Tutorials: OAuth2

[predic8]

Summary by CodeRabbit

• New Features
  • Added new OAuth2 security tutorials for Password Grant, Client Credentials, and automatic client token renewal.
  • Included end-to-end examples for obtaining access tokens and calling protected services.
• Tests
  • Added integration tests covering Password Flow, Client Credentials, and token renewal after expiry.
  • Verified protected endpoints reject requests without tokens and succeed with valid Bearer tokens.
• Chores
  • Added an Apache License header to a core test file.
• Documentation
  • Introduced new tutorial configuration files for the OAuth2 flows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 625d5a67-2e71-45a7-9589-0dc697201a85

📥 Commits

Reviewing files that changed from the base of the PR and between 9f339bc and 6c81a1e.

📒 Files selected for processing (1)

• distribution/src/test/java/com/predic8/membrane/examples/withoutinternet/test/OAuth2APIExampleTest.java

---

📝 Walkthrough

Walkthrough

Three OAuth2 tutorial YAML files and matching integration tests are added, including a token-renewal setup with gateway lifecycle handling. One OAuth2 example test updates its startup wait condition, and one core test file gets a license header.

Changes

OAuth2 Tutorial Configs and Tests

Layer / File(s)	Summary
OAuth2 Password Flow tutorial config and test distribution/tutorials/security/40-OAuth2-Password-Flow.yaml, distribution/src/test/java/com/predic8/membrane/tutorials/security/OAuth2PasswordFlowTutorialTest.java	YAML defines the authorization server, protected API, and backend for the password flow; the test checks unauthorized access, obtains a password-grant token, and then accesses the protected resource.
OAuth2 Client Credentials tutorial config and test distribution/tutorials/security/50-OAuth2-Client-Credentials.yaml, distribution/src/test/java/com/predic8/membrane/tutorials/security/OAuth2ClientCredentialsTutorialTest.java	YAML defines the authorization server, protected API, and backend for client credentials; the test checks unauthorized access, obtains a client_credentials token, and then accesses the protected resource.
OAuth2 Client Token Renewal tutorial config and test distribution/tutorials/security/55-OAuth2-Client-Token-Renewal.yaml, distribution/src/test/java/com/predic8/membrane/tutorials/security/OAuth2ClientTokenRenewalTutorialTest.java	YAML defines the authorization server, gateway with oauth2Client, protected API, and backend; the test patches token expiry, starts and stops the gateway, and verifies token renewal after expiry.

OAuth2 example test and core header update

Layer / File(s)	Summary
OAuth2 example wait condition distribution/src/test/java/com/predic8/membrane/examples/withoutinternet/test/OAuth2APIExampleTest.java	Replaces wildcard imports with explicit imports and changes the test wait trigger from true to Got: in the example test.
License header update core/src/test/java/com/predic8/membrane/core/resolver/ResolverMapTest.java	Adds an Apache 2.0 copyright and license header comment at the top of the test file.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• membrane/api-gateway#2616: Introduces the shared security tutorial test base class used by the new OAuth2 tutorial tests.
• membrane/api-gateway#3020: Adds the same OAuth2 tutorial flows and related test coverage, making it directly adjacent to this change set.

Suggested reviewers

• rrayst

Poem

🐇 Three OAuth doors now softly glow,
With tokens fetched and tests in tow.
One waits for “Got:” just so it’s true,
And one tiny header got its due.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is related to the change set, but it is too generic to clearly describe the main update.	Use a more specific title like "Add OAuth2 tutorial tests and configurations" to reflect the main change.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch tutorials-oauth2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

distribution/tutorials/security/50-OAuth2-Client-Credentials.yaml (1)

34-37: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the end-user credential store from this client-credentials example.

The tutorial text says this flow is machine-to-machine with no username/password, but Lines 34-37 still provision a user store. Even if the test never uses it, that makes the example teach the wrong contract for client_credentials.

Suggested cleanup

     - oauth2authserver:
         issuer: http://localhost:7007
-        staticUserDataProvider:
-          users:
-            - username: john
-              password: password
         staticClientList:
           clients:
             - clientId: abc

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@distribution/tutorials/security/50-OAuth2-Client-Credentials.yaml` around
lines 34 - 37, The OAuth2 client-credentials tutorial still provisions an
end-user login store via staticUserDataProvider, which conflicts with the
machine-to-machine contract. Remove the users/password block from the example
YAML so the 50-OAuth2-Client-Credentials tutorial only demonstrates
client_credentials setup and no username/password authentication.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@distribution/tutorials/security/55-OAuth2-Client-Token-Renewal.yaml`:
- Around line 22-50: The OAuth2 client renewal tutorial currently never
exercises token expiry, so it only validates initial acquisition. Update the
OAuth2 auth-server setup in the tutorial config so the access token lifetime is
intentionally short, and adjust OAuth2ClientTokenRenewalTutorialTest to send a
second request after the first token has expired. Use the existing
oauth2authserver and oauth2Client flow blocks as the places to change the
renewal scenario, and keep the test asserting that the client re-fetches a new
token on the second request.

---

Nitpick comments:
In `@distribution/tutorials/security/50-OAuth2-Client-Credentials.yaml`:
- Around line 34-37: The OAuth2 client-credentials tutorial still provisions an
end-user login store via staticUserDataProvider, which conflicts with the
machine-to-machine contract. Remove the users/password block from the example
YAML so the 50-OAuth2-Client-Credentials tutorial only demonstrates
client_credentials setup and no username/password authentication.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 36651a06-e4c2-43b6-ad6e-3489dd6aa35b

📥 Commits

Reviewing files that changed from the base of the PR and between d7e3dfa and 3951855.

📒 Files selected for processing (6)

• distribution/src/test/java/com/predic8/membrane/tutorials/security/OAuth2ClientCredentialsTutorialTest.java
• distribution/src/test/java/com/predic8/membrane/tutorials/security/OAuth2ClientTokenRenewalTutorialTest.java
• distribution/src/test/java/com/predic8/membrane/tutorials/security/OAuth2PasswordFlowTutorialTest.java
• distribution/tutorials/security/40-OAuth2-Password-Flow.yaml
• distribution/tutorials/security/50-OAuth2-Client-Credentials.yaml
• distribution/tutorials/security/55-OAuth2-Client-Token-Renewal.yaml

[membrane-ci-server]

This pull request needs "/ok-to-test" from an authorized committer.

[rrayst]

/ok-to-test

[rrayst]

OAuth2ClientTokenRenewalTutorialTest.gatewayRenewsTokenAfterExpiry test failure