Repair AS integration test infrastructure (pre-existing pre-#122) #149

Summary

The Authorization Server's integration test infrastructure is broken at the infrastructure level — independent of any specific test's code. Discovered while attempting PR D (issue #148): all 23 tests in OAuth2FlowIntegrationTest error out with context-load failures, and any new @SpringBootTest-based integration test against AS fails identically. This blocks #148 (which needs a working AS integration harness) and probably any future AS integration tests until repaired.

Reproduction

mvn -pl openespi-authserver test -Dtest='OAuth2FlowIntegrationTest'
# Result: 23 tests run, 23 errors, 0 passes

Same pattern with any new @SpringBootTest(classes = AuthorizationServerApplication.class) test class.

Root causes (partial inventory from investigation)

1. application-test.yml uses H2 with MODE=MySQL — but V1_0_0__create_oauth2_schema.sql references DATETIME (MySQL type), which H2 doesn't recognize even in MySQL mode. Pre-existing flagged in PR feat(#122 PR C3): AS-side delegation to DC + /oauth2/authorize/continue #144's failing CI integration tests; this is the same root cause.

2. application-testcontainers.yml ships placeholder values for spring.datasource.url, username, password, and driver-class-name ("placeholder" literal string). Tests that don't override every one of these with @DynamicPropertySource fail because of the literal "placeholder" driver class.

3. schemas: public in the testcontainers Flyway config is Postgres-specific and breaks MySQL TestContainers (MySQL uses the database name as schema). Needs to be conditional per-vendor.

4. The C3 + C4 architectural changes added bean dependencies (GrantContextEnrichingAuthorizationService wraps the standard authorization service; EspiTokenResponseSuccessHandler is wired on the token endpoint) which may or may not work cleanly under MockMvc / RANDOM_PORT — never verified end-to-end because the underlying infra is broken.

5. The OIDC strip (commit e31a617) may have left some test expectations stale (OAuth2FlowIntegrationTest has nested @DisplayName("OIDC Discovery Tests") and @DisplayName("JWK Set Tests") classes that test stripped behavior).

Why this blocks #148 / closing #122

Phase 2.0 Step 6 acceptance is "one integration test that boots both modules, mints a real token via the authorization code flow." That test (any variant — single-context with @MockitoBean, dual-context with two Spring contexts, contract-tested with Spring Cloud Contract) needs a working @SpringBootTest foundation for AS. Currently there isn't one.

Recommended fix shape

1. Pick a canonical AS integration test profile. TestContainers MySQL is the right choice (matches production); deprecate the H2 test profile for AS integration tests (it's fundamentally broken on the V1 schema).
2. Repair application-testcontainers.yml:
   • Remove "placeholder" values from spring.datasource.*; let them be unset and rely entirely on @DynamicPropertySource (or use a base class AbstractTestcontainersAuthserverTest that wires them).
   • Remove schemas: public (or make it MySQL-conditional).
   • Set spring.flyway.target=7.0.0 and spring.flyway.locations=classpath:db/vendor/mysql to match the PR C4 pattern.
3. Delete or repair OAuth2FlowIntegrationTest nested classes for stripped features (OIDC, JWK). They're aspirational and confuse the suite.
4. Provide a base class with a singleton TestContainers MySQL that other AS integration tests extend, so the container only spins up once per build.
5. Then PR PR D: Phase 2.0 integration test — auth-code flow + introspection + token-response augmentation end-to-end (closes #122 Step 6) #148 (PR D) can be written against this working foundation.

Out of scope

• The CI runner's broader OWASP / SonarCloud setup
• The H2 schema repair tracked in Complete #123 schema-repair sync: align AS V1 schema with application code column names #145 (different table set)
• The TP bring-up gap tracked in TP bring-up: missing JAXB Atom marshaller, narrow component scan, and broader OAuth2-client wiring gaps #146

Acceptance

• mvn -pl openespi-authserver test -Dtest='OAuth2FlowIntegrationTest' passes (or the test class is deleted with explicit rationale and replaced with a working successor)
• A documented pattern exists for "write a new AS integration test" (base class or template)
• PR PR D: Phase 2.0 integration test — auth-code flow + introspection + token-response augmentation end-to-end (closes #122 Step 6) #148 can be implemented on top of this foundation

Related

• Phase 2.0 — Stand up auth-server in dev with opaque tokens + subscription-bound introspection (Phase 2 precursor) #122 — Phase 2.0 umbrella; cannot close until PR D: Phase 2.0 integration test — auth-code flow + introspection + token-response augmentation end-to-end (closes #122 Step 6) #148 lands, which depends on this
• PR D: Phase 2.0 integration test — auth-code flow + introspection + token-response augmentation end-to-end (closes #122 Step 6) #148 — PR D Phase 2.0 integration test; blocked on this
• Complete #123 schema-repair sync: align AS V1 schema with application code column names #145 — Schema-repair sync (different concern)