do not allow scope update once client and service are linked.

[stevehu]

When both clients and services are registered with relationships set up in between, users are not allowed to update scope on the client anymore as the scope will be derived from services/endpoints. Currently, the client microservice throws an exception but still returns old scope and new scope in the response. In fact, the database wasn't updated and the old scope is still in both database and cache. We need capture the SQLException and return users a meaningful error code and message.

[stevehu]

A test case has been added but there is no SQLException for H2 database. Need to find a way to trigger SQLException in H2 or write a test case with other databases.

[sukruthakittur]

Steps to reproduce
Assumptions - There is a service X, with scopes A(/v1/endpoint1), B(/v1/endpoint2) & C(/v1/endpoint3).

1. Create a new client M with Scopes [A].
2. Link the client M with service X and endpoints - POST with body A(/v1/endpoint1), B(/v1/endpoint2)
3. Response to the above POST API comes back with
   { "old_scope": "A", "new_scope": "A B" }

Issue
4. Make a request to GET all clients API, which returns client M, scope A
5. Make a request to GET client by client ID, which returns client M with scope A, B
6. Generate JWT token and decode it. The payload is calculated with only scope A.

Error
In docker client service the following error popped up -

oauth2-client_1 | java.sql.SQLIntegrityConstraintViolationException: Cannot delete or update a parent row: a foreign key constraint fails (oauth2.client_service, CONSTRAINT client_service_ibfk_1 FOREIGN KEY (service_id, endpoint) REFERENCES service_endpoint (service_id, endpoint))

Environemnt
Windows
Docker on Windows
MySql

[stevehu]

@sukruthakittur Cool. I think I understood the issue originally. I will create a test case tomorrow to reproduce and fix it. Thanks a lot for your help.