feat(prism-agent): add JWT auth support for agent-admin role

[patlo-iog]

Overview

ATL-6074. This PR adds a concept of EntityRole to Entity and KeycloakEntity to implement the admin role auth of both JWT and admin-api-key following this ADR.

Checklist

My PR contains...

• No code changes (changes to documentation, CI, metadata, etc.)
• Bug fixes (non-breaking change which fixes an issue)
• Improvements (misc. changes to existing features)
• Features (non-breaking change which adds functionality)

My changes...

• are breaking changes
• are not breaking changes
• If yes to above: I have updated the documentation accordingly

Documentation

• My changes do not require a change to the project documentation
• My changes require a change to the project documentation
• If yes to above: I have updated the documentation accordingly

Tests

• My changes can not or do not need to be tested
• My changes can and should be tested by unit and/or integration tests
• If yes to above: I have added tests to cover my changes
• If yes to above: I have taken care to cover edge cases in my tests

[github-actions]

Integration Test Results

11 files  ±0  11 suites  ±0   2s ⏱️ ±0s
24 tests ±0  24 ✅ ±0  0 💤 ±0  0 ❌ ±0 
25 runs  ±0  25 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 4c459e3. ± Comparison against base commit b48fe3c.

♻️ This comment has been updated with latest results.

[github-actions]

Unit Test Results

 85 files  ±0   85 suites  ±0   20m 10s ⏱️ -54s
719 tests +6  711 ✅ +6  8 💤 ±0  0 ❌ ±0 
725 runs  +6  717 ✅ +6  8 💤 ±0  0 ❌ ±0 

Results for commit 4c459e3. ± Comparison against base commit b48fe3c.

This pull request removes 8 and adds 14 tests. Note that renamed tests count towards both.

io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - allow token with a permitted wallet
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - reject expired token
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - reject malformed token
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - reject token with a wallet that doesn't exist
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - reject token with multiple permitted wallets
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - reject token with no permitted wallet
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate with auto-upgrade RPT disabled - accecpt RPT token with a permitted wallet
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate with auto-upgrade RPT disabled - reject non-RPT token

io.iohk.atala.iam.authentication.SecurityLogicSpec ‑  - authorizeRole accept if the role is matched
io.iohk.atala.iam.authentication.SecurityLogicSpec ‑  - authorizeRole reject if the role is not matched
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - authenticate entity with multiple role not support
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - authenticate entity with specified role
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authenticate - authenticate entity with tenant role if not specified
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authorizeWalletAccess - admin role is not authorized for wallet access
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authorizeWalletAccess - allow token with a permitted wallet
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authorizeWalletAccess - reject expired token
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authorizeWalletAccess - reject malformed token
io.iohk.atala.iam.authentication.oidc.KeycloakAuthenticatorSpec ‑ KeycloakAuthenticatorSepc - authorizeWalletAccess - reject token with a wallet that doesn't exist
…

♻️ This comment has been updated with latest results.

[yshyn-iohk]

Good job, @patlo-iog!

[sonarcloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.9% Duplication on New Code

See analysis details on SonarCloud