The following issues were found

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationConsentServiceTests.java
56 issues
A high number of imports can indicate a high degree of coupling within an object.
Design

Line: 16 

               * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.springframework.security.oauth2.server.authorization;

import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Types;
import java.util.List;

Reported by PMD.

This class has too many methods, consider refactoring it.
Design

Line: 58 

               *
 * @author Ovidiu Popa
 */
public class JdbcOAuth2AuthorizationConsentServiceTests {
	private static final String OAUTH2_AUTHORIZATION_CONSENT_SCHEMA_SQL_RESOURCE = "org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql";
	private static final String CUSTOM_OAUTH2_AUTHORIZATION_CONSENT_SCHEMA_SQL_RESOURCE = "org/springframework/security/oauth2/server/authorization/custom-oauth2-authorization-consent-schema.sql";
	private static final String PRINCIPAL_NAME = "principal-name";
	private static final RegisteredClient REGISTERED_CLIENT = TestRegisteredClients.registeredClient().build();

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 73 

              					.authority(new SimpleGrantedAuthority("authority-b"))
					.build();

	private EmbeddedDatabase db;
	private JdbcOperations jdbcOperations;
	private RegisteredClientRepository registeredClientRepository;
	private JdbcOAuth2AuthorizationConsentService authorizationConsentService;

	@Before

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 74 

              					.build();

	private EmbeddedDatabase db;
	private JdbcOperations jdbcOperations;
	private RegisteredClientRepository registeredClientRepository;
	private JdbcOAuth2AuthorizationConsentService authorizationConsentService;

	@Before
	public void setUp() {

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 75 

              
	private EmbeddedDatabase db;
	private JdbcOperations jdbcOperations;
	private RegisteredClientRepository registeredClientRepository;
	private JdbcOAuth2AuthorizationConsentService authorizationConsentService;

	@Before
	public void setUp() {
		this.db = createDb();

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 76 

              	private EmbeddedDatabase db;
	private JdbcOperations jdbcOperations;
	private RegisteredClientRepository registeredClientRepository;
	private JdbcOAuth2AuthorizationConsentService authorizationConsentService;

	@Before
	public void setUp() {
		this.db = createDb();
		this.jdbcOperations = new JdbcTemplate(this.db);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 94 

              	@Test
	public void constructorWhenJdbcOperationsIsNullThenThrowIllegalArgumentException() {
		// @formatter:off
		assertThatThrownBy(() -> new JdbcOAuth2AuthorizationConsentService(null, this.registeredClientRepository))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("jdbcOperations cannot be null");
		// @formatter:on
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 94 

              	@Test
	public void constructorWhenJdbcOperationsIsNullThenThrowIllegalArgumentException() {
		// @formatter:off
		assertThatThrownBy(() -> new JdbcOAuth2AuthorizationConsentService(null, this.registeredClientRepository))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("jdbcOperations cannot be null");
		// @formatter:on
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 103 

              	@Test
	public void constructorWhenRegisteredClientRepositoryIsNullThenThrowIllegalArgumentException() {
		// @formatter:off
		assertThatThrownBy(() -> new JdbcOAuth2AuthorizationConsentService(this.jdbcOperations, null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("registeredClientRepository cannot be null");
		// @formatter:on
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 103 

              	@Test
	public void constructorWhenRegisteredClientRepositoryIsNullThenThrowIllegalArgumentException() {
		// @formatter:off
		assertThatThrownBy(() -> new JdbcOAuth2AuthorizationConsentService(this.jdbcOperations, null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("registeredClientRepository cannot be null");
		// @formatter:on
	}

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/TokenSettingsTests.java
56 issues
Unit tests should not contain more than 1 assert(s).
Design

Line: 35 

              public class TokenSettingsTests {

	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              
	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 37 

              	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 37 

              	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 38 

              	public void buildWhenDefaultThenDefaultsAreSet() {
		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              	public void buildWhenDefaultThenDefaultsAreSet() {
		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 39 

              		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

	@Test

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 39 

              		TokenSettings tokenSettings = TokenSettings.builder().build();
		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

	@Test

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 40 

              		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

	@Test
	public void accessTokenTimeToLiveWhenProvidedThenSet() {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 40 

              		assertThat(tokenSettings.getSettings()).hasSize(4);
		assertThat(tokenSettings.getAccessTokenTimeToLive()).isEqualTo(Duration.ofMinutes(5));
		assertThat(tokenSettings.isReuseRefreshTokens()).isTrue();
		assertThat(tokenSettings.getRefreshTokenTimeToLive()).isEqualTo(Duration.ofMinutes(60));
		assertThat(tokenSettings.getIdTokenSignatureAlgorithm()).isEqualTo(SignatureAlgorithm.RS256);
	}

	@Test
	public void accessTokenTimeToLiveWhenProvidedThenSet() {

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenRevocationTests.java
53 issues
Avoid reassigning parameters such as 'secret'
Design

Line: 190 

              		return parameters;
	}

	private static String encodeBasicAuth(String clientId, String secret) throws Exception {
		clientId = URLEncoder.encode(clientId, StandardCharsets.UTF_8.name());
		secret = URLEncoder.encode(secret, StandardCharsets.UTF_8.name());
		String credentialsString = clientId + ":" + secret;
		byte[] encodedBytes = Base64.getEncoder().encode(credentialsString.getBytes(StandardCharsets.UTF_8));
		return new String(encodedBytes, StandardCharsets.UTF_8);

Reported by PMD.

Avoid reassigning parameters such as 'clientId'
Design

Line: 190 

              		return parameters;
	}

	private static String encodeBasicAuth(String clientId, String secret) throws Exception {
		clientId = URLEncoder.encode(clientId, StandardCharsets.UTF_8.name());
		secret = URLEncoder.encode(secret, StandardCharsets.UTF_8.name());
		String credentialsString = clientId + ":" + secret;
		byte[] encodedBytes = Base64.getEncoder().encode(credentialsString.getBytes(StandardCharsets.UTF_8));
		return new String(encodedBytes, StandardCharsets.UTF_8);

Reported by PMD.

A high number of imports can indicate a high degree of coupling within an object.
Design

Line: 16 

               * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization;

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 83 

              	private static ProviderSettings providerSettings;

	@Rule
	public final SpringTestRule spring = new SpringTestRule();

	@Autowired
	private MockMvc mvc;

	@Autowired

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 86 

              	public final SpringTestRule spring = new SpringTestRule();

	@Autowired
	private MockMvc mvc;

	@Autowired
	private JdbcOperations jdbcOperations;

	@Autowired

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 89 

              	private MockMvc mvc;

	@Autowired
	private JdbcOperations jdbcOperations;

	@Autowired
	private RegisteredClientRepository registeredClientRepository;

	@Autowired

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 92 

              	private JdbcOperations jdbcOperations;

	@Autowired
	private RegisteredClientRepository registeredClientRepository;

	@Autowired
	private OAuth2AuthorizationService authorizationService;

	@BeforeClass

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 95 

              	private RegisteredClientRepository registeredClientRepository;

	@Autowired
	private OAuth2AuthorizationService authorizationService;

	@BeforeClass
	public static void init() {
		JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
		jwkSource = (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 101 

              	public static void init() {
		JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
		jwkSource = (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
		providerSettings = ProviderSettings.builder().tokenRevocationEndpoint("/test/revoke").build();
		db = new EmbeddedDatabaseBuilder()
				.generateUniqueName(true)
				.setType(EmbeddedDatabaseType.HSQL)
				.setScriptEncoding("UTF-8")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 101 

              	public static void init() {
		JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
		jwkSource = (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
		providerSettings = ProviderSettings.builder().tokenRevocationEndpoint("/test/revoke").build();
		db = new EmbeddedDatabaseBuilder()
				.generateUniqueName(true)
				.setType(EmbeddedDatabaseType.HSQL)
				.setScriptEncoding("UTF-8")
				.addScript("org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql")

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretBasicAuthenticationConverterTests.java
48 issues
Avoid reassigning parameters such as 'clientId'
Design

Line: 121 

              						entry(PkceParameterNames.CODE_VERIFIER, "code-verifier-1"));
	}

	private static String encodeBasicAuth(String clientId, String secret) throws Exception {
		clientId = URLEncoder.encode(clientId, StandardCharsets.UTF_8.name());
		secret = URLEncoder.encode(secret, StandardCharsets.UTF_8.name());
		String credentialsString = clientId + ":" + secret;
		byte[] encodedBytes = Base64.getEncoder().encode(credentialsString.getBytes(StandardCharsets.UTF_8));
		return new String(encodedBytes, StandardCharsets.UTF_8);

Reported by PMD.

Avoid reassigning parameters such as 'secret'
Design

Line: 121 

              						entry(PkceParameterNames.CODE_VERIFIER, "code-verifier-1"));
	}

	private static String encodeBasicAuth(String clientId, String secret) throws Exception {
		clientId = URLEncoder.encode(clientId, StandardCharsets.UTF_8.name());
		secret = URLEncoder.encode(secret, StandardCharsets.UTF_8.name());
		String credentialsString = clientId + ":" + secret;
		byte[] encodedBytes = Base64.getEncoder().encode(credentialsString.getBytes(StandardCharsets.UTF_8));
		return new String(encodedBytes, StandardCharsets.UTF_8);

Reported by PMD.

Private field 'converter' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 46 

               * @author Joe Grandja
 */
public class ClientSecretBasicAuthenticationConverterTests {
	private ClientSecretBasicAuthenticationConverter converter = new ClientSecretBasicAuthenticationConverter();

	@Test
	public void convertWhenAuthorizationHeaderEmptyThenReturnNull() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		Authentication authentication = this.converter.convert(request);

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 46 

               * @author Joe Grandja
 */
public class ClientSecretBasicAuthenticationConverterTests {
	private ClientSecretBasicAuthenticationConverter converter = new ClientSecretBasicAuthenticationConverter();

	@Test
	public void convertWhenAuthorizationHeaderEmptyThenReturnNull() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		Authentication authentication = this.converter.convert(request);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 52 

              	public void convertWhenAuthorizationHeaderEmptyThenReturnNull() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		Authentication authentication = this.converter.convert(request);
		assertThat(authentication).isNull();
	}

	@Test
	public void convertWhenAuthorizationHeaderNotBasicThenReturnNull() {
		MockHttpServletRequest request = new MockHttpServletRequest();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		MockHttpServletRequest request = new MockHttpServletRequest();
		request.addHeader(HttpHeaders.AUTHORIZATION, "Bearer token");
		Authentication authentication = this.converter.convert(request);
		assertThat(authentication).isNull();
	}

	@Test
	public void convertWhenAuthorizationHeaderBasicWithMissingCredentialsThenThrowOAuth2AuthenticationException() {
		MockHttpServletRequest request = new MockHttpServletRequest();

Reported by PMD.

The String literal 'Basic ' appears 4 times in this file; the first occurrence is on line 66
Error

Line: 66 

              	@Test
	public void convertWhenAuthorizationHeaderBasicWithMissingCredentialsThenThrowOAuth2AuthenticationException() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		request.addHeader(HttpHeaders.AUTHORIZATION, "Basic ");
		assertThatThrownBy(() -> this.converter.convert(request))
				.isInstanceOf(OAuth2AuthenticationException.class)
				.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
				.extracting("errorCode")
				.isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 67 

              	public void convertWhenAuthorizationHeaderBasicWithMissingCredentialsThenThrowOAuth2AuthenticationException() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		request.addHeader(HttpHeaders.AUTHORIZATION, "Basic ");
		assertThatThrownBy(() -> this.converter.convert(request))
				.isInstanceOf(OAuth2AuthenticationException.class)
				.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
				.extracting("errorCode")
				.isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 67 

              	public void convertWhenAuthorizationHeaderBasicWithMissingCredentialsThenThrowOAuth2AuthenticationException() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		request.addHeader(HttpHeaders.AUTHORIZATION, "Basic ");
		assertThatThrownBy(() -> this.converter.convert(request))
				.isInstanceOf(OAuth2AuthenticationException.class)
				.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
				.extracting("errorCode")
				.isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 67 

              	public void convertWhenAuthorizationHeaderBasicWithMissingCredentialsThenThrowOAuth2AuthenticationException() {
		MockHttpServletRequest request = new MockHttpServletRequest();
		request.addHeader(HttpHeaders.AUTHORIZATION, "Basic ");
		assertThatThrownBy(() -> this.converter.convert(request))
				.isInstanceOf(OAuth2AuthenticationException.class)
				.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
				.extracting("errorCode")
				.isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);
	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java
47 issues
A high number of imports can indicate a high degree of coupling within an object.
Design

Line: 16 

               * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.springframework.security.oauth2.server.authorization.oidc.authentication;

import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
import java.util.Base64;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 67 

              	private static final StringKeyGenerator CLIENT_SECRET_GENERATOR = new Base64StringKeyGenerator(
			Base64.getUrlEncoder().withoutPadding(), 48);
	private static final String DEFAULT_AUTHORIZED_SCOPE = "client.create";
	private final RegisteredClientRepository registeredClientRepository;
	private final OAuth2AuthorizationService authorizationService;

	/**
	 * Constructs an {@code OidcClientRegistrationAuthenticationProvider} using the provided parameters.
	 *

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 68 

              			Base64.getUrlEncoder().withoutPadding(), 48);
	private static final String DEFAULT_AUTHORIZED_SCOPE = "client.create";
	private final RegisteredClientRepository registeredClientRepository;
	private final OAuth2AuthorizationService authorizationService;

	/**
	 * Constructs an {@code OidcClientRegistrationAuthenticationProvider} using the provided parameters.
	 *
	 * @param registeredClientRepository the repository of registered clients

Reported by PMD.

The method 'authenticate(Authentication)' has a cyclomatic complexity of 14.
Design

Line: 85 

              	}

	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		OidcClientRegistrationAuthenticationToken clientRegistrationAuthentication =
				(OidcClientRegistrationAuthenticationToken) authentication;

		// Validate the "initial" access token
		AbstractOAuth2TokenAuthenticationToken<?> accessTokenAuthentication = null;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 91 

              
		// Validate the "initial" access token
		AbstractOAuth2TokenAuthenticationToken<?> accessTokenAuthentication = null;
		if (AbstractOAuth2TokenAuthenticationToken.class.isAssignableFrom(clientRegistrationAuthentication.getPrincipal().getClass())) {
			accessTokenAuthentication = (AbstractOAuth2TokenAuthenticationToken<?>) clientRegistrationAuthentication.getPrincipal();
		}
		if (accessTokenAuthentication == null || !accessTokenAuthentication.isAuthenticated()) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 91 

              
		// Validate the "initial" access token
		AbstractOAuth2TokenAuthenticationToken<?> accessTokenAuthentication = null;
		if (AbstractOAuth2TokenAuthenticationToken.class.isAssignableFrom(clientRegistrationAuthentication.getPrincipal().getClass())) {
			accessTokenAuthentication = (AbstractOAuth2TokenAuthenticationToken<?>) clientRegistrationAuthentication.getPrincipal();
		}
		if (accessTokenAuthentication == null || !accessTokenAuthentication.isAuthenticated()) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 94 

              		if (AbstractOAuth2TokenAuthenticationToken.class.isAssignableFrom(clientRegistrationAuthentication.getPrincipal().getClass())) {
			accessTokenAuthentication = (AbstractOAuth2TokenAuthenticationToken<?>) clientRegistrationAuthentication.getPrincipal();
		}
		if (accessTokenAuthentication == null || !accessTokenAuthentication.isAuthenticated()) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

		String accessTokenValue = accessTokenAuthentication.getToken().getTokenValue();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 98 

              			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

		String accessTokenValue = accessTokenAuthentication.getToken().getTokenValue();

		OAuth2Authorization authorization = this.authorizationService.findByToken(
				accessTokenValue, OAuth2TokenType.ACCESS_TOKEN);
		if (authorization == null) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 98 

              			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

		String accessTokenValue = accessTokenAuthentication.getToken().getTokenValue();

		OAuth2Authorization authorization = this.authorizationService.findByToken(
				accessTokenValue, OAuth2TokenType.ACCESS_TOKEN);
		if (authorization == null) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 106 

              			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

		OAuth2Authorization.Token<OAuth2AccessToken> authorizedAccessToken = authorization.getAccessToken();
		if (!authorizedAccessToken.isActive()) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
		}

		if (!isAuthorized(authorizedAccessToken)) {

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/client/InMemoryRegisteredClientRepositoryTests.java
47 issues
This class has too many methods, consider refactoring it.
Design

Line: 37 

               * @author Ovidiu Popa
 * @author Joe Grandja
 */
public class InMemoryRegisteredClientRepositoryTests {
	private RegisteredClient registration = TestRegisteredClients.registeredClient().build();

	private InMemoryRegisteredClientRepository clients = new InMemoryRegisteredClientRepository(this.registration);

	@Test

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 38 

               * @author Joe Grandja
 */
public class InMemoryRegisteredClientRepositoryTests {
	private RegisteredClient registration = TestRegisteredClients.registeredClient().build();

	private InMemoryRegisteredClientRepository clients = new InMemoryRegisteredClientRepository(this.registration);

	@Test
	public void constructorVarargsRegisteredClientWhenNullThenThrowIllegalArgumentException() {

Reported by PMD.

Private field 'registration' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 38 

               * @author Joe Grandja
 */
public class InMemoryRegisteredClientRepositoryTests {
	private RegisteredClient registration = TestRegisteredClients.registeredClient().build();

	private InMemoryRegisteredClientRepository clients = new InMemoryRegisteredClientRepository(this.registration);

	@Test
	public void constructorVarargsRegisteredClientWhenNullThenThrowIllegalArgumentException() {

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 40 

              public class InMemoryRegisteredClientRepositoryTests {
	private RegisteredClient registration = TestRegisteredClients.registeredClient().build();

	private InMemoryRegisteredClientRepository clients = new InMemoryRegisteredClientRepository(this.registration);

	@Test
	public void constructorVarargsRegisteredClientWhenNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {

Reported by PMD.

Private field 'clients' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 40 

              public class InMemoryRegisteredClientRepositoryTests {
	private RegisteredClient registration = TestRegisteredClients.registeredClient().build();

	private InMemoryRegisteredClientRepository clients = new InMemoryRegisteredClientRepository(this.registration);

	@Test
	public void constructorVarargsRegisteredClientWhenNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 44 

              
	@Test
	public void constructorVarargsRegisteredClientWhenNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {
					RegisteredClient registration = null;
					new InMemoryRegisteredClientRepository(registration);
				})
				.withMessageContaining("registration cannot be null");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 44 

              
	@Test
	public void constructorVarargsRegisteredClientWhenNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {
					RegisteredClient registration = null;
					new InMemoryRegisteredClientRepository(registration);
				})
				.withMessageContaining("registration cannot be null");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 54 

              
	@Test
	public void constructorListRegisteredClientWhenNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {
					List<RegisteredClient> registrations = null;
					new InMemoryRegisteredClientRepository(registrations);
				})
				.withMessageContaining("registrations cannot be empty");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 54 

              
	@Test
	public void constructorListRegisteredClientWhenNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {
					List<RegisteredClient> registrations = null;
					new InMemoryRegisteredClientRepository(registrations);
				})
				.withMessageContaining("registrations cannot be empty");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 64 

              
	@Test
	public void constructorListRegisteredClientWhenEmptyThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> {
					List<RegisteredClient> registrations = Collections.emptyList();
					new InMemoryRegisteredClientRepository(registrations);
				})
				.withMessageContaining("registrations cannot be empty");

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/AbstractOAuth2AuthorizationServerMetadata.java
46 issues
This class has too many methods, consider refactoring it.
Design

Line: 63 

              	/**
	 * A builder for subclasses of {@link AbstractOAuth2AuthorizationServerMetadata}.
	 */
	protected static abstract class AbstractBuilder<T extends AbstractOAuth2AuthorizationServerMetadata, B extends AbstractBuilder<T, B>> {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		protected AbstractBuilder() {
		}

Reported by PMD.

The class 'AbstractBuilder' has a Standard Cyclomatic Complexity of 1 (Highest = 10).
Design

Line: 63 

              	/**
	 * A builder for subclasses of {@link AbstractOAuth2AuthorizationServerMetadata}.
	 */
	protected static abstract class AbstractBuilder<T extends AbstractOAuth2AuthorizationServerMetadata, B extends AbstractBuilder<T, B>> {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		protected AbstractBuilder() {
		}

Reported by PMD.

The class 'AbstractBuilder' has a Modified Cyclomatic Complexity of 1 (Highest = 10).
Design

Line: 63 

              	/**
	 * A builder for subclasses of {@link AbstractOAuth2AuthorizationServerMetadata}.
	 */
	protected static abstract class AbstractBuilder<T extends AbstractOAuth2AuthorizationServerMetadata, B extends AbstractBuilder<T, B>> {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		protected AbstractBuilder() {
		}

Reported by PMD.

Field claims has the same name as a method
Error

Line: 64 

              	 * A builder for subclasses of {@link AbstractOAuth2AuthorizationServerMetadata}.
	 */
	protected static abstract class AbstractBuilder<T extends AbstractOAuth2AuthorizationServerMetadata, B extends AbstractBuilder<T, B>> {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		protected AbstractBuilder() {
		}

		protected Map<String, Object> getClaims() {

Reported by PMD.

The method 'validate' has a Modified Cyclomatic Complexity of 10.
Design

Line: 332 

              		 */
		public abstract T build();

		protected void validate() {
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint cannot be null");

Reported by PMD.

The method 'validate' has a Standard Cyclomatic Complexity of 10.
Design

Line: 332 

              		 */
		public abstract T build();

		protected void validate() {
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint cannot be null");

Reported by PMD.

The method 'validate()' has a cyclomatic complexity of 10.
Design

Line: 332 

              		 */
		public abstract T build();

		protected void validate() {
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint cannot be null");

Reported by PMD.

The method 'validate()' has an NPath complexity of 512, current threshold is 200
Design

Line: 332 

              		 */
		public abstract T build();

		protected void validate() {
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint cannot be null");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 333 

              		public abstract T build();

		protected void validate() {
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint must be a valid URL");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 334 

              
		protected void validate() {
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.ISSUER), "issuer must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT), "authorizationEndpoint must be a valid URL");
			Assert.notNull(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint cannot be null");
			validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT), "tokenEndpoint must be a valid URL");
			if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED) != null) {

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java
45 issues
The class 'RegisteredClient' is suspected to be a Data Class (WOC=29.412%, NOPA=0, NOAM=12, WMC=21)
Design

Line: 46 

               * @see <a target="_blank" href="https://tools.ietf.org/html/rfc6749#section-2">Section 2 Client Registration</a>
 * @since 0.0.1
 */
public class RegisteredClient implements Serializable {
	private static final long serialVersionUID = Version.SERIAL_VERSION_UID;
	private String id;
	private String clientId;
	private Instant clientIdIssuedAt;
	private String clientSecret;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 48 

               */
public class RegisteredClient implements Serializable {
	private static final long serialVersionUID = Version.SERIAL_VERSION_UID;
	private String id;
	private String clientId;
	private Instant clientIdIssuedAt;
	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 49 

              public class RegisteredClient implements Serializable {
	private static final long serialVersionUID = Version.SERIAL_VERSION_UID;
	private String id;
	private String clientId;
	private Instant clientIdIssuedAt;
	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 50 

              	private static final long serialVersionUID = Version.SERIAL_VERSION_UID;
	private String id;
	private String clientId;
	private Instant clientIdIssuedAt;
	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 51 

              	private String id;
	private String clientId;
	private Instant clientIdIssuedAt;
	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;
	private Set<String> redirectUris;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 52 

              	private String clientId;
	private Instant clientIdIssuedAt;
	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;
	private Set<String> redirectUris;
	private Set<String> scopes;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 53 

              	private Instant clientIdIssuedAt;
	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;
	private Set<String> redirectUris;
	private Set<String> scopes;
	private ClientSettings clientSettings;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 54 

              	private String clientSecret;
	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;
	private Set<String> redirectUris;
	private Set<String> scopes;
	private ClientSettings clientSettings;
	private TokenSettings tokenSettings;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 55 

              	private Instant clientSecretExpiresAt;
	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;
	private Set<String> redirectUris;
	private Set<String> scopes;
	private ClientSettings clientSettings;
	private TokenSettings tokenSettings;

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 56 

              	private String clientName;
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;
	private Set<AuthorizationGrantType> authorizationGrantTypes;
	private Set<String> redirectUris;
	private Set<String> scopes;
	private ClientSettings clientSettings;
	private TokenSettings tokenSettings;

	protected RegisteredClient() {

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/JwtEncodingContextTests.java
44 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 48 

              
	@Test
	public void withWhenHeadersNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> JwtEncodingContext.with(null, TestJwtClaimsSets.jwtClaimsSet()))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("headersBuilder cannot be null");
	}

	@Test

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 48 

              
	@Test
	public void withWhenHeadersNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> JwtEncodingContext.with(null, TestJwtClaimsSets.jwtClaimsSet()))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("headersBuilder cannot be null");
	}

	@Test

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 55 

              
	@Test
	public void withWhenClaimsNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> JwtEncodingContext.with(TestJoseHeaders.joseHeader(), null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("claimsBuilder cannot be null");
	}

	@Test

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 55 

              
	@Test
	public void withWhenClaimsNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> JwtEncodingContext.with(TestJoseHeaders.joseHeader(), null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("claimsBuilder cannot be null");
	}

	@Test

Reported by PMD.

Unit tests should not contain more than 1 assert(s).
Design

Line: 61 

              	}

	@Test
	public void setWhenValueNullThenThrowIllegalArgumentException() {
		JwtEncodingContext.Builder builder = JwtEncodingContext
				.with(TestJoseHeaders.joseHeader(), TestJwtClaimsSets.jwtClaimsSet());
		assertThatThrownBy(() -> builder.registeredClient(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.principal(null))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 64 

              	public void setWhenValueNullThenThrowIllegalArgumentException() {
		JwtEncodingContext.Builder builder = JwtEncodingContext
				.with(TestJoseHeaders.joseHeader(), TestJwtClaimsSets.jwtClaimsSet());
		assertThatThrownBy(() -> builder.registeredClient(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.principal(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorization(null))
				.isInstanceOf(IllegalArgumentException.class);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 66 

              				.with(TestJoseHeaders.joseHeader(), TestJwtClaimsSets.jwtClaimsSet());
		assertThatThrownBy(() -> builder.registeredClient(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.principal(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorization(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.tokenType(null))
				.isInstanceOf(IllegalArgumentException.class);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 68 

              				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.principal(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorization(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.tokenType(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorizationGrantType(null))
				.isInstanceOf(IllegalArgumentException.class);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 70 

              				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorization(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.tokenType(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorizationGrantType(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorizationGrant(null))
				.isInstanceOf(IllegalArgumentException.class);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 72 

              				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.tokenType(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorizationGrantType(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.authorizationGrant(null))
				.isInstanceOf(IllegalArgumentException.class);
		assertThatThrownBy(() -> builder.put(null, ""))
				.isInstanceOf(IllegalArgumentException.class);

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/JdbcRegisteredClientRepository.java
43 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 144 

              
	private void insertRegisteredClient(RegisteredClient registeredClient) {
		List<SqlParameterValue> parameters = this.registeredClientParametersMapper.apply(registeredClient);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(INSERT_REGISTERED_CLIENT_SQL, pss);
	}

	@Override
	public RegisteredClient findById(String id) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 163 

              	private RegisteredClient findBy(String filter, Object... args) {
		List<RegisteredClient> result = this.jdbcOperations.query(
				LOAD_REGISTERED_CLIENT_SQL + filter, this.registeredClientRowMapper, args);
		return !result.isEmpty() ? result.get(0) : null;
	}

	/**
	 * Sets the {@link RowMapper} used for mapping the current row in {@code java.sql.ResultSet} to {@link RegisteredClient}.
	 * The default is {@link RegisteredClientRowMapper}.

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 163 

              	private RegisteredClient findBy(String filter, Object... args) {
		List<RegisteredClient> result = this.jdbcOperations.query(
				LOAD_REGISTERED_CLIENT_SQL + filter, this.registeredClientRowMapper, args);
		return !result.isEmpty() ? result.get(0) : null;
	}

	/**
	 * Sets the {@link RowMapper} used for mapping the current row in {@code java.sql.ResultSet} to {@link RegisteredClient}.
	 * The default is {@link RegisteredClientRowMapper}.

Reported by PMD.

In J2EE, getClassLoader() might not work as expected. Use Thread.currentThread().getContextClassLoader() instead.
Error

Line: 208 

              		private ObjectMapper objectMapper = new ObjectMapper();

		public RegisteredClientRowMapper() {
			ClassLoader classLoader = JdbcRegisteredClientRepository.class.getClassLoader();
			List<Module> securityModules = SecurityJackson2Modules.getModules(classLoader);
			this.objectMapper.registerModules(securityModules);
			this.objectMapper.registerModule(new OAuth2AuthorizationServerJackson2Module());
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 224 

              			Set<String> clientScopes = StringUtils.commaDelimitedListToSet(rs.getString("scopes"));

			// @formatter:off
			RegisteredClient.Builder builder = RegisteredClient.withId(rs.getString("id"))
					.clientId(rs.getString("client_id"))
					.clientIdIssuedAt(clientIdIssuedAt != null ? clientIdIssuedAt.toInstant() : null)
					.clientSecret(rs.getString("client_secret"))
					.clientSecretExpiresAt(clientSecretExpiresAt != null ? clientSecretExpiresAt.toInstant() : null)
					.clientName(rs.getString("client_name"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 224 

              			Set<String> clientScopes = StringUtils.commaDelimitedListToSet(rs.getString("scopes"));

			// @formatter:off
			RegisteredClient.Builder builder = RegisteredClient.withId(rs.getString("id"))
					.clientId(rs.getString("client_id"))
					.clientIdIssuedAt(clientIdIssuedAt != null ? clientIdIssuedAt.toInstant() : null)
					.clientSecret(rs.getString("client_secret"))
					.clientSecretExpiresAt(clientSecretExpiresAt != null ? clientSecretExpiresAt.toInstant() : null)
					.clientName(rs.getString("client_name"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 224 

              			Set<String> clientScopes = StringUtils.commaDelimitedListToSet(rs.getString("scopes"));

			// @formatter:off
			RegisteredClient.Builder builder = RegisteredClient.withId(rs.getString("id"))
					.clientId(rs.getString("client_id"))
					.clientIdIssuedAt(clientIdIssuedAt != null ? clientIdIssuedAt.toInstant() : null)
					.clientSecret(rs.getString("client_secret"))
					.clientSecretExpiresAt(clientSecretExpiresAt != null ? clientSecretExpiresAt.toInstant() : null)
					.clientName(rs.getString("client_name"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 224 

              			Set<String> clientScopes = StringUtils.commaDelimitedListToSet(rs.getString("scopes"));

			// @formatter:off
			RegisteredClient.Builder builder = RegisteredClient.withId(rs.getString("id"))
					.clientId(rs.getString("client_id"))
					.clientIdIssuedAt(clientIdIssuedAt != null ? clientIdIssuedAt.toInstant() : null)
					.clientSecret(rs.getString("client_secret"))
					.clientSecretExpiresAt(clientSecretExpiresAt != null ? clientSecretExpiresAt.toInstant() : null)
					.clientName(rs.getString("client_name"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 224 

              			Set<String> clientScopes = StringUtils.commaDelimitedListToSet(rs.getString("scopes"));

			// @formatter:off
			RegisteredClient.Builder builder = RegisteredClient.withId(rs.getString("id"))
					.clientId(rs.getString("client_id"))
					.clientIdIssuedAt(clientIdIssuedAt != null ? clientIdIssuedAt.toInstant() : null)
					.clientSecret(rs.getString("client_secret"))
					.clientSecretExpiresAt(clientSecretExpiresAt != null ? clientSecretExpiresAt.toInstant() : null)
					.clientName(rs.getString("client_name"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 224 

              			Set<String> clientScopes = StringUtils.commaDelimitedListToSet(rs.getString("scopes"));

			// @formatter:off
			RegisteredClient.Builder builder = RegisteredClient.withId(rs.getString("id"))
					.clientId(rs.getString("client_id"))
					.clientIdIssuedAt(clientIdIssuedAt != null ? clientIdIssuedAt.toInstant() : null)
					.clientSecret(rs.getString("client_secret"))
					.clientSecretExpiresAt(clientSecretExpiresAt != null ? clientSecretExpiresAt.toInstant() : null)
					.clientName(rs.getString("client_name"))

Reported by PMD.