Closes #134. ESPI 4.0 uses opaque access tokens only and the GBA Resource Server carries no JWK/JWT. The auth-server carried OIDC + JWK/JWT-signing machinery the opaque flow never exercises. Removed it; the opaque token mint + RFC 7662 introspection path is unchanged. AuthorizationServerConfig: - Removed .oidc(...) from the authorization-server configurer. - Removed the .oauth2ResourceServer().jwt(...) self-protection added in #128. The auth-server no longer validates bearer tokens on its own endpoints: OAuth2 protocol endpoints (token/introspect/revoke) authenticate clients via client_secret_basic; admin/UI endpoints are protected by the @order(2) session-login chain (#122 design §5). - Removed jwkSource()/jwtDecoder() beans, generateRsaKey(), the .jwkSetEndpoint() declaration, and all JWK/JWT imports. application.yml: - Excluded OAuth2AuthorizationServerJwtAutoConfiguration so Spring Boot no longer auto-generates a JWKSource / stands up /oauth2/jwks. Removed jwk-set-uri property. EspiTokenCustomizer RETAINED (not stripped): it is OAuth2TokenCustomizer<JwtEncodingContext> and currently inert (short-circuits unless espi.token.format=jwt), BUT it is the sole home of the ESPI logic adding resource/authorization URIs to the token. That logic must migrate to the opaque token-response path (#122 token-response augmentation), so the class + bean + test are kept deliberately. OIDC removal is a DEFERRAL, not permanent — OIDC returns when multi-utility Third-Party registration is built (#122). Data-custodian: replaced the misleading "Future enhancement: Add JWT support" comment with a note that JWT/JWK is intentionally absent (ESPI opaque-only). Tests: - AuthorizationServerConfigTest: removed the JWK Configuration test class + jwkSource()/ jwtDecoder() assertions (beans gone); espiTokenCustomizer assertions kept. - ClientRegistrationEndpointIntegrationTest: @disabled — every test hits the removed OIDC /connect/register endpoint. Restore when OIDC returns (#122); suite repair tracked in #129. - Blast radius is exactly that one class; OAuth2FlowIntegrationTest and SecurityIntegrationTest exercise only the opaque /oauth2/{authorize,token,introspect} + admin endpoints this change preserves. Verified (fresh MySQL, dev-mysql): - Boots clean (~37s) with NO JWKSource - POST /oauth2/token (client_credentials) -> 200 opaque token (128 chars, 0 dots) - POST /oauth2/introspect -> 200 RFC 7662 - wrong secret -> 401 - /.well-known/openid-configuration -> 404; /oauth2/jwks -> 302 (no key served) Known minor residue: the OAuth2 metadata doc still advertises a jwks_uri that now 302s (removing it needs a metadata customizer; harmless for opaque-only). Left as-is. Refs: #122 #128 #129 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Commits

Commits on May 27, 2026

fix(authserver): strip unused OIDC/JWK/JWT — ESPI is opaque-only