See T402597: Exploratory testing on PHP 8.3 for MediaWiki Platform Team components for context. T384232: QA for SUL3 on testwikis has more info on some checklist items.

OAuth

• Create and test (e.g. with action=query&meta=userinfo) an owner-only OAuth 1 app
• Create and test a normal (non-owner-only) OAuth 1 app
• Same but use RSA-SHA1 rather than HMAC-SHA1
• Same but do it while not being logged in on Wikipedia (you should be sent to login and then to the authorization dialog)
• Test OAuth 1 pseduo-OIDC (the identify endpoint)
• Create and test an owner-only OAuth 2 app
• Create and test a normal (non-owner-only) OAuth 2 app
• Same but use a non-confidential client
• Test using a refresh token
• Test OAuth 2 OIDC (the profile endpoint)
• Create an app via api.wikimedia.org