[dfcoffin]

Summary

Closes #254. One command starts the AS, DC and TP on the local profile; one command checks them; a runbook lists every URL, login, client and curl recipe.

Merge after #257 and #258. This branch contains their commits (the local profile relies on #257's demo-seeding flag, and giving third_party a client_credentials grant is only safe with #258's per-grant scope rule). Once they merge, this PR's diff shrinks to the #254 commits.

Changes

AS

• third_party demo client: also client_credentials + ThirdParty_Admin_Access, which is the ESPI client access token for the Authorization (and later Bulk, DC: implement ESPI Batch/Bulk API — Third Party client access token only, scoped to its own Authorizations #256) APIs. fix(authserver): restrict each OAuth grant to its own kind of scope (#251) #258 makes sure customer FB scopes can't be obtained that way.
• Its redirect URIs are configurable (espi.authserver.seed.third-party.redirect-uris; the default is unchanged). local lists the TP's real Spring OAuth2 callbacks (:8082/ThirdParty/login/oauth2/code/datacustodian-{monthly,daily}).
• application-local.yml (DEV ONLY), all overridable by environment variables:
  • bootstrap admin admin / admin (bcrypt hash; a passkey is still enrolled at first login);
  • espi_admin and espi_registrar dev secrets.
• SecurityIntegrationTest: the "client not registered for the grant" case uses the per-test authorization_code-only client instead of third_party.

TP application-local.yml: the registrations match the AS seed.

• tp-secret everywhere.
• The monthly/daily scopes are exactly the AS-registered ESPI scopes; openid/profile are dropped.
• datacustodian-admin becomes client_credentials with ThirdParty_Admin_Access.

Scripts in scripts/local/, Bash and PowerShell versions:

• start-all builds once, starts all three apps, waits for /actuator/health and prints the URLs; logs go to .local-run/.
• stop-all stops the apps by port.
• smoke makes 25 checks: health; four client_credentials tokens; client_credentials refused for an FB scope; introspection; all ten DC feeds; the Authorization feed with the TP client access token; 401 without a token; admin actuator on each app.

Docs and repo

• docs/LOCAL_TESTING.md is the runbook.
• .gitattributes keeps *.sh at LF.
• .local-run/ is git-ignored.

Verification (this branch, Windows 11)

• scripts/local/stop-all.sh stopped the running apps; start-all.sh (with build) brought all three up healthy
• smoke.sh: 25 passed, 0 failed; smoke.ps1: 25 passed, 0 failed
• TP oauth2/authorization/datacustodian-monthly → AS /oauth2/authorize accepted (redirect URI and scope valid) → 302 to /authorize/delegate, which is where AS: unauthenticated /oauth2/authorize redirects to /authorize/delegate without parameters (400); outbound delegation to DC is broken #232 stops the flow today
• RFC 7591 recipe in the runbook returns 201
• Non-Docker AS tests pass; the Docker suite runs in CI

Not in this PR

• DC sample data and a customer login (DC local profile: seed a deterministic ESPI sample dataset (customer, usage, PII, ApplicationInformation) for manual testing #253).
• TP user login (Third Party: add a username/password login page matching the Data Custodian login design #249).
• The rest of the customer flow (AS: unauthenticated /oauth2/authorize redirects to /authorize/delegate without parameters (400); outbound delegation to DC is broken #232, TP bring-up: missing JAXB Atom marshaller, narrow component scan, and broader OAuth2-client wiring gaps #146, Third Party cannot unmarshal any ESPI Atom feed (AtomFeedDto date adapters + abstract entry type) #197, AS/DC: customer scope narrowing yields invalid_scope on authorize replay #211).
  These are listed under "Known limitations" in the runbook.

🤖 Generated with Claude Code