Essential OAuth functionality should have end-to-end tests:

• proposing a new application (OAuth 1, OAuth 2; owner-only, normal)
• authorizing an application (OAuth 1, OAuth 2); there are lots of variations (/authorize vs /authenticate for OAuth 1; refresh token, PKCE for OAuth 2), not sure how much we should try to cover
• making an API request with an authorized application
• using the identify endpoint (OAuth 1, OAuth 2)

For the authorizing test, we might want to build something like oauth-hello-world into the extension, only enabled in CI mode. Or we could use a NodeJS test script to both be the OAuth app and simulate the browser.

The others are straightforward, we use createOAuthConsumer.php to register the app (we'd need to do T274713: Allow creating OAuth owner-only consumers via maintenance script for the owner-only tests), override the secret key in the DB or just use RSA, the API and identify requests can use the PHP integration test framework (OAuth 2 has a couple such tests already), app proposal is a normal Selenium test.