Add openid scope analytics

lib/reporting/protocols_report.rb

@@ -154,6 +154,11 @@ def deprecated_parameters_table
           id_token_hint_data.length,
           id_token_hint_data.join(', '),
         ],
+        [
+          'No openid in scope',
+          no_openid_scope_data.length,
+          no_openid_scope_data.join(', '),
+        ],
       ]
     end
 
@@ -194,6 +199,12 @@ def loa_issuers_data
       )
     end
 
+    def no_openid_scope_data
+      @no_openid_scope_data ||= fetch_uniq_issuers(
+        query: no_openid_scope_query,
+      )
+    end
+
     def aal3_issuers_data
       @aal3_issuers_data ||= fetch_uniq_issuers(
         query: aal3_issuers_query,
@@ -314,6 +325,23 @@ def id_token_hint_query
       QUERY
     end
 
+    def no_openid_scope_query
+      params = {
+        event: quote(OIDC_AUTH_EVENT),
+      }
+
+      format(<<~QUERY, params)
+        fields @timestamp,
+          coalesce(properties.event_properties.client_id, properties.service_provider) as issuer
+        | filter name = %{event}
+          AND properties.event_properties.success = 1
+          AND properties.event_properties.scope NOT LIKE 'openid'
+        | display issuer
+        | sort issuer
+        | dedup issuer
+      QUERY
+    end
+
     def loa_issuers_query
       params = {
         event: quote([SAML_AUTH_EVENT, OIDC_AUTH_EVENT]),

spec/lib/reporting/protocols_report_spec.rb

@@ -99,12 +99,22 @@
       },
     ]
 
+    no_openid_scope_query_response = [
+      {
+        'issuer' => 'Issuer1',
+      },
+      {
+        'issuer' => 'Issuer2',
+      },
+    ]
+
     stub_multiple_cloudwatch_logs(
       protocol_query_response,
       saml_signature_query_response,
       loa_issuers_query_response,
       aal3_issuers_query_response,
       id_token_hint_query_response,
+      no_openid_scope_query_response,
       facial_match_issuers_query_response,
     )
   end
@@ -137,6 +147,7 @@
           loa_issuers_query
           protocol_query
           saml_signature_query
+          no_openid_scope_query
         ].each do |query|
           expect(client).to have_received(:fetch).with(
             query: report.public_send(query),
@@ -283,6 +294,11 @@ def expected_tables(strings: false)
           string_or_num(strings, 2),
           'Issuer3, Issuer4',
         ],
+        [
+          'No openid in scope',
+          string_or_num(strings, 2),
+          'Issuer1, Issuer2',
+        ],
       ],
       [
         [