--------------------------------------------------------------------------
 Keycloak discovery document
--------------------------------------------------------------------------
  issuer                 http://localhost:8080/realms/demo
  jwks_uri               http://localhost:8080/realms/demo/protocol/openid-connect/certs
  token_endpoint         http://localhost:8080/realms/demo/protocol/openid-connect/token
--------------------------------------------------------------------------
 Keycloak JWK Set
--------------------------------------------------------------------------
  keys published: 2
   kid=drdWA3YaK3PfH8uKORPsqYsf30mlkxtLKJdvYFzWqO4 alg=RSA-OAEP use=enc kty=RSA
   kid=B8LKu8nKy9b_CCTMqaZBdRH7dH1ASVjg5Do5hElKpQE alg=RS256 use=sig kty=RSA
--------------------------------------------------------------------------
 1. alice, password grant
--------------------------------------------------------------------------
  header: {"alg": "RS256", "typ": "JWT", "kid": "B8LKu8nKy9b_CCTMqaZBdRH7dH1ASVjg5Do5hElKpQE"}
  iss                "http://localhost:8080/realms/demo"
  aud                "reports-api"
  typ                "Bearer"
  scope              "email profile"
  preferred_username "alice"
  realm_access       {"roles": ["USER"]}
  resource_access    {"reports-api": {"roles": ["reports-reader"]}}

$ GET /api/me
HTTP 200
{
    "name": "79448051-2590-4dfe-8374-314fcf2d7273",
    "authorities": [
        "FACTOR_BEARER",
        "SCOPE_email",
        "SCOPE_profile"
    ],
    "iss": "http://localhost:8080/realms/demo",
    "aud": [
        "reports-api"
    ],
    "typ": "JWT",
    "kid": "B8LKu8nKy9b_CCTMqaZBdRH7dH1ASVjg5Do5hElKpQE",
    "exp": "2026-08-23T10:39:01Z"
}


$ GET /api/reports    (client role, from resource_access.reports-api.roles)
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

$ GET /api/admin/stats (realm role ADMIN, which alice does not have)
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
--------------------------------------------------------------------------
 2. root
--------------------------------------------------------------------------

$ GET /api/admin/stats
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
--------------------------------------------------------------------------
 3. nobody - a user with no client role
--------------------------------------------------------------------------
  header: {"alg": "RS256", "typ": "JWT", "kid": "B8LKu8nKy9b_CCTMqaZBdRH7dH1ASVjg5Do5hElKpQE"}
  iss                "http://localhost:8080/realms/demo"
  aud                "reports-api"
  typ                "Bearer"
  scope              "email profile"
  preferred_username "nobody"
  realm_access       {"roles": ["USER"]}

$ GET /api/reports
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"