==========================================================================
 jwt-auth-demo - built-in resource server
 profiles: hs256,resourceserver,strict
==========================================================================

--------------------------------------------------------------------------
# 1. The filter chain. Note BearerTokenAuthenticationFilter in place of our
#    hand-written JwtAuthenticationFilter - same slot, framework-owned.

HTTP 200
[
    {
        "chain": "DefaultSecurityFilterChain defined as 'apiFilterChain' in [class path resource [com/ankurm/jwtauth/config/ResourceServerSecurityConfig.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Logout, OAuth2ProtectedResourceMetadata, BearerTokenAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization]",
        "filters": [
            "DisableEncodeUrlFilter",
            "WebAsyncManagerIntegrationFilter",
            "SecurityContextHolderFilter",
            "HeaderWriterFilter",
            "LogoutFilter",
            "OAuth2ProtectedResourceMetadataFilter",


--------------------------------------------------------------------------
# 2. Access token -> 200.

HTTP 200
{
    "name": "alice",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_USER",
        "SCOPE_profile:read"
    ],
    "authenticationType": "JwtAuthenticationToken",
    "jti": "c140fc47-8b48-41e9-bd01-071d398b6c8b",
    "issuer": "https://jwt-auth-demo.ankurm.com",


--------------------------------------------------------------------------
# 3. Non-admin on an admin route -> 403 insufficient_scope.

HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

--------------------------------------------------------------------------
# 4. REFRESH token presented as an access token.
#    This is the line to watch when comparing the two runs.

HTTP 401
WWW-Authenticate: Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Expected a token with token_type=access", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:8080/.well-known/oauth-protected-resource"

--------------------------------------------------------------------------
# end