==============================================================================
docs/output/02-five-strategies.txt
The same request into the edge service, five ways of getting a token for the hop to
downstream. Read the sub and scope of each downstream response.
GET /edge/{naive,relay,client-credentials,exchange,relay-async}
==============================================================================

$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/naive
{
    "strategy": "no token forwarded",
    "error": "Unauthorized: 401 Unauthorized: [no body]"
}

$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/relay
{
    "strategy": "bearer token relayed from the incoming request",
    "downstream": {
        "service": "downstream:8082",
        "strictValidation": false,
        "sub": "alice",
        "aud": [
            "downstream-api"
        ],
        "iss": "http://127.0.0.1:9000",
        "scope": "[orders.write, orders.read]",
        "client_id": null,
        "authorities": [
            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
            "SCOPE_orders.read",
            "SCOPE_orders.write"
        ],
        "cnf": null,
        "orders": [
            {
                "total": "42.00",
                "id": 1
            }
        ]
    }
}

$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/client-credentials
{
    "strategy": "the edge service's own client_credentials token",
    "downstream": {
        "service": "downstream:8082",
        "strictValidation": false,
        "sub": "edge-service",
        "aud": [
            "downstream-api"
        ],
        "iss": "http://127.0.0.1:9000",
        "scope": "[orders.read]",
        "client_id": null,
        "authorities": [
            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
            "SCOPE_orders.read"
        ],
        "cnf": null,
        "orders": [
            {
                "total": "42.00",
                "id": 1
            }
        ]
    }
}

$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/exchange
{
    "strategy": "RFC 8693 token exchange",
    "downstream": {
        "service": "downstream:8082",
        "strictValidation": false,
        "sub": "alice",
        "aud": [
            "downstream-api"
        ],
        "iss": "http://127.0.0.1:9000",
        "scope": "[orders.read]",
        "client_id": null,
        "authorities": [
            "SCOPE_orders.read",
            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]"
        ],
        "cnf": null,
        "orders": [
            {
                "total": "42.00",
                "id": 1
            }
        ]
    }
}

$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/relay-async
{
    "strategy": "relay attempted from a separate thread",
    "error": "Unauthorized: 401 Unauthorized: [no body]"
}

# naive           - 401. The control.
# relay           - sub: alice, scope: [orders.write, orders.read]. The user's own
#                   token, unchanged, including scopes downstream did not need.
# client-creds    - sub: edge-service, scope: [orders.read]. Correctly scoped, and
#                   the user has disappeared from downstream's audit log.
# exchange        - sub: alice, scope: [orders.read]. Both. This is what RFC 8693 is
#                   for and it is the one nobody reaches for.
# relay-async     - 401. The relay interceptor reads SecurityContextHolder, which is
#                   a ThreadLocal, and the call was made on a different thread.