[dfcoffin]

Summary

The Authorization Server's development OAuth clients (data_custodian_admin, third_party, third_party_admin, datacustodian) are now seeded only when espi.authserver.seed.demo-clients=true. The local, dev-mysql, dev-postgresql and testcontainers profiles set it; every other profile (prod, docker, espi40, none) starts without them. This matches the production onboarding model agreed in #251 / #252: a production AS registers no Third Parties up front, and each one onboards through RFC 7591.

Changes

• AuthorizationServerConfig:
  • seedDemoClients flag (default false) around the existing seed-and-reconcile;
  • seedConfiguredClient: provisions datacustodian (DC introspection) and data_custodian_admin from ESPI_DATACUSTODIAN_CLIENT_SECRET / ESPI_DATACUSTODIAN_ADMIN_CLIENT_SECRET, stored hashed, rotating an existing row's secret when it no longer matches (same pattern as espi_admin / espi_registrar);
  • retireWellKnownSecrets: with seeding off, a row from an earlier release that still accepts its development secret gets a random hashed secret at startup.
• requireLoopbackIssuerForDemoClients: dev-mysql is the default profile in application.yml, so a deployment that forgets SPRING_PROFILES_ACTIVE would otherwise seed the demo clients. Startup now fails when demo seeding is on and the issuer host is not localhost / 127.0.0.1 / ::1.
• application.yml documents the new keys; the dev/test profile files enable demo seeding.
• DEPLOYMENT_GUIDE.md lists the new secrets.
• DemoClientSeedingTest (embedded H2, Spring's registered-client schema): default start seeds none; flag on seeds all four; configured secrets are hashed and used; leftover demo rows are retired; demo seeding on a non-loopback issuer fails startup; a configured secret replaces a leftover one on the same row id.

Deployment note

The docker profile has no AS profile file, so the compose setups now start without the demo clients. A containerised DC needs ESPI_DATACUSTODIAN_CLIENT_SECRET set on the AS (and the matching espi.authorization-server.client-secret on the DC) to introspect tokens.

Test plan

• DemoClientSeedingTest (6) and AuthorizationServerConfigReconcileTest pass locally
• All non-Docker AS tests pass (-DexcludedGroups=testcontainers-it)
• Testcontainers suite in CI (uses the testcontainers profile, which enables demo seeding)

🤖 Generated with Claude Code