bug: Cognito access token scope is always aws.cognito.signin.user.admin in authorization code flow

[zahedulhossain]

Current Behavior

In an authorization-code flow where the authorize request asks for scope=openid email profile, and
the app client is created with AllowedOAuthScopes: ["openid","email","profile"], the access token
returned by /_aws/cognito-idp/oauth2/token carries:

{
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "client_id": "<client id>",
  "iss": "http://localhost.localstack.cloud:4566/<pool id>"
}

The requested openid, email and profile scopes are absent, and a scope that was never
requested is present instead.

This breaks any relying party that validates the openid scope on the access token before
trusting it — a standard check, since openid is what marks the token as OIDC-issued.

Expected Behavior

Amazon Cognito returns the granted scopes from the authorize request. For
scope=openid email profile the access token scope claim should contain those values.

openid is a system-reserved scope in Cognito, documented alongside email, phone, profile
and aws.cognito.signin.user.admin:
https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html

Steps To Reproduce

Setup (SERVICES=cognito-idp, port 4566):

AUTH='Authorization: AWS4-HMAC-SHA256 Credential=test/20260815/us-east-1/cognito-idp/aws4_request, SignedHeaders=host, Signature=test'
api() { curl -s -X POST http://localhost:4566/ -H 'Content-Type: application/x-amz-json-1.1' \
  -H "$AUTH" -H "X-Amz-Target: AWSCognitoIdentityProviderService.$1" -d "$2"; }

POOL=$(api CreateUserPool '{"PoolName":"demo","AutoVerifiedAttributes":["email"],"UsernameAttributes":["email"]}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['UserPool']['Id'])")

CID=$(api CreateUserPoolClient "{\"UserPoolId\":\"$POOL\",\"ClientName\":\"web\",\"GenerateSecret\":false,\
\"AllowedOAuthFlows\":[\"code\"],\"AllowedOAuthScopes\":[\"openid\",\"email\",\"profile\"],\
\"AllowedOAuthFlowsUserPoolClient\":true,\"CallbackURLs\":[\"http://localhost:5173/auth/callback\"],\
\"SupportedIdentityProviders\":[\"COGNITO\"]}" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['UserPoolClient']['ClientId'])")

api AdminCreateUser "{\"UserPoolId\":\"$POOL\",\"Username\":\"user@example.test\",\
\"UserAttributes\":[{\"Name\":\"email\",\"Value\":\"user@example.test\"},{\"Name\":\"email_verified\",\"Value\":\"true\"}],\
\"MessageAction\":\"SUPPRESS\"}"
api AdminSetUserPassword "{\"UserPoolId\":\"$POOL\",\"Username\":\"user@example.test\",\"Password\":\"LocalDemo123!\",\"Permanent\":true}"

Then complete an authorization-code + PKCE flow (login form at
/_aws/cognito-idp/login, CSRF field value is test123) and exchange the code at
/_aws/cognito-idp/oauth2/token. Decode the returned tokens:

python3 -c "
import json,base64,sys
t=sys.argv[1]; p=t.split('.')[1]; p+='='*(-len(p)%4)
print(json.loads(base64.urlsafe_b64decode(p))['scope'])
" "$ACCESS_TOKEN"
# actual:   aws.cognito.signin.user.admin
# expected: openid email profile

Environment:

- OS: macOS (Docker Desktop, 6.12.76-linuxkit, aarch64)
- LocalStack version: 2026.7.4
- LocalStack build git hash: 875b30838
- LocalStack build date: 2026-08-14
- LocalStack Docker image sha256: f7b778d03717b58c3adce81a740bfafff5c6f9d639159bbf08da557c9ac1b513
- How are you starting LocalStack: With a docker-compose file