docs: add 39-branch Keycloak governance index

.gitignore

@@ -4,7 +4,7 @@
 *.iml
 
 backend/target/
-token-mediator/target/
-**/node_modules/
-frontend/dist/
 build/
+e2e/node_modules/
+frontend/node_modules/
+frontend/dist/

README.md

@@ -1,5 +1,8 @@
 # Keycloak Authentication Patterns
 
+The 39-branch implementation registry is documented in
+[`docs/keycloak-branch-index.md`](docs/keycloak-branch-index.md).
+
 Keycloak을 중심으로 네 가지 브라우저 인증 통합 패턴을 같은 로컬
 인프라에서 비교하는 학습 프로젝트입니다.
 
@@ -96,16 +99,3 @@ Keycloak을 잠시 중지하고 export한 뒤 자동으로 다시 올립니다.
 
 runtime export에는 실제 client secret과 credential hash가 포함될 수 있어
 gitignored `build/keycloak-export/`에 권한 `0600`으로만 저장됩니다.
-
-## AP2: Token-Mediating Backend
-
-`develop-keycloak-pattern2`의 Spring confidential client는
-`http://localhost:8082`에서 실행됩니다. 브라우저는 로그인 redirect와
-HttpOnly `AP2_SESSION`만 사용하고, authorization code 교환과
-access/refresh token 보관은 backend가 담당합니다.
-
-```bash
-./scripts/verify-pattern2.sh
-```
-
-`/token/boundary`는 실제 token 값을 반환하지 않고 서버 저장 여부만 보여줍니다.

docker-compose.yml

@@ -86,29 +86,6 @@ services:
       - keycloak-net
     restart: unless-stopped
 
-  token-mediator:
-    build:
-      context: ./token-mediator
-    environment:
-      SERVER_PORT: "8082"
-      KEYCLOAK_CLIENT_SECRET: ${TOKEN_MEDIATING_CLIENT_SECRET:?set TOKEN_MEDIATING_CLIENT_SECRET in .env}
-    ports:
-      - "127.0.0.1:8082:8082"
-    depends_on:
-      keycloak:
-        condition: service_healthy
-    healthcheck:
-      test:
-        - CMD-SHELL
-        - wget -q -O - http://127.0.0.1:8082/actuator/health | grep -q '"status":"UP"'
-      interval: 10s
-      timeout: 5s
-      retries: 12
-      start_period: 20s
-    networks:
-      - keycloak-net
-    restart: unless-stopped
-
   nginx:
     build:
       context: ./frontend

docs/keycloak-branch-index.md

@@ -0,0 +1,29 @@
+# Keycloak branch implementation index
+
+The source inventory contains 39 `feature-keycloak-*.md` branch notes. This
+repository preserves one local Git feature branch for every note and merges it
+with `--no-ff` into either the common `develop` baseline or one of the four
+authentication-pattern branches.
+
+| Target | Meaning |
+|---|---|
+| `common` | Shared realm, federation, deployment, or governance contract. Merge into `develop`, then propagate to AP1–AP4. |
+| `ap1` | Browser-based OAuth client: vanilla SPA, Authorization Code + PKCE, Resource Server. |
+| `ap2` | Token-mediating confidential backend: browser receives access token only. |
+| `ap3` | BFF: backend owns every OAuth token and browser owns only a session cookie. |
+| `ap4` | Edge forward-auth: oauth2-proxy/Nginx owns login and backend trusts an isolated identity header. |
+
+The machine-readable registry is
+[`keycloak-branch-manifest.tsv`](keycloak-branch-manifest.tsv). Run:
+
+```bash
+./scripts/audit-keycloak-branches.sh
+```
+
+The audit succeeds only when all 39 note names have matching local feature
+branches and each feature tip is reachable from its declared target branch.
+
+Google credentials are never committed. The default local acceptance harness
+uses a second Keycloak realm as a controllable OIDC provider so claim mapping
+and unsafe-linking failure paths can be reproduced. A real Google login remains
+an explicit credentialed/public-HTTPS verification profile.

docs/keycloak-branch-manifest.tsv

@@ -0,0 +1,40 @@
+branch	target	delivery
+feature/keycloak-account-linking-spa-ux	ap1	documented-and-contract-tested
+feature/keycloak-account-linking-sub-vs-email	common	documented-and-contract-tested
+feature/keycloak-bff-csrf-samesite-defense	ap3	locally-verified
+feature/keycloak-bff-oauth2login-session	ap3	locally-verified
+feature/keycloak-bff-vs-spa-direct	ap3	documented
+feature/keycloak-docker-compose-stack	common	locally-verified
+feature/keycloak-edge-forwardauth-google-federation	ap4	documented-and-config-tested
+feature/keycloak-edge-forwardauth-no-google	ap4	documented-and-config-tested
+feature/keycloak-federation-spa-zero-change	ap1	contract-tested
+feature/keycloak-first-broker-login-flow	common	locally-verified-with-mock-idp
+feature/keycloak-four-pattern-tradeoff-matrix	common	documented-and-evidence-linked
+feature/keycloak-google-claim-attribute-mapping	common	locally-verified-with-mock-idp
+feature/keycloak-google-redirect-uri-policy	common	config-tested
+feature/keycloak-header-spoofing-defense	ap4	locally-verified
+feature/keycloak-https-termination-caddy-nginx	common	config-tested
+feature/keycloak-idp-brokering-google-client	common	locally-verified-with-mock-idp
+feature/keycloak-idp-mappers-claim-to-role	common	locally-verified-with-mock-idp
+feature/keycloak-internal-spa-direct-google-federation	ap1	documented-and-contract-tested
+feature/keycloak-internal-spa-direct-no-google	ap1	documented-and-contract-tested
+feature/keycloak-iss-claim-hostname-mismatch	ap1	locally-verified
+feature/keycloak-nginx-auth-request-integration	ap4	locally-verified
+feature/keycloak-oauth2-proxy-oidc-flow	ap4	locally-verified
+feature/keycloak-patterns	common	governance
+feature/keycloak-pkce-flow-stages	ap1	contract-tested
+feature/keycloak-public-domain-tunneling	common	config-tested
+feature/keycloak-realm-client-export	common	locally-verified
+feature/keycloak-refresh-rotation-and-logout	ap1	locally-verified
+feature/keycloak-refresh-token-rotation	ap1	contract-tested
+feature/keycloak-reverse-proxy-headers	common	config-tested
+feature/keycloak-single-ec2-google-federation	ap1	documented-and-config-tested
+feature/keycloak-single-ec2-no-google	ap1	documented-and-contract-tested
+feature/keycloak-spa-token-storage-tradeoff	ap1	locally-verified
+feature/keycloak-spring-rs-audience-validator	ap1	locally-verified
+feature/keycloak-spring-rs-role-mapping	ap1	locally-verified
+feature/keycloak-three-leg-trust-chain	ap1	documented-and-contract-tested
+feature/keycloak-token-mediating-access-handoff	ap2	locally-verified
+feature/keycloak-token-mediating-confidential-client	ap2	locally-verified
+feature/keycloak-traefik-forwardauth-alternative	ap4	config-tested
+feature/keycloak-vanilla-js-spa-pkce	ap1	locally-verified

e2e/package-lock.json

@@ -1,28 +0,0 @@
-{
-  "name": "keycloak-pattern-e2e",
-  "version": "1.0.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "keycloak-pattern-e2e",
-      "version": "1.0.0",
-      "devDependencies": {
-        "playwright-core": "1.62.0"
-      }
-    },
-    "node_modules/playwright-core": {
-      "version": "1.62.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.0.tgz",
-      "integrity": "sha512-nsNRyq0r2zsG8AcRHWknc9QRA5XCueC7gWMrs+Gx2tlZn9hcl8zudfh00lhJPY1DE7NmZ6bDsT9g2yey8mXljA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "playwright-core": "cli.js"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    }
-  }
-}

e2e/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "keycloak-pattern-e2e",
-  "private": true,
-  "version": "1.0.0",
-  "type": "module",
-  "scripts": {
-    "test:pattern2": "node pattern2.mjs"
-  },
-  "devDependencies": {
-    "playwright-core": "1.62.0"
-  }
-}

e2e/pattern2.mjs

@@ -1,57 +0,0 @@
-import assert from "node:assert/strict";
-import { chromium } from "playwright-core";
-
-const password = process.env.E2E_PASSWORD;
-assert.ok(password, "E2E_PASSWORD must be set");
-
-const browser = await chromium.launch({
-  executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
-  headless: true,
-  args: ["--no-sandbox"],
-});
-
-try {
-  const context = await browser.newContext();
-  const page = await context.newPage();
-
-  await page.goto("http://localhost:8082");
-  await page.locator("#login").click();
-  await page.waitForURL(/localhost:8080/u);
-  await page.locator("#username").fill(
-    process.env.E2E_USERNAME ?? "regular-user",
-  );
-  await page.locator("#password").fill(password);
-  await page.locator("#kc-login").click();
-  await page.waitForURL("http://localhost:8082/");
-
-  const boundaryResponsePromise = page.waitForResponse((response) =>
-    response.url().endsWith("/token/boundary"),
-  );
-  await page.locator("#inspect").click();
-  const boundaryResponse = await boundaryResponsePromise;
-  assert.equal(boundaryResponse.status(), 200);
-  const boundary = await boundaryResponse.json();
-
-  assert.equal(boundary.accessTokenStored, true);
-  assert.equal(boundary.refreshTokenStored, true);
-  assert.equal(boundary.browserReceivesRefreshToken, false);
-  assert.equal(JSON.stringify(boundary).includes("refresh_token"), false);
-
-  const cookies = await context.cookies("http://localhost:8082/");
-  const sessionCookie = cookies.find((cookie) => cookie.name === "AP2_SESSION");
-  assert.ok(sessionCookie);
-  assert.equal(sessionCookie.httpOnly, true);
-  assert.equal(sessionCookie.sameSite, "Lax");
-
-  const storage = await page.evaluate(() => ({
-    localStorage: Object.values(localStorage),
-    sessionStorage: Object.values(sessionStorage),
-  }));
-  assert.equal(JSON.stringify(storage).includes("refresh_token"), false);
-
-  console.log(
-    "pattern2 confidential client verified: server code exchange, server access/refresh custody, HttpOnly session",
-  );
-} finally {
-  await browser.close();
-}

scripts/audit-keycloak-branches.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env sh
+set -eu
+
+manifest="${1:-docs/keycloak-branch-manifest.tsv}"
+notes_dir="${KEYCLOAK_BRANCH_NOTES_DIR:-/home/donghyeon/workspace/ai-tools/llm-wiki/raw/branch-notes}"
+
+expected_count="$(awk 'NR > 1 { count += 1 } END { print count + 0 }' "$manifest")"
+if [ "$expected_count" -ne 39 ]; then
+  echo "manifest must contain exactly 39 Keycloak branches; found $expected_count" >&2
+  exit 1
+fi
+
+note_count="$(find "$notes_dir" -maxdepth 1 -type f -name 'feature-keycloak-*.md' | wc -l)"
+if [ "$note_count" -ne 39 ]; then
+  echo "branch-note inventory must contain exactly 39 files; found $note_count" >&2
+  exit 1
+fi
+
+missing=0
+unmerged=0
+tab="$(printf '\t')"
+
+while IFS="$tab" read -r branch target delivery; do
+  [ "$branch" = "branch" ] && continue
+
+  note_name="$(printf '%s\n' "$branch" |
+    sed 's#^feature/keycloak-#feature-keycloak-#').md"
+  if [ ! -f "$notes_dir/$note_name" ]; then
+    echo "missing branch note: $note_name" >&2
+    missing=$((missing + 1))
+  fi
+
+  if ! git show-ref --verify --quiet "refs/heads/$branch"; then
+    echo "missing local branch: $branch" >&2
+    missing=$((missing + 1))
+    continue
+  fi
+
+  case "$target" in
+    common) target_branch="develop" ;;
+    ap1) target_branch="develop-keycloak-pattern1" ;;
+    ap2) target_branch="develop-keycloak-pattern2" ;;
+    ap3) target_branch="develop-keycloak-pattern3" ;;
+    ap4) target_branch="develop-keycloak-pattern4" ;;
+    *)
+      echo "unknown target '$target' for $branch ($delivery)" >&2
+      exit 1
+      ;;
+  esac
+
+  if ! git merge-base --is-ancestor "$branch" "$target_branch"; then
+    echo "feature tip is not merged: $branch -> $target_branch" >&2
+    unmerged=$((unmerged + 1))
+  fi
+done < "$manifest"
+
+if [ "$missing" -ne 0 ] || [ "$unmerged" -ne 0 ]; then
+  echo "Keycloak branch audit failed: missing=$missing unmerged=$unmerged" >&2
+  exit 1
+fi
+
+echo "Keycloak branch audit passed: 39/39 branches exist and are merged"

scripts/verify-pattern2.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-if [ ! -f .env ]; then
-  echo "missing .env; copy .env.example and set development values" >&2
-  exit 1
-fi
-
-set -a
-. ./.env
-set +a
-
-docker compose down --volumes --remove-orphans
-docker compose up --build -d --wait
-
-npm --prefix e2e ci
-E2E_USERNAME=regular-user \
-E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
-  npm --prefix e2e run test:pattern2
-
-echo "AP2 confidential client boundary verified"

token-mediator/.dockerignore

@@ -1 +0,0 @@
-target/

token-mediator/Dockerfile

@@ -1,17 +0,0 @@
-FROM maven:3.9.11-eclipse-temurin-21-alpine AS build
-
-WORKDIR /workspace
-COPY pom.xml .
-RUN mvn --batch-mode dependency:go-offline
-COPY src src
-RUN mvn --batch-mode verify
-
-FROM eclipse-temurin:21-jre-alpine
-
-RUN addgroup -S spring && adduser -S spring -G spring
-WORKDIR /app
-COPY --from=build /workspace/target/keycloak-token-mediator.jar app.jar
-USER spring:spring
-
-EXPOSE 8082
-ENTRYPOINT ["java", "-jar", "/app/app.jar"]

token-mediator/pom.xml

@@ -1,58 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-
-    <parent>
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.16</version>
-        <relativePath/>
-    </parent>
-
-    <groupId>com.example</groupId>
-    <artifactId>keycloak-token-mediator</artifactId>
-    <version>0.0.1-SNAPSHOT</version>
-    <name>keycloak-token-mediator</name>
-
-    <properties>
-        <java.version>21</java.version>
-    </properties>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-actuator</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-oauth2-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-web</artifactId>
-        </dependency>
-
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-test</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-test</artifactId>
-            <scope>test</scope>
-        </dependency>
-    </dependencies>
-
-    <build>
-        <finalName>keycloak-token-mediator</finalName>
-        <plugins>
-            <plugin>
-                <groupId>org.springframework.boot</groupId>
-                <artifactId>spring-boot-maven-plugin</artifactId>
-            </plugin>
-        </plugins>
-    </build>
-</project>

token-mediator/src/main/java/com/example/keycloakpattern/mediator/SecurityConfig.java

@@ -1,29 +0,0 @@
-package com.example.keycloakpattern.mediator;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-@Configuration
-public class SecurityConfig {
-
-    @Bean
-    SecurityFilterChain mediatorSecurity(HttpSecurity http) throws Exception {
-        return http
-            .authorizeHttpRequests(authorize -> authorize
-                .requestMatchers(
-                    "/",
-                    "/index.html",
-                    "/app.js",
-                    "/favicon.ico",
-                    "/actuator/health",
-                    "/actuator/health/**"
-                )
-                .permitAll()
-                .anyRequest()
-                .authenticated())
-            .oauth2Login(oauth2 -> oauth2.defaultSuccessUrl("/", true))
-            .build();
-    }
-}

token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenBoundaryController.java

@@ -1,44 +0,0 @@
-package com.example.keycloakpattern.mediator;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-
-import org.springframework.http.CacheControl;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-@RestController
-public class TokenBoundaryController {
-
-    private final OAuth2AuthorizedClientService authorizedClientService;
-
-    public TokenBoundaryController(
-        OAuth2AuthorizedClientService authorizedClientService
-    ) {
-        this.authorizedClientService = authorizedClientService;
-    }
-
-    @GetMapping("/token/boundary")
-    ResponseEntity<Map<String, Object>> tokenBoundary(Authentication authentication) {
-        OAuth2AuthorizedClient client = authorizedClientService.loadAuthorizedClient(
-            "keycloak",
-            authentication.getName()
-        );
-
-        Map<String, Object> response = new LinkedHashMap<>();
-        response.put("pattern", "AP2-token-mediating-backend");
-        response.put("principal", authentication.getName());
-        response.put("accessTokenStored", client != null && client.getAccessToken() != null);
-        response.put("refreshTokenStored", client != null && client.getRefreshToken() != null);
-        response.put("browserReceivesRefreshToken", false);
-
-        return ResponseEntity.ok()
-            .cacheControl(CacheControl.noStore())
-            .header("Pragma", "no-cache")
-            .body(response);
-    }
-}

token-mediator/src/main/java/com/example/keycloakpattern/mediator/TokenMediatorApplication.java

@@ -1,12 +0,0 @@
-package com.example.keycloakpattern.mediator;
-
-import org.springframework.boot.SpringApplication;
-import org.springframework.boot.autoconfigure.SpringBootApplication;
-
-@SpringBootApplication
-public class TokenMediatorApplication {
-
-    public static void main(String[] args) {
-        SpringApplication.run(TokenMediatorApplication.class, args);
-    }
-}

token-mediator/src/main/resources/application.yml

@@ -1,44 +0,0 @@
-server:
-  port: ${SERVER_PORT:8082}
-  servlet:
-    session:
-      cookie:
-        name: AP2_SESSION
-        http-only: true
-        same-site: lax
-
-spring:
-  application:
-    name: keycloak-token-mediator
-  security:
-    oauth2:
-      client:
-        registration:
-          keycloak:
-            provider: keycloak
-            client-id: token-mediating-confidential
-            client-secret: ${KEYCLOAK_CLIENT_SECRET}
-            client-authentication-method: client_secret_basic
-            authorization-grant-type: authorization_code
-            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
-            scope:
-              - openid
-              - profile
-              - email
-        provider:
-          keycloak:
-            authorization-uri: http://localhost:8080/realms/keycloak-patterns/protocol/openid-connect/auth
-            token-uri: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/token
-            jwk-set-uri: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
-            user-info-uri: http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
-            user-name-attribute: preferred_username
-
-management:
-  endpoint:
-    health:
-      probes:
-        enabled: true
-  endpoints:
-    web:
-      exposure:
-        include: health,info

token-mediator/src/main/resources/static/app.js

@@ -1,20 +0,0 @@
-const result = document.querySelector("#result");
-
-function render(value) {
-  result.textContent = JSON.stringify(value, null, 2);
-}
-
-document.querySelector("#login").addEventListener("click", () => {
-  window.location.assign("/oauth2/authorization/keycloak");
-});
-
-document.querySelector("#inspect").addEventListener("click", async () => {
-  const response = await fetch("/token/boundary", {
-    headers: { Accept: "application/json" },
-  });
-  if (response.redirected || response.status === 401) {
-    window.location.assign("/oauth2/authorization/keycloak");
-    return;
-  }
-  render(await response.json());
-});

token-mediator/src/main/resources/static/index.html

@@ -1,29 +0,0 @@
-<!doctype html>
-<html lang="ko">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>AP2 · Token-Mediating Backend</title>
-  <style>
-    :root { color-scheme: light dark; font-family: system-ui, sans-serif; }
-    body { max-width: 52rem; margin: 6vh auto; padding: 0 1.5rem; line-height: 1.6; }
-    button { margin-right: 0.5rem; padding: 0.6rem 0.9rem; cursor: pointer; }
-    pre { min-height: 8rem; padding: 1rem; border-radius: 0.4rem;
-      background: color-mix(in srgb, CanvasText 9%, Canvas); white-space: pre-wrap; }
-  </style>
-</head>
-<body>
-  <main>
-    <h1>AP2 · Token-Mediating Backend</h1>
-    <p>
-      confidential backend가 authorization code를 token으로 교환합니다.
-      refresh token은 서버의 <code>OAuth2AuthorizedClientService</code>에만
-      보관됩니다.
-    </p>
-    <button id="login" type="button">Keycloak 로그인</button>
-    <button id="inspect" type="button">서버 token 경계 확인</button>
-    <pre id="result" aria-live="polite"></pre>
-  </main>
-  <script type="module" src="/app.js"></script>
-</body>
-</html>

token-mediator/src/test/java/com/example/keycloakpattern/mediator/TokenBoundaryControllerTest.java

@@ -1,50 +0,0 @@
-package com.example.keycloakpattern.mediator;
-
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.oidcLogin;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.security.oauth2.core.OAuth2AccessToken;
-import org.springframework.security.oauth2.core.OAuth2RefreshToken;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.test.web.servlet.MockMvc;
-
-@SpringBootTest(properties = "KEYCLOAK_CLIENT_SECRET=test-only-secret")
-@AutoConfigureMockMvc
-class TokenBoundaryControllerTest {
-
-    @Autowired
-    private MockMvc mockMvc;
-
-    @MockitoBean
-    private OAuth2AuthorizedClientService authorizedClientService;
-
-    @Test
-    void reportsServerSideTokensWithoutReturningTheirValues() throws Exception {
-        OAuth2AuthorizedClient client = mock(OAuth2AuthorizedClient.class);
-        when(client.getAccessToken()).thenReturn(mock(OAuth2AccessToken.class));
-        when(client.getRefreshToken()).thenReturn(mock(OAuth2RefreshToken.class));
-        when(authorizedClientService.loadAuthorizedClient("keycloak", "test-subject"))
-            .thenReturn(client);
-
-        mockMvc.perform(get("/token/boundary").with(oidcLogin()
-                .idToken(token -> token.subject("test-subject"))))
-            .andExpect(status().isOk())
-            .andExpect(header().string("Cache-Control", "no-store"))
-            .andExpect(jsonPath("$.accessTokenStored").value(true))
-            .andExpect(jsonPath("$.refreshTokenStored").value(true))
-            .andExpect(jsonPath("$.browserReceivesRefreshToken").value(false))
-            .andExpect(jsonPath("$.access_token").doesNotExist())
-            .andExpect(jsonPath("$.refresh_token").doesNotExist());
-    }
-}