Shouldn't a scope for external sources also not return AuthSourceHidden? Technically, it's also an Internal implementation...