Missing null-check in IdentityOauthEventHandler leads to 500 error when removing a scope-less application authorised API resource

[vfraga]

Describe the issue:
Can't delete a scope-less application authorized API resource in the Console application due to a 500 error.

How to reproduce:

1. Setup and start a Identity Server 7.0.0 instance.
2. Access the Console application, and create a Standard-Based Application.
3. Go to API Authorization, click 'Authorize an API Resource', select any option for the 'API Resource' field, leave 'Authorized Scopes' blank, and click the 'Finish' button.
4. Try to delete the authorized API resource by clicking the trash icon, ticking on the 'Please confirm your action.' checkbox, and clicking the 'Confirm' button.
5. Observe the error message in the bottom-right corner, and the stacktrace in the carbon logs.

Expected behavior:
Users should be able to remove an Authorized API Resource definition even if it doesn't have any defined scope. Either:

• IdentityOauthEventHandler::handleEvent does a null-check before calling AuthorizedAPI::getScopes at [1];
• Change AuthorizedAPI::getScopes [2] to return an empty list if scopes is null;
• Add an else branch in - AuthorizedAPIDAOImpl::getAuthorizedAPI [3] to set an empty list on the AuthorizedAPI#scopes field.

Environment information:

• Product Version: IS 7.0.0

---

[1] https://github.com/wso2-extensions/identity-inbound-auth-oauth/blob/v7.0.26/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/listener/IdentityOauthEventHandler.java#L284-L286
[2] https://github.com/wso2/carbon-identity-framework/blob/v7.0.78/components/application-mgt/org.wso2.carbon.identity.application.common/src/main/java/org/wso2/carbon/identity/application/common/model/AuthorizedAPI.java#L99-L102
[3] https://github.com/wso2/carbon-identity-framework/blob/v7.0.78/components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/AuthorizedAPIDAOImpl.java#L232-L237

[HasiniSama]

The Master was already fixed by the following PRs:

• Fix NPE when deleting an authorized API wso2-extensions/identity-inbound-auth-oauth#2378
• Handle Null Pointer Exception while trying to delete already deleted Authorized API wso2-extensions/identity-inbound-auth-oauth#2607