fix(authserver): canonical Spring Security 7.x filter chain + Jackson modules on custom repo

[dfcoffin]

Summary

Closes #124. End-to-end opaque token issuance + RFC 7662 introspection now works on dev-mysql.

Two related commits, one PR — they form a dependency chain (the filter-chain fix exposed the serialization defect; the serialization fix is what makes the filter-chain fix verifiable end-to-end). Splitting them would create a PR whose acceptance criteria provably can't be met.

Commits

1. fix(authserver): adopt canonical Spring Security 7.x filter chain pattern

authorizationServerSecurityFilterChain rewritten from the non-canonical .oauth2AuthorizationServer(...) + .oauth2ResourceServer().jwt() + .anyRequest().authenticated() combination to the canonical Spring Security 7.x pattern:

OAuth2AuthorizationServerConfigurer configurer = new OAuth2AuthorizationServerConfigurer();
configurer.oidc(Customizer.withDefaults());
RequestMatcher endpointsMatcher = configurer.getEndpointsMatcher();

http
    .securityMatcher(endpointsMatcher)
    .authorizeHttpRequests(a -> a.anyRequest().authenticated())
    .csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
    .with(configurer, Customizer.withDefaults())
    .exceptionHandling(...)
    .oauth2ResourceServer(rs -> rs.jwt(Customizer.withDefaults()));

securityMatcher(endpointsMatcher) scopes this chain to OAuth2 endpoints only, so the resource-server bearer-token filter no longer intercepts POST /oauth2/token before its basic-auth handler can run.

A second @Order(2) defaultSecurityFilterChain bean now handles login form, static resources, /.well-known/*, and actuator — replacing the previously commented-out stub.

Note: Spring Security 7.x removed the OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http) static method that Spring Authorization Server 1.x docs commonly cite. The http.with(...) + manual securityMatcher is the replacement.

2. fix(authserver): register Spring Authorization Server Jackson modules on custom repo

The custom JdbcRegisteredClientRepository constructed new ObjectMapper() with no Jackson modules. Spring Authorization Server stores typed values (OAuth2TokenFormat, ClientAuthenticationMethod) inside ClientSettings/TokenSettings; Jackson serializes correctly on write but reads them back as LinkedHashMap without the provider's type-info modules. TokenSettings.getAccessTokenFormat() then ClassCasts, and the DelegatingOAuth2TokenGenerator falls through to JwtGenerator even for clients configured as opaque — HTTP 500 on every POST /oauth2/token.

Fix: register SecurityJacksonModules + OAuth2AuthorizationServerJacksonModule on the existing ObjectMapper using Jackson 3's JsonMapper.builder() pattern (codebase is already on tools.jackson.databind.ObjectMapper).

This is the minimum fix that unblocks #124's acceptance criteria. The custom repo's other architectural issues — auto-encoding clientSecret on save, non-interface findAll/deleteById extensions, the "build-vs-buy" question of reimplementing Spring's stock impl — are scoped to follow-up issue #127.

Verification (local, fresh MySQL container)

$ curl -u 'data_custodian_admin:{bcrypt}secret' \
    -d 'grant_type=client_credentials&scope=DataCustodian_Admin_Access' \
    http://localhost:9999/oauth2/token
{"access_token":"7b_HlXgKfi7V-phbFWODTJW_Cfn--uBuKRClixyqFyxPHTpEiMQw29wf33nhor0Tx5dmBUgSmDCFOfoTwQVMsTbVX8P9WOdm_cyAYOET9IIy12THZR9OKe8D7ZsazjUp",
 "token_type":"Bearer","expires_in":3599,"scope":"DataCustodian_Admin_Access"}

$ curl -u 'data_custodian_admin:{bcrypt}secret' \
    -d "token=$ACCESS_TOKEN" \
    http://localhost:9999/oauth2/introspect
{"active":true,"sub":"data_custodian_admin","aud":["data_custodian_admin"],
 "nbf":1779751451,"scope":"DataCustodian_Admin_Access","iss":"http://localhost:9999",
 "exp":1779755052,"iat":1779751452,"jti":"19dca850-f8a3-4b5e-bf8a-3fbec3596943",
 "client_id":"data_custodian_admin","token_type":"Bearer"}

• Access token: 128 chars, zero dots (not a JWT — proper opaque/REFERENCE format per ESPI 4.0)
• Introspection response: RFC 7662-compliant — exactly the shape Step 4 of #122 will enrich with a subscription_id custom claim once grant→subscription wiring lands.

Test plan

• Manual: mvn -pl openespi-authserver compile succeeds
• Manual: mvn spring-boot:run -Dspring-boot.run.profiles=dev-mysql reaches Started AuthorizationServerApplication (~45s)
• Manual: POST /oauth2/token returns 200 with opaque token; POST /oauth2/introspect returns RFC 7662 response (results above)
• CI: full test suite passes (will verify)
• Automated integration test exercising the full mint+introspect cycle — deferred to #127 which will refactor the repo and add proper test coverage at the same time

Related

• Closes #124
• Advances #122 Phase 2.0 (Step 3 — verify opaque token introspection — finally satisfied after 11 patches across 3 issues)
• Filed #127 for the deeper "swap custom repo for stock" refactor

🤖 Generated with Claude Code