = vi.fn().mockResolvedValueOnce(consentResponse());
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+        render(AuthorizePage);
+        await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
+
+        // Act
         await fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+
+        // Assert
         expect(await screen.findByText('Authorization canceled. You can close this tab.')).toBeVisible();
         expect(fetch).toHaveBeenCalledOnce();
-        await fireEvent.click(approve);
-        await fireEvent.click(approve);
-        expect(approve).toBeDisabled();
-        await waitFor(() => expect(fetch).toHaveBeenCalledTimes(2));
-        complete(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
+    });
+
+    it('LoadConsent_FailedRequest_DisablesSelectionsAndApproval', async () => {
+        // Arrange
+        const fetch = vi.fn().mockResolvedValue(jsonResponse({ error: 'invalid_scope', error_description: scopeError }, 400));
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+
+        // Act
+        render(AuthorizePage);
+
+        // Assert
         expect(await screen.findByText(scopeError)).toBeVisible();
-        expect(fetch).toHaveBeenCalledTimes(2);
+        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
+        expect(screen.getAllByText('Required')).toHaveLength(1);
+        expect(screen.getByRole('checkbox', { name: /Stacks Write/ })).toBeDisabled();
+        expect(screen.getByRole('checkbox', { name: /Offline Access/ })).toBeDisabled();
+        expect(screen.getByRole('checkbox', { name: 'Test Organization' })).toBeDisabled();
+        expect(fetch).toHaveBeenCalledOnce();
     });
 
-    it('renders an error as text without creating HTML', async () => {
+    it('LoadConsent_PendingRequest_DisablesSelectionsUntilValidated', async () => {
+        // Arrange
+        let complete: (response: Response) => void = () => {};
+        const fetch = vi.fn().mockImplementation(
+            () =>
+                new Promise<Response>((resolve) => {
+                    complete = resolve;
+                })
+        );
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+
+        // Act
+        render(AuthorizePage);
+        await waitFor(() => expect(fetch).toHaveBeenCalledOnce());
+
+        // Assert
+        expect(screen.getByRole('checkbox', { name: /Offline Access/ })).toBeDisabled();
+        expect(screen.getByRole('checkbox', { name: 'Test Organization' })).toBeDisabled();
+        expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
+
+        // Act
+        complete(consentResponse());
+
+        // Assert
+        await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
+        expect(screen.getByRole('checkbox', { name: /Offline Access/ })).toBeEnabled();
+        expect(screen.getByRole('checkbox', { name: 'Test Organization' })).toBeEnabled();
+    });
+
+    it('LoadConsent_UntrustedDescription_RendersText', async () => {
+        // Arrange
         const description = '<img src=x onerror=alert(1)>';
         const fetch = vi.fn().mockResolvedValue(jsonResponse({ error_description: description }, 400));
         mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+
+        // Act
         const { container } = render(AuthorizePage);
+
+        // Assert
         expect(await screen.findByText(description)).toBeVisible();
         expect(container.querySelector('img[src="x"]')).toBeNull();
         expect(screen.getByRole('button', { name: 'Approve' })).toBeDisabled();
     });
+
+    it.each(['consent', 'approval'])('Session_ExpiredDuring%s_RedirectsWithOriginalQuery', async (stage) => {
+        // Arrange
+        const fetch = vi.fn();
+        if (stage === 'approval') {
+            fetch.mockResolvedValueOnce(consentResponse());
+        }
+        fetch.mockResolvedValueOnce(jsonResponse({}, 401));
+        mocks.useFetchClient.mockReturnValue(new FetchClient({ baseUrl: 'http://localhost/api/v2/', fetch }));
+
+        // Act
+        render(AuthorizePage);
+        if (stage === 'approval') {
+            await waitFor(() => expect(screen.getByRole('button', { name: 'Approve' })).toBeEnabled());
+            await fireEvent.click(screen.getByRole('button', { name: 'Approve' }));
+        }
+
+        // Assert
+        await waitFor(() => expect(mocks.clearSession).toHaveBeenCalledOnce());
+        expect(mocks.goto).toHaveBeenCalledWith(`/login?redirect=${encodeURIComponent(mocks.page.url.pathname + mocks.page.url.search)}`, {
+            replaceState: true
+        });
+    });
 });
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts
deleted file mode 100644
index 9ede6ca18d..0000000000
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.test.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { getOAuthErrorMessage } from './oauth-error';
-
-describe('OAuth error messages', () => {
-    it.each([
-        [{ error_description: 'OAuth description' }, 'OAuth description'],
-        [{ error: 'invalid_scope' }, 'invalid_scope'],
-        [{ detail: 'Problem detail' }, 'Problem detail'],
-        [{ title: 'Problem title' }, 'Problem title'],
-        [{ detail: 7, error: [], error_description: {}, title: false }, 'Fallback'],
-        [{ detail: 'Problem detail', error_description: '  ' }, 'Problem detail'],
-        [null, 'Fallback'],
-        ['Malformed body', 'Fallback']
-    ])('handles OAuth, ordinary problem details, and malformed bodies: %j', (problem, expected) => {
-        expect(getOAuthErrorMessage({ data: null, problem }, 'Fallback')).toBe(expected);
-    });
-
-    it('retains the description from a parsed response body', () => {
-        expect(getOAuthErrorMessage({ data: { error_description: 'Description' }, problem: { title: 'Title' } }, 'Fallback')).toBe('Description');
-    });
-});
diff --git a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts b/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts
deleted file mode 100644
index a33e834879..0000000000
--- a/src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/oauth-error.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-export function getOAuthErrorMessage(response: { data: unknown; problem: unknown }, fallback: string): string {
-    for (const body of [response.data, response.problem]) {
-        if (!body || typeof body !== 'object') {
-            continue;
-        }
-
-        const error = body as Record<string, unknown>;
-        for (const key of ['error_description', 'error', 'detail', 'title']) {
-            const value = error[key];
-            if (typeof value === 'string' && value.trim()) {
-                return value;
-            }
-        }
-    }
-
-    return fallback;
-}
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
index ba4be5b8e5..221a742c7f 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
@@ -608,14 +608,67 @@ public async Task CompleteAuthorizeAsync_WithoutOrganizations_ReturnsBadRequest(
         Assert.Equal("Select at least one organization.", error.ErrorDescription);
     }
 
+    [Theory]
+    [InlineData(null, "stacks:write")]
+    [InlineData("mcp:read projects:read stacks:read events:read", "stacks:write, offline_access")]
+    [InlineData("mcp:read projects:read stacks:read stacks:write events:read offline_access", null)]
+    public async Task AuthorizeAsync_DynamicClientScopes_ValidatesConsentAndFinalRequest(string? registeredScopes, string? deniedScopes)
+    {
+        // Arrange: reproduce both omitted registration scope and an explicit read-only client.
+        using var client = CreateHttpClient();
+        var registrationResponse = await client.PostAsJsonAsync("oauth/register", new OAuthClientRegistrationRequest
+        {
+            ClientName = "Scope Regression Client",
+            RedirectUris = [RedirectUri],
+            Scope = registeredScopes
+        }, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, registrationResponse.StatusCode);
+        var registration = await DeserializeResponseAsync<OAuthClientRegistrationResponse>(registrationResponse);
+        Assert.NotNull(registration);
+        string requestedScopes = String.Join(' ', OAuthService.SupportedScopes);
+
+        // Both endpoints enforce the same client policy before issuing a code.
+        foreach (string endpoint in new[] { "oauth/authorize/consent", "oauth/authorize" })
+        {
+            using var request = CreateAuthorizeJsonRequest(PkceVerifier, clientId: registration.ClientId, scope: requestedScopes, organizationIds: [SampleDataService.TEST_ORG_ID]);
+            request.RequestUri = new Uri(endpoint, UriKind.Relative);
+            // Act
+            var response = await client.SendAsync(request, TestContext.Current.CancellationToken);
+
+            // Assert
+            Assert.Equal(deniedScopes is null ? HttpStatusCode.OK : HttpStatusCode.BadRequest, response.StatusCode);
+            if (deniedScopes is not null)
+            {
+                var error = await response.DeserializeAsync<OAuthErrorResponse>(ensureSuccess: false);
+                Assert.NotNull(error);
+                Assert.Equal("invalid_scope", error.Error);
+                Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.", error.ErrorDescription);
+                Assert.DoesNotContain("redirect_uri", await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+            }
+        }
+
+        // Act: authorize an allowed subset without changing the registration.
+        var token = await IssueTokenAsync(clientId: registration.ClientId, scope: AuthorizationRoles.McpRead, organizationIds: [SampleDataService.TEST_ORG_ID]);
+
+        // Assert
+        Assert.Null(token.RefreshToken);
+        Assert.Equal(AuthorizationRoles.McpRead, token.Scope);
+        var application = await _oauthApplicationRepository.GetByClientIdAsync(registration.ClientId, o => o.ImmediateConsistency());
+        Assert.NotNull(application);
+        Assert.Equal(registration.Scope.Split(' '), application.Scopes);
+    }
+
     [Fact]
     public async Task CompleteAuthorizeAsync_ForeignOrganization_ReturnsBadRequestWithoutCode()
     {
+        // Arrange
         using var client = CreateHttpClient();
         using var request = CreateAuthorizeJsonRequest(PkceVerifier, organizationIds: [ObjectId.GenerateNewId().ToString()]);
 
+        // Act
         var response = await client.SendAsync(request, TestContext.Current.CancellationToken);
 
+        // Assert
         Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
         var error = await response.DeserializeAsync<OAuthErrorResponse>(ensureSuccess: false);
         Assert.NotNull(error);
@@ -751,52 +804,6 @@ public async Task GetAuthorizeConsentAsync_ValidRequest_ReturnsValidatedClientDe
         Assert.Empty(consent.RequiredScopes);
     }
 
-    [Theory]
-    [InlineData(null, "stacks:write")]
-    [InlineData("mcp:read projects:read stacks:read events:read", "stacks:write, offline_access")]
-    [InlineData("mcp:read projects:read stacks:read stacks:write events:read offline_access", null)]
-    public async Task AuthorizeAsync_DynamicClientScopes_ValidatesConsentAndFinalRequest(string? registeredScopes, string? deniedScopes)
-    {
-        // Arrange: reproduce both omitted registration scope and an explicit read-only client.
-        using var client = CreateHttpClient();
-        var registrationResponse = await client.PostAsJsonAsync("oauth/register", new OAuthClientRegistrationRequest
-        {
-            ClientName = "Scope Regression Client",
-            RedirectUris = [RedirectUri],
-            Scope = registeredScopes
-        }, TestContext.Current.CancellationToken);
-        Assert.Equal(HttpStatusCode.Created, registrationResponse.StatusCode);
-        var registration = await DeserializeResponseAsync<OAuthClientRegistrationResponse>(registrationResponse);
-        Assert.NotNull(registration);
-        string requestedScopes = String.Join(' ', OAuthService.SupportedScopes);
-
-        // Act and assert: both endpoints enforce the same client policy before issuing a code.
-        foreach (string endpoint in new[] { "oauth/authorize/consent", "oauth/authorize" })
-        {
-            using var request = CreateAuthorizeJsonRequest(PkceVerifier, clientId: registration.ClientId, scope: requestedScopes, organizationIds: [SampleDataService.TEST_ORG_ID]);
-            request.RequestUri = new Uri(endpoint, UriKind.Relative);
-            var response = await client.SendAsync(request, TestContext.Current.CancellationToken);
-
-            Assert.Equal(deniedScopes is null ? HttpStatusCode.OK : HttpStatusCode.BadRequest, response.StatusCode);
-            if (deniedScopes is not null)
-            {
-                var error = await response.DeserializeAsync<OAuthErrorResponse>(ensureSuccess: false);
-                Assert.NotNull(error);
-                Assert.Equal("invalid_scope", error.Error);
-                Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.", error.ErrorDescription);
-                Assert.DoesNotContain("redirect_uri", await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
-            }
-        }
-
-        // An allowed subset works without changing the client's configured scopes and without offline access.
-        var token = await IssueTokenAsync(clientId: registration.ClientId, scope: AuthorizationRoles.McpRead, organizationIds: [SampleDataService.TEST_ORG_ID]);
-        Assert.Null(token.RefreshToken);
-        Assert.Equal(AuthorizationRoles.McpRead, token.Scope);
-        var application = await _oauthApplicationRepository.GetByClientIdAsync(registration.ClientId, o => o.ImmediateConsistency());
-        Assert.NotNull(application);
-        Assert.Equal(registration.Scope.Split(' '), application.Scopes);
-    }
-
     [Fact]
     public async Task CompleteAuthorizeAsync_ClientMetadataDocument_PersistsObservedApplication()
     {
@@ -1383,13 +1390,16 @@ public async Task TokenAsync_RefreshToken_RotatesRefreshToken()
     [InlineData(true)]
     public async Task TokenAsync_ExpandedClientScopes_RequiresFreshConsent(bool originalOfflineAccess)
     {
+        // Arrange
         string originalScopes = originalOfflineAccess ? "mcp:read projects:read offline_access" : "mcp:read projects:read";
         await SetStoredOAuthApplicationScopesAsync(ClientId, originalScopes.Split(' '));
         var token = await IssueTokenAsync(scope: originalScopes);
         Assert.Equal(originalOfflineAccess, token.RefreshToken is not null);
 
+        // Act
         await SetStoredOAuthApplicationScopesAsync(ClientId, OAuthService.SupportedScopes.ToArray());
 
+        // Assert
         var storedToken = await GetStoredOAuthTokenAsync(token.AccessToken);
         Assert.NotNull(storedToken);
         Assert.DoesNotContain(AuthorizationRoles.StacksWrite, storedToken.Scopes);
@@ -1398,14 +1408,18 @@ public async Task TokenAsync_ExpandedClientScopes_RequiresFreshConsent(bool orig
         {
             using var client = CreateHttpClient();
             using var content = CreateRefreshTokenContent(token.RefreshToken);
+            // Act
             var response = await client.PostAsync("oauth/token", content, TestContext.Current.CancellationToken);
+            // Assert
             Assert.Equal(HttpStatusCode.OK, response.StatusCode);
             var refreshed = await DeserializeResponseAsync<OAuthTokenResponse>(response);
             Assert.NotNull(refreshed);
             Assert.Equal(originalScopes, refreshed.Scope);
         }
 
+        // Act
         var freshToken = await IssueTokenAsync(scope: String.Join(' ', OAuthService.SupportedScopes));
+        // Assert
         Assert.Contains(AuthorizationRoles.StacksWrite, freshToken.Scope);
         Assert.NotNull(freshToken.RefreshToken);
     }
diff --git a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
index af3882044b..43b5a35d99 100644
--- a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
+++ b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
@@ -17,6 +17,21 @@ public sealed class OAuthAuthorizationValidationTests
     private const string FourReadScopes = "mcp:read projects:read stacks:read events:read";
     private const string AllScopes = "mcp:read projects:read stacks:read stacks:write events:read offline_access";
 
+    [Fact]
+    public void GetActiveOAuthOrganizationIds_RemovedMembership_ReturnsNoOrganizations()
+    {
+        // Arrange
+        var user = new User { OrganizationIds = ["organization-1"] };
+        var token = new OAuthToken { OrganizationIds = ["organization-1"] };
+        user.OrganizationIds.Clear();
+
+        // Act
+        var organizationIds = user.GetActiveOAuthOrganizationIds(token);
+
+        // Assert
+        Assert.Empty(organizationIds);
+    }
+
     [Theory]
     [InlineData(false, false)]
     [InlineData(false, true)]
@@ -24,6 +39,7 @@ public sealed class OAuthAuthorizationValidationTests
     [InlineData(true, true)]
     public void ToIdentity_OAuthGrant_DoesNotInheritGlobalRoleOrForeignOrganization(bool globalAdministrator, bool writeScope)
     {
+        // Arrange
         var user = new User
         {
             Id = "user-1",
@@ -40,13 +56,13 @@ public void ToIdentity_OAuthGrant_DoesNotInheritGlobalRoleOrForeignOrganization(
             OrganizationIds = ["organization-1", "foreign-organization"]
         };
 
+        // Act
         var identity = user.ToIdentity(token);
 
+        // Assert
         Assert.DoesNotContain(identity.Claims, claim => claim.Type == ClaimTypes.Role && claim.Value == AuthorizationRoles.GlobalAdmin);
         Assert.Equal(writeScope, identity.HasClaim(ClaimTypes.Role, AuthorizationRoles.StacksWrite));
         Assert.Equal("organization-1", identity.FindFirst(IdentityUtils.OrganizationIdsClaim)?.Value);
-        user.OrganizationIds.Clear();
-        Assert.Empty(user.GetActiveOAuthOrganizationIds(token));
     }
 
     [Theory]
@@ -82,10 +98,13 @@ public async Task ValidateAuthorizationRequestAsync_ClientScopeCombinations_Enfo
     [InlineData("mcp:read <script>unknown</script>")]
     public async Task ValidateAuthorizationRequestAsync_InvalidScopes_DeniesWithoutReflectingUnknownScopes(string scopes)
     {
+        // Arrange
         var (service, _) = CreateService(AllScopes);
 
+        // Act
         var result = await service.ValidateAuthorizationRequestAsync(CreateRequest(scopes), Resource, OAuthService.McpResource);
 
+        // Assert
         Assert.False(result.IsValid);
         Assert.Equal("invalid_scope", result.Error);
         Assert.DoesNotContain("<script>", result.ErrorDescription);
@@ -100,6 +119,7 @@ public async Task ValidateAuthorizationRequestAsync_InvalidScopes_DeniesWithoutR
     [InlineData("resource", "invalid_target", "The requested resource is not supported.")]
     public async Task ValidateAuthorizationRequestAsync_InvalidSecurityParameters_DoesNotDiscloseClientScopeDetails(string scenario, string error, string description)
     {
+        // Arrange
         var (service, application) = CreateService(FourReadScopes);
         application.IsDisabled = scenario == "disabled";
         var request = CreateRequest(AllScopes) with
@@ -110,8 +130,10 @@ public async Task ValidateAuthorizationRequestAsync_InvalidSecurityParameters_Do
             Resource = scenario == "resource" ? "http://localhost/other" : Resource
         };
 
+        // Act
         var result = await service.ValidateAuthorizationRequestAsync(request, Resource, OAuthService.McpResource);
 
+        // Assert
         Assert.False(result.IsValid);
         Assert.Equal(error, result.Error);
         Assert.Equal(description, result.ErrorDescription);

From 8d9db6bff8461a23138f36daa4434ac13dac567c Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Sun, 4 Oct 2026 21:24:55 -0500
Subject: [PATCH 5/6] Use concrete membership collection in OAuth regression
 test

---
 .../Services/OAuthAuthorizationValidationTests.cs               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
index 43b5a35d99..60522aa1cb 100644
--- a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
+++ b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
@@ -21,7 +21,7 @@ public sealed class OAuthAuthorizationValidationTests
     public void GetActiveOAuthOrganizationIds_RemovedMembership_ReturnsNoOrganizations()
     {
         // Arrange
-        var user = new User { OrganizationIds = ["organization-1"] };
+        var user = new User { OrganizationIds = new HashSet<string>(["organization-1"]) };
         var token = new OAuthToken { OrganizationIds = ["organization-1"] };
         user.OrganizationIds.Clear();
 

From e137aaf3cdc1f9c81843b4f298718021ebb1526a Mon Sep 17 00:00:00 2001
From: Blake Niemyjski <bniemyjski@gmail.com>
Date: Mon, 5 Oct 2026 09:31:02 -0500
Subject: [PATCH 6/6] Address OAuth consent error handling review

---
 docs/docs/api/index.md                         | 16 ++++------------
 .../Services/OAuthService.cs                   |  2 +-
 .../ClientApp/e2e/tests/oauth-consent.e2e.ts   |  2 +-
 .../src/lib/features/shared/validation.test.ts |  2 +-
 .../src/lib/features/shared/validation.ts      | 18 +++++++++++++-----
 .../Api/Endpoints/OAuthEndpointTests.cs        |  2 +-
 .../OAuthAuthorizationValidationTests.cs       |  2 +-
 7 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/docs/docs/api/index.md b/docs/docs/api/index.md
index 032da52880..f6d8de618b 100644
--- a/docs/docs/api/index.md
+++ b/docs/docs/api/index.md
@@ -12,9 +12,9 @@ To view the full API documentation, visit <https://api.exceptionless.io> and cli
 
 OAuth discovery advertises the scopes the server supports. Each OAuth application has its own allowed scopes, and each authorization grant contains only the scopes and organizations approved by the user. Discovery does not grant every advertised permission to an application.
 
-For the MCP resource, `mcp:read` is required to connect. `projects:read`, `stacks:read`, and `events:read` permit the corresponding read tools. `stacks:write` permits changing stack status (open, fixed, ignored, or discarded), snoozing stacks, changing whether future occurrences are critical, and adding or removing reference links. It does not grant global administration or access to organizations outside the grant and the user's current membership.
+For the MCP resource, `mcp:read` is required to connect. `projects:read`, `stacks:read`, and `events:read` permit the corresponding read tools. `stacks:write` permits changing stack status (open, fixed, ignored, or discarded), snoozing stacks, changing whether future occurrences are critical, and adding or removing reference links. Access remains limited to the organizations in the grant and the user's current membership.
 
-`offline_access` permits refresh token issuance so the client can obtain another access token without a new interactive authorization. It adds no read or write permission. Access tokens default to one hour and refresh tokens to 30 days; self-hosted administrators can configure these lifetimes with `OAuthServer:AccessTokenLifetimeMinutes` and `OAuthServer:RefreshTokenLifetimeDays`.
+`offline_access` permits refresh token issuance so the client can obtain another access token without a new interactive authorization. It adds no read or write permission. Access tokens default to one hour and refresh tokens to 30 days; these lifetimes are configured with `OAuthServer:AccessTokenLifetimeMinutes` and `OAuthServer:RefreshTokenLifetimeDays`.
 
 Dynamic registration without a scope uses `mcp:read projects:read stacks:read events:read offline_access`. It excludes `stacks:write`. An explicit registration scope is retained, so a client registered with only the four read scopes also lacks `offline_access`.
 
@@ -22,17 +22,9 @@ Dynamic registration without a scope uses `mcp:read projects:read stacks:read ev
 
 If authorization reports scopes that are not allowed for the application, restart the client's authorization flow requesting an allowed subset. Keep `mcp:read` for MCP access. Changing checkboxes on a failed consent page does not validate a new request.
 
-Client software should register the scopes it will request. A **global administrator** can review an existing application’s allowed scopes:
+Client software should register the scopes it will request. Each grant remains limited to the scopes and organizations approved by the user. Account **Applications** lists and revokes the user's grants.
 
-1. Open **System → OAuth Apps** (`/system/oauth-applications`).
-2. Change the default **Authorized** filter to **Not authorized** or **All applications** if the application has never completed consent.
-3. Find the application using the exact client ID from the authorization request, then select **Edit application**.
-4. Review and select **Stacks Write** and/or **Offline Access** as needed, then select **Save Changes**.
-5. Restart authorization using the **same client ID**, request the newly allowed scopes, and approve the appropriate organizations.
-
-Ordinary members can consent to access for their own organizations but cannot change global OAuth application configuration. Account **Applications** lists and revokes the user's grants; it does not enable client scopes. A global administrator's OAuth grant also receives only its approved scopes, without the administrator role.
-
-Enabling a scope on an application does not expand existing access or refresh tokens. Refreshing an existing grant keeps its original scopes intersected with the application's currently allowed scopes. Fresh consent is required to add write access, or to obtain refresh tokens for a grant originally created without `offline_access`.
+Existing access and refresh tokens do not gain additional permissions automatically. Fresh consent is required for additional access, including refresh tokens when the original grant did not include `offline_access`.
 
 ---
 
diff --git a/src/Exceptionless.Core/Services/OAuthService.cs b/src/Exceptionless.Core/Services/OAuthService.cs
index 03e6dab361..4bd3a00885 100644
--- a/src/Exceptionless.Core/Services/OAuthService.cs
+++ b/src/Exceptionless.Core/Services/OAuthService.cs
@@ -367,7 +367,7 @@ public async Task<OAuthValidationResult> ValidateAuthorizationRequestAsync(OAuth
             string description = disallowedScopes.Length > 0
                 ? $"Scopes not allowed for this application: {String.Join(", ", disallowedScopes)}."
                 : "One or more scopes are not allowed for this application.";
-            return OAuthValidationResult.Invalid("invalid_scope", $"{description} Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.");
+            return OAuthValidationResult.Invalid("invalid_scope", $"{description} Restart authorization with scopes allowed for this application.");
         }
 
         if (resourceDefinition.RequiredScopes.Any(s => !requestedScopes.Contains(s, StringComparer.Ordinal)))
diff --git a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
index 4190ea76f1..439441bd2b 100644
--- a/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
+++ b/src/Exceptionless.Web/ClientApp/e2e/tests/oauth-consent.e2e.ts
@@ -3,7 +3,7 @@ import { expect, test } from '@playwright/test';
 test('AuthorizeConsent_InvalidAndRestartedRequests_UsesOnlyCurrentValidation', async ({ page }) => {
     // Arrange
     const errorDescription =
-        'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.';
+        'Scopes not allowed for this application: stacks:write, offline_access. Restart authorization with scopes allowed for this application.';
     let consentRequests = 0;
     let authorizationRequests = 0;
     let completeStaleConsent: (() => void) | undefined;
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts
index 2fdaa53e16..3739462a83 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.test.ts
@@ -21,7 +21,7 @@ describe('getProblemMessage', () => {
         [{ detail: 'Problem detail' }, 'Problem detail'],
         [{ title: 'Problem title' }, 'Problem title'],
         [{ detail: 7, error: [], error_description: {}, title: false }, 'Fallback'],
-        [{ detail: 'Problem detail', error_description: '  ' }, 'Problem detail'],
+        [{ detail: 'Problem detail', error_description: '' }, 'Problem detail'],
         [null, 'Fallback'],
         ['Malformed body', 'Fallback']
     ])('GetProblemMessage_OAuthPayload_ReturnsSafeMessage: %j', (problem, expected) => {
diff --git a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts
index 51439c579a..f010c51394 100644
--- a/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts
+++ b/src/Exceptionless.Web/ClientApp/src/lib/features/shared/validation.ts
@@ -10,8 +10,6 @@ export type FieldWithErrors = {
 
 type ProblemDetailsLike = {
     detail?: unknown;
-    error?: unknown;
-    error_description?: unknown;
     errors?: Record<string, unknown>;
     message?: unknown;
     status?: unknown;
@@ -119,11 +117,21 @@ export function getFormErrorMessages(errors?: unknown[]): string | string[] | un
 }
 
 export function getProblemMessage(error: unknown, fallback: string): string {
+    // OAuth uses its own error format; FetchClient also stores these bodies in response.problem.
+    if (error && typeof error === 'object') {
+        if ('error_description' in error && isNonEmptyString(error.error_description)) {
+            return error.error_description;
+        }
+        if ('error' in error && isNonEmptyString(error.error)) {
+            return error.error;
+        }
+    }
+
     if (!isProblemDetailsLike(error)) {
         return fallback;
     }
 
-    const candidates: unknown[] = [error.error_description, error.error, error.message];
+    const candidates: unknown[] = [error.message];
     for (const value of Object.values(error.errors ?? {})) {
         if (Array.isArray(value)) {
             candidates.push(...value);
@@ -236,7 +244,7 @@ export function problemDetailsToFormErrors(problem: null | ProblemDetails): null
 }
 
 function isNonEmptyString(value: unknown): value is string {
-    return typeof value === 'string' && value.trim().length > 0;
+    return typeof value === 'string' && value.length > 0;
 }
 
 function isProblemDetailsLike(error: unknown): error is ProblemDetailsLike {
@@ -244,5 +252,5 @@ function isProblemDetailsLike(error: unknown): error is ProblemDetailsLike {
         return false;
     }
 
-    return 'title' in error || 'detail' in error || 'errors' in error || 'status' in error || 'error_description' in error || 'error' in error;
+    return 'title' in error || 'detail' in error || 'errors' in error || 'status' in error;
 }
diff --git a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
index 221a742c7f..1ec60ca75f 100644
--- a/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
+++ b/tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs
@@ -642,7 +642,7 @@ public async Task AuthorizeAsync_DynamicClientScopes_ValidatesConsentAndFinalReq
                 var error = await response.DeserializeAsync<OAuthErrorResponse>(ensureSuccess: false);
                 Assert.NotNull(error);
                 Assert.Equal("invalid_scope", error.Error);
-                Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.", error.ErrorDescription);
+                Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with scopes allowed for this application.", error.ErrorDescription);
                 Assert.DoesNotContain("redirect_uri", await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
             }
         }
diff --git a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
index 60522aa1cb..3608fd6392 100644
--- a/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
+++ b/tests/Exceptionless.Tests/Services/OAuthAuthorizationValidationTests.cs
@@ -86,7 +86,7 @@ public async Task ValidateAuthorizationRequestAsync_ClientScopeCombinations_Enfo
         if (deniedScopes is not null)
         {
             Assert.Equal("invalid_scope", result.Error);
-            Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with fewer scopes or ask a global administrator to review the application in System → OAuth Apps. After saving changes, restart authorization using the same client ID.", result.ErrorDescription);
+            Assert.Equal($"Scopes not allowed for this application: {deniedScopes}. Restart authorization with scopes allowed for this application.", result.ErrorDescription);
             Assert.Empty(result.Scopes);
         }
     }