[sleidig]

Adds PUT /v1/admin/api-client/{clientId}/scope with body { "scopes": [...] }. It replaces the client scopes (the access) of an API client and returns the updated ApiClient. Administrators can then change what an external system can access without creating new credentials for it. Frontend: Aam-Digital/ndb-core#4611

• closes Change the access of an existing API client ndb-core#4613

How it works

• It validates the scopes the same way as when creating a client (NO_SCOPE, UNKNOWN_SCOPE). This check is now validateScopes in NewApiClient.kt, and validateNewApiClient reuses it.
• It only adds and removes offered scopes as Default scopes. Keycloak's own Default scopes that the client got at creation (e.g. profile) stay as they are. As at creation, it removes any Optional scopes before adding scopes.
• The same security boundary applies: clients without the managed attribute or the api- prefix are API_CLIENT_NOT_FOUND.
• The audit log line [audit] User '…' (…) changed the client scopes of API client '…' to [...] records every change. Failed attempts are logged the same way as for the other actions.
• Access tokens issued before the change keep their scopes until they expire. The spec and docs say so.

Changes

• ApiClientAdministration.updateScopes and its Keycloak implementation
• ApiClientController.updateScopes with UpdateApiClientScopesRequestDto
• OpenAPI spec (admin-api-v1.yaml), docs/modules/admin.md and the module README
• Tests: audit log in ApiClientControllerTest. Keycloak integration tests: tokens carry the new scopes, Keycloak's own scopes are kept, scopes that aren't offered or an empty list are rejected, and other clients of the realm can't be changed.

Testing

⚠️ I could not build or run the tests locally: Maven Central answered HTTP 429 while Gradle resolved plugins in the dev environment. CI has to confirm compilation, ktlint and the tests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fb2hmonEJ4GPn7E8vpSMBC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Aam-Digital/aam-services
• Branch: claude/api-client-edit-scopes
• File: .coderabbit.yaml
• Commit: 3574077
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67e80e0a-b8ba-4ba5-a98c-bbd41dc572c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Abhinegi2]

looks good to me