Return invalid_request instead of server_error for unknown subjects in /authorize and /token

[Copilot]

The /authorize endpoint returns server_error (HTTP 500) when the subject is not found, misclassifying a client error as a server error.

Changes

• Modified subjectExists() to return oauth.OAuth2Error with InvalidRequest code instead of raw didsubject.ErrSubjectNotFound
• Updated test expectations in TestWrapper_subjectExists to verify OAuth2 error structure

Impact

Requests to /oauth2/{unknown-subject}/authorize now return:

HTTP 400 Bad Request
{
  "error": "invalid_request",
  "error_description": "subject not found"
}

Fixes #3974

Previously returned HTTP 500 with generic server_error code.

This aligns with the error handling pattern already used in OpenIDConfiguration() for the same error condition.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>IAM: /authorize yields server error when subject is not known</issue_title>
<issue_description>```
time="2025-04-14T11:40:00+02:00" level=warning msg="HandleAuthorizeRequest failed" error="subject not found" module=Auth/iam operation=HandleAuthorizeRequest operationID=HandleAuthorizeRequest requestURI=/oauth2/local/authorize user=""

![Image](https://github.com/user-attachments/assets/f9b77a3e-4251-4d18-b648-e779fc026056)

I think we should be OK communicating the underlying error to the client.</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes IAM: /authorize yields server error when subject is not known #3792

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[qltysh]

Coverage Impact

⬆️ Merging this pull request will increase total coverage on master by 0.01%.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	auth/api/iam/api.go	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[qltysh]

0 new issues

Tool	Category	Rule	Count