The core Router class is not @newable thus extensions must not instantiate a router via a constructor. OAuth extension tests violate this constraint which limits our ability to change the Router constructor signature.
Core provides HandlerTestTrait that could be used to write unit tests for OAuth, and integration tests could be written using api-testing framework. The existing REST endpoints tests in the OAuth extension should be rewritten using these two abstractions and about instantiating a non-newable Router.