Add Client resource type and scopes to authorization schema

[ShashankFC]

Test 5

Summary by CodeRabbit

Release Notes

• New Features
  • Added fine-grained authorization support for client management operations with granular permission scopes including configure, manage, view, and role mapping capabilities.
  • Administrators can now assign detailed access controls for client and client scope operations, enabling better permission delegation and compliance.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

---

Replicated from ai-code-review-evaluation/keycloak-coderabbit#5

[Copilot]

Pull request overview

This PR adds support for client resource types and scopes to the authorization schema, enabling fine-grained permission management for client operations.

Changes:

• Adds CLIENTS resource type with scopes: configure, manage, view, map-roles, map-roles-client-scope, and map-roles-composite
• Implements ClientPermissionsV2 class to handle client permission evaluation using the new authorization schema
• Refactors test utilities to use static methods and centralize permission creation logic

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
server-spi-private/src/main/java/org/keycloak/authorization/AdminPermissionsSchema.java	Adds CLIENTS resource type with associated scopes and client resolution logic
services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionsV2.java	Implements V2 permission checks for client operations using the new schema
services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissionsV2.java	Adds instantiation and management of ClientPermissionsV2
services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java	Adds comprehensive documentation for client permission methods
services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissions.java	Wraps event listener logic with feature flag check
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AbstractPermissionTest.java	Refactors test utilities to static methods and adds helper methods for policy and permission creation
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionClientTest.java	Adds comprehensive tests for client permission scenarios
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionRESTTest.java	Updates method calls to pass client parameter
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java	Refactors to use centralized helper methods and removes duplicate code
tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypePermissionTest.java	Updates method calls to pass client parameter

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The constant AdminPermissionsSchema.USERS_RESOURCE_TYPE is used instead of the existing usersType field pattern. For consistency with line 76 where clientsType is defined, consider using a similar field usersType or use the constant directly everywhere.

Suggested change

	createPermission(client, myadmin.getId(), AdminPermissionsSchema.USERS_RESOURCE_TYPE, Set.of(MAP_ROLES), onlyMyAdminUserPolicy);
	createPermission(client, myadmin.getId(), usersType, Set.of(MAP_ROLES), onlyMyAdminUserPolicy);