DC: implement ESPI Batch/Bulk API — Third Party client access token only, scoped to its own Authorizations #256

Summary

Implement the ESPI Bulk API on the Data Custodian: GET /espi/1_1/resource/Batch/Bulk/{bulkId}. Per REQ.21 it accepts only the Third Party's client access token (client_credentials, ThirdParty_Admin_Access) and returns, as one Atom feed, the data of every customer Authorization that the Third Party holds under that bulk id.

Current state

• No Batch/Bulk endpoint exists (CLAUDE.md "REST API Structure" lists it as not implemented). SecurityConfiguration only routes /espi/1_1/resource/Batch/** into the generic usage-data rule (FB_4 + commodity, or DC admin), which is the wrong token for Bulk.
• Building blocks already present:
  • AuthorizationRepository.findAllIdsByBulkId(thirdParty, bulkId) (matches on scope LIKE :bulkId) and AuthorizationService.findAllIdsByBulkId;
  • NotificationServiceImpl already treats /Batch/Bulk/ resource URIs as the Third Party's client access token URIs;
  • the AS's EspiTokenCustomizer maps a Third Party admin to the .../Batch/Bulk/** resource URI (JWT-era code).
• The client access token response does not yet carry the Bulk resourceURI or the authorizationURI (ESPI token-response URIs: FB_51 gating, re-provisioning on refresh, missing URIs for client_credentials tokens #202).

Scope

1. Endpoint: GET /espi/1_1/resource/Batch/Bulk/{bulkId} → an Atom feed (the fix(#247): export DC collection endpoints as Atom feeds instead of a bare List #250 exportFeed assembly) of the resources of every Authorization of the calling Third Party whose scope carries BulkId={bulkId}.
2. Access rule (single source of truth):
   • accept only ThirdParty_Admin_Access (Third Party client access token), plus DataCustodian_Admin_Access for operators;
   • reject customer function-block tokens and the registration access token (403);
   • ownership: only Authorizations whose applicationInformation.clientId equals the token's client_id (same rule as AdminCaller, fix(#247): export DC collection endpoints as Atom feeds instead of a bare List #250); an unknown or foreign bulk id → 404.
   • Move /Batch/Bulk/** out of the generic usage-data matcher in SecurityConfiguration.
3. Data and limits: decide the feed's content per REQ.21 (UsagePoint subtree per Authorization) and add paging or size limits, since bulk responses can be large; consider streaming.
4. Notification: a Third Party is told about bulk data through its notification URI (BatchList containing the Bulk URI). Confirm that the existing NotificationServiceImpl path produces those URIs.
5. Tests:
   • Third Party client token → 200 with only its own Authorizations' data;
   • another Third Party's bulk id → 404;
   • customer token → 403; registration access token → 403;
   • DC admin → 200;
   • the empty bulk case returns an empty feed.

Dependencies

#202 (client access token resourceURI / authorizationURI), #251 (Third Party client credentials limited to ThirdParty_Admin_Access / FB=36_40), #187 (resource scoping / E1 engine), #253 (sample data for manual testing), #255 (roadmap: Phase 2)

🤖 Generated with Claude Code