Implement access token context encoding framework

[ShashankFC]

Test 8

Summary by CodeRabbit

• New Features

  • Introduced token context encoding system enabling metadata encoding and retrieval for access tokens.
  • Added grant type shortcut support across OAuth2 grant types for improved token processing.

• Bug Fixes

  • Fixed variable naming error in token audience processing logic.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

---

Replicated from ai-code-review-evaluation/keycloak-coderabbit#8

[Copilot]

Pull request overview

This PR implements a token context encoding framework that embeds metadata directly into access token IDs. The framework encodes session type (online/offline/transient), token type (regular/lightweight), and grant type information into a 6-character prefix followed by the raw token ID (format: {sessionType}{tokenType}{grantType}:{rawTokenId}).

Changes:

• Introduces new TokenContextEncoderProvider SPI with default implementation for encoding/decoding token context
• Adds grant type shortcut support to all OAuth2 grant type factories (2-character shortcuts like "ac", "rt", "dg", etc.)
• Updates token generation and test assertions to use the new encoded token ID format

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
AccessTokenContext.java	Defines context data structure with SessionType, TokenType, and grantType enums
TokenContextEncoderProvider.java	Provider interface for encoding/decoding token context
DefaultTokenContextEncoderProvider.java	Default implementation of encoding/decoding logic
DefaultTokenContextEncoderProviderFactory.java	Factory managing grant type shortcut mappings and provider lifecycle
TokenManager.java	Integrates encoder into token generation flow and fixes typo in variable name
OAuth2GrantTypeFactory.java	Adds getShortcut() method to interface
Various grant type factories	Implements getShortcut() returning 2-character codes
OAuth2GrantType.java	Adds grantType field to Context and removes duplicate constructor
Various grant type implementations	Sets GRANT_TYPE attribute on clientSessionContext
AssertEvents.java	Updates test assertions to validate encoded token IDs with grant shortcuts
DefaultTokenContextEncoderProviderTest.java	Comprehensive unit tests for encoding/decoding logic

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The logic is inverted - this returns false when the grant shortcut matches, but should return true. Change return false to return true.

Suggested change

	if (items[0].substring(3, 5).equals(expectedGrantShortcut)) return false;
	if (!items[0].substring(3, 5).equals(expectedGrantShortcut)) return false;

[Copilot]

The error message references 'rawTokenId' but should reference 'grantType'. Additionally, this line duplicates the check on line 72 - it should validate rawTokenId instead.

Suggested change

	Objects.requireNonNull(grantType, "Null rawTokenId not allowed");
	Objects.requireNonNull(rawTokenId, "Null rawTokenId not allowed");

[Copilot]

The comment contains redundant wording ('character 4th char'). Consider revising to 'Grant type shortcut starts at the 4th character and is 2 characters long'.

Suggested change

	// Grant type shortcut starts at character 4th char and is 2-chars long
	// Grant type shortcut starts at the 4th character and is 2 characters long

[Copilot]

The documentation states '3-letters shortcut' but all implementations use 2-character shortcuts. Update to '2-character shortcut' for accuracy.

Suggested change

	* @return usually like 3-letters shortcut of specific grants. It can be useful for example in the tokens when the amount of characters should be limited and hence using full grant name
	* @return usually like 2-character shortcut of specific grants. It can be useful for example in the tokens when the amount of characters should be limited and hence using full grant name