The following issues were found

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java
27 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 56

              	 */
	private static final String DEFAULT_OIDC_PROVIDER_CONFIGURATION_ENDPOINT_URI = "/.well-known/openid-configuration";

	private final ProviderSettings providerSettings;
	private final RequestMatcher requestMatcher;
	private final OidcProviderConfigurationHttpMessageConverter providerConfigurationHttpMessageConverter =
			new OidcProviderConfigurationHttpMessageConverter();

	public OidcProviderConfigurationEndpointFilter(ProviderSettings providerSettings) {

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 57

              	private static final String DEFAULT_OIDC_PROVIDER_CONFIGURATION_ENDPOINT_URI = "/.well-known/openid-configuration";

	private final ProviderSettings providerSettings;
	private final RequestMatcher requestMatcher;
	private final OidcProviderConfigurationHttpMessageConverter providerConfigurationHttpMessageConverter =
			new OidcProviderConfigurationHttpMessageConverter();

	public OidcProviderConfigurationEndpointFilter(ProviderSettings providerSettings) {
		Assert.notNull(providerSettings, "providerSettings cannot be null");

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 58

              
	private final ProviderSettings providerSettings;
	private final RequestMatcher requestMatcher;
	private final OidcProviderConfigurationHttpMessageConverter providerConfigurationHttpMessageConverter =
			new OidcProviderConfigurationHttpMessageConverter();

	public OidcProviderConfigurationEndpointFilter(ProviderSettings providerSettings) {
		Assert.notNull(providerSettings, "providerSettings cannot be null");
		this.providerSettings = providerSettings;

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 79

              			return;
		}

		OidcProviderConfiguration providerConfiguration = OidcProviderConfiguration.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
				.tokenEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue())

            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationTokenTests.java
27 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 38

               * @author Daniel Garnier-Moiroux
 */
public class OAuth2AuthorizationCodeAuthenticationTokenTests {
	private String code = "code";
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

            

Reported by PMD.

Private field 'code' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 38

               * @author Daniel Garnier-Moiroux
 */
public class OAuth2AuthorizationCodeAuthenticationTokenTests {
	private String code = "code";
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 39

               */
public class OAuth2AuthorizationCodeAuthenticationTokenTests {
	private String code = "code";
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");


            

Reported by PMD.

Private field 'registeredClient' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 39

               */
public class OAuth2AuthorizationCodeAuthenticationTokenTests {
	private String code = "code";
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 40

              public class OAuth2AuthorizationCodeAuthenticationTokenTests {
	private String code = "code";
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test

            

Reported by PMD.

Private field 'clientPrincipal' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 40

              public class OAuth2AuthorizationCodeAuthenticationTokenTests {
	private String code = "code";
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 42

              	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenCodeNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2AuthorizationCodeAuthenticationToken(null, this.clientPrincipal, this.redirectUri, null))

            

Reported by PMD.

Private field 'redirectUri' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 42

              	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenCodeNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2AuthorizationCodeAuthenticationToken(null, this.clientPrincipal, this.redirectUri, null))

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 43

              	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenCodeNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2AuthorizationCodeAuthenticationToken(null, this.clientPrincipal, this.redirectUri, null))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

Private field 'additionalParameters' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 43

              	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private String redirectUri = "redirectUri";
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenCodeNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2AuthorizationCodeAuthenticationToken(null, this.clientPrincipal, this.redirectUri, null))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AccessTokenAuthenticationTokenTests.java
26 issues
Private field 'registeredClient' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 40

               * @author Joe Grandja
 */
public class OAuth2AccessTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 40

               * @author Joe Grandja
 */
public class OAuth2AccessTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 41

               */
public class OAuth2AccessTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));

            

Reported by PMD.

Private field 'clientPrincipal' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 41

               */
public class OAuth2AccessTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));

            

Reported by PMD.

Private field 'accessToken' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 43

              	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));
	private Map<String, Object> additionalParameters = Collections.singletonMap("custom-param", "custom-value");


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 43

              	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));
	private Map<String, Object> additionalParameters = Collections.singletonMap("custom-param", "custom-value");


            

Reported by PMD.

Private field 'refreshToken' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 45

              			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));
	private Map<String, Object> additionalParameters = Collections.singletonMap("custom-param", "custom-value");

	@Test
	public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() {

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 45

              			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));
	private Map<String, Object> additionalParameters = Collections.singletonMap("custom-param", "custom-value");

	@Test
	public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() {

            

Reported by PMD.

Private field 'additionalParameters' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 47

              			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));
	private Map<String, Object> additionalParameters = Collections.singletonMap("custom-param", "custom-value");

	@Test
	public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2AccessTokenAuthenticationToken(null, this.clientPrincipal, this.accessToken))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 47

              			"access-token", Instant.now(), Instant.now().plusSeconds(300));
	private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken(
			"refresh-token", Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS));
	private Map<String, Object> additionalParameters = Collections.singletonMap("custom-param", "custom-value");

	@Test
	public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2AccessTokenAuthenticationToken(null, this.clientPrincipal, this.accessToken))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationTokenTests.java
25 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 37

              
	@Test
	public void constructorWhenClientIdNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("clientId cannot be empty");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 37

              
	@Test
	public void constructorWhenClientIdNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("clientId cannot be empty");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 44

              
	@Test
	public void constructorWhenClientAuthenticationMethodNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken("clientId", null, "clientSecret", null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("clientAuthenticationMethod cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 44

              
	@Test
	public void constructorWhenClientAuthenticationMethodNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken("clientId", null, "clientSecret", null))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("clientAuthenticationMethod cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 51

              
	@Test
	public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "clientSecret"))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("registeredClient cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 51

              
	@Test
	public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "clientSecret"))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("registeredClient cannot be null");
	}

	@Test

            

Reported by PMD.

Unit tests should not contain more than 1 assert(s).
Design

Line: 57

              	}

	@Test
	public void constructorWhenClientCredentialsProvidedThenCreated() {
		OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId",
				ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null);
		assertThat(authentication.isAuthenticated()).isFalse();
		assertThat(authentication.getPrincipal().toString()).isEqualTo("clientId");
		assertThat(authentication.getCredentials()).isEqualTo("secret");

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60

              	public void constructorWhenClientCredentialsProvidedThenCreated() {
		OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId",
				ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null);
		assertThat(authentication.isAuthenticated()).isFalse();
		assertThat(authentication.getPrincipal().toString()).isEqualTo("clientId");
		assertThat(authentication.getCredentials()).isEqualTo("secret");
		assertThat(authentication.getRegisteredClient()).isNull();
		assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
	}

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 61

              		OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId",
				ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null);
		assertThat(authentication.isAuthenticated()).isFalse();
		assertThat(authentication.getPrincipal().toString()).isEqualTo("clientId");
		assertThat(authentication.getCredentials()).isEqualTo("secret");
		assertThat(authentication.getRegisteredClient()).isNull();
		assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
	}


            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 61

              		OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId",
				ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null);
		assertThat(authentication.isAuthenticated()).isFalse();
		assertThat(authentication.getPrincipal().toString()).isEqualTo("clientId");
		assertThat(authentication.getCredentials()).isEqualTo("secret");
		assertThat(authentication.getRegisteredClient()).isNull();
		assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
	}


            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationConsentServiceTests.java
25 issues
This class has too many methods, consider refactoring it.
Design

Line: 33

               *
 * @author Daniel Garnier-Moiroux
 */
public class InMemoryOAuth2AuthorizationConsentServiceTests {
	private static final String REGISTERED_CLIENT_ID = "registered-client-id";
	private static final String PRINCIPAL_NAME = "principal-name";
	private static final OAuth2AuthorizationConsent AUTHORIZATION_CONSENT =
			OAuth2AuthorizationConsent.withId(REGISTERED_CLIENT_ID, PRINCIPAL_NAME)
					.authority(new SimpleGrantedAuthority("some.authority"))

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 41

              					.authority(new SimpleGrantedAuthority("some.authority"))
					.build();

	private InMemoryOAuth2AuthorizationConsentService authorizationConsentService;

	@Before
	public void setUp() {
		this.authorizationConsentService = new InMemoryOAuth2AuthorizationConsentService();
		this.authorizationConsentService.save(AUTHORIZATION_CONSENT);

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 51

              
	@Test
	public void constructorVarargsWhenAuthorizationConsentNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> new InMemoryOAuth2AuthorizationConsentService((OAuth2AuthorizationConsent) null))
				.withMessage("authorizationConsent cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 51

              
	@Test
	public void constructorVarargsWhenAuthorizationConsentNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> new InMemoryOAuth2AuthorizationConsentService((OAuth2AuthorizationConsent) null))
				.withMessage("authorizationConsent cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 58

              
	@Test
	public void constructorListWhenAuthorizationConsentsNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> new InMemoryOAuth2AuthorizationConsentService((List<OAuth2AuthorizationConsent>) null))
				.withMessage("authorizationConsents cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 58

              
	@Test
	public void constructorListWhenAuthorizationConsentsNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> new InMemoryOAuth2AuthorizationConsentService((List<OAuth2AuthorizationConsent>) null))
				.withMessage("authorizationConsents cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65

              
	@Test
	public void constructorWhenDuplicateAuthorizationConsentsThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> new InMemoryOAuth2AuthorizationConsentService(AUTHORIZATION_CONSENT, AUTHORIZATION_CONSENT))
				.withMessage("The authorizationConsent must be unique. Found duplicate, with registered client id: [registered-client-id] and principal name: [principal-name]");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65

              
	@Test
	public void constructorWhenDuplicateAuthorizationConsentsThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> new InMemoryOAuth2AuthorizationConsentService(AUTHORIZATION_CONSENT, AUTHORIZATION_CONSENT))
				.withMessage("The authorizationConsent must be unique. Found duplicate, with registered client id: [registered-client-id] and principal name: [principal-name]");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 72

              
	@Test
	public void saveWhenAuthorizationConsentNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> this.authorizationConsentService.save(null))
				.withMessage("authorizationConsent cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 72

              
	@Test
	public void saveWhenAuthorizationConsentNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> this.authorizationConsentService.save(null))
				.withMessage("authorizationConsent cannot be null");
	}

	@Test

            

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java
25 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 57

              	 */
	private static final String DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI = "/.well-known/oauth-authorization-server";

	private final ProviderSettings providerSettings;
	private final RequestMatcher requestMatcher;
	private final OAuth2AuthorizationServerMetadataHttpMessageConverter authorizationServerMetadataHttpMessageConverter =
			new OAuth2AuthorizationServerMetadataHttpMessageConverter();

	public OAuth2AuthorizationServerMetadataEndpointFilter(ProviderSettings providerSettings) {

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 58

              	private static final String DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI = "/.well-known/oauth-authorization-server";

	private final ProviderSettings providerSettings;
	private final RequestMatcher requestMatcher;
	private final OAuth2AuthorizationServerMetadataHttpMessageConverter authorizationServerMetadataHttpMessageConverter =
			new OAuth2AuthorizationServerMetadataHttpMessageConverter();

	public OAuth2AuthorizationServerMetadataEndpointFilter(ProviderSettings providerSettings) {
		Assert.notNull(providerSettings, "providerSettings cannot be null");

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 59

              
	private final ProviderSettings providerSettings;
	private final RequestMatcher requestMatcher;
	private final OAuth2AuthorizationServerMetadataHttpMessageConverter authorizationServerMetadataHttpMessageConverter =
			new OAuth2AuthorizationServerMetadataHttpMessageConverter();

	public OAuth2AuthorizationServerMetadataEndpointFilter(ProviderSettings providerSettings) {
		Assert.notNull(providerSettings, "providerSettings cannot be null");
		this.providerSettings = providerSettings;

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 80

              			return;
		}

		OAuth2AuthorizationServerMetadata authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
				.issuer(this.providerSettings.getIssuer())
				.authorizationEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getAuthorizationEndpoint()))
				.tokenEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getTokenEndpoint()))
				.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
				.jwkSetUrl(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getJwkSetEndpoint()))

            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/ClientSettingsTests.java
24 issues
Unit tests should not contain more than 1 assert(s).
Design

Line: 30

              public class ClientSettingsTests {

	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 31

              
	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}


            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 32

              	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 32

              	@Test
	public void buildWhenDefaultThenDefaultsAreSet() {
		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 33

              	public void buildWhenDefaultThenDefaultsAreSet() {
		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

	@Test
	public void requireProofKeyWhenTrueThenSet() {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 33

              	public void buildWhenDefaultThenDefaultsAreSet() {
		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

	@Test
	public void requireProofKeyWhenTrueThenSet() {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 34

              		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

	@Test
	public void requireProofKeyWhenTrueThenSet() {
		ClientSettings clientSettings = ClientSettings.builder()

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 34

              		ClientSettings clientSettings = ClientSettings.builder().build();
		assertThat(clientSettings.getSettings()).hasSize(2);
		assertThat(clientSettings.isRequireProofKey()).isFalse();
		assertThat(clientSettings.isRequireAuthorizationConsent()).isFalse();
	}

	@Test
	public void requireProofKeyWhenTrueThenSet() {
		ClientSettings clientSettings = ClientSettings.builder()

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 39

              
	@Test
	public void requireProofKeyWhenTrueThenSet() {
		ClientSettings clientSettings = ClientSettings.builder()
				.requireProofKey(true)
				.build();
		assertThat(clientSettings.isRequireProofKey()).isTrue();
	}


            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 39

              
	@Test
	public void requireProofKeyWhenTrueThenSet() {
		ClientSettings clientSettings = ClientSettings.builder()
				.requireProofKey(true)
				.build();
		assertThat(clientSettings.isRequireProofKey()).isTrue();
	}


            

Reported by PMD.

samples/boot/oauth2-integration/authorizationserver-custom-consent-page/src/main/java/sample/config/AuthorizationServerConfig.java
24 issues
A method/constructor should not explicitly throw java.lang.Exception
Design

Line: 55

              
	@Bean
	@Order(Ordered.HIGHEST_PRECEDENCE)
	public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
		OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
				new OAuth2AuthorizationServerConfigurer<>();
		authorizationServerConfigurer
				.authorizationEndpoint(authorizationEndpoint ->
						authorizationEndpoint.consentPage("/oauth2/consent"));

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65

              		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

		http
			.requestMatcher(endpointsMatcher)
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65

              		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

		http
			.requestMatcher(endpointsMatcher)
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65

              		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

		http
			.requestMatcher(endpointsMatcher)
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 72

              			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
			.apply(authorizationServerConfigurer);
		return http.formLogin(Customizer.withDefaults()).build();
	}

	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 78

              	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("{noop}secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 78

              	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("{noop}secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 78

              	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("{noop}secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 78

              	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("{noop}secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 78

              	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("{noop}secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)

            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/OAuth2AuthorizationConsentTests.java
23 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 34

              
	@Test
	public void fromWhenAuthorizationConsentNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.from(null))
				.withMessage("authorizationConsent cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 34

              
	@Test
	public void fromWhenAuthorizationConsentNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.from(null))
				.withMessage("authorizationConsent cannot be null");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 41

              
	@Test
	public void withIdWhenRegisteredClientIdNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.withId(null, "some-user"))
				.withMessage("registeredClientId cannot be empty");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 41

              
	@Test
	public void withIdWhenRegisteredClientIdNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.withId(null, "some-user"))
				.withMessage("registeredClientId cannot be empty");
	}

	@Test

            

Reported by PMD.

The String literal 'some-user' appears 5 times in this file; the first occurrence is on line 42
Error

Line: 42

              	@Test
	public void withIdWhenRegisteredClientIdNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.withId(null, "some-user"))
				.withMessage("registeredClientId cannot be empty");
	}

	@Test
	public void withIdWhenPrincipalNameNullThenThrowIllegalArgumentException() {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 48

              
	@Test
	public void withIdWhenPrincipalNameNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.withId("some-client", null))
				.withMessage("principalName cannot be empty");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 48

              
	@Test
	public void withIdWhenPrincipalNameNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.withId("some-client", null))
				.withMessage("principalName cannot be empty");
	}

	@Test

            

Reported by PMD.

The String literal 'some-client' appears 7 times in this file; the first occurrence is on line 49
Error

Line: 49

              	@Test
	public void withIdWhenPrincipalNameNullThenThrowIllegalArgumentException() {
		assertThatIllegalArgumentException()
				.isThrownBy(() -> OAuth2AuthorizationConsent.withId("some-client", null))
				.withMessage("principalName cannot be empty");
	}

	@Test
	public void buildWhenAuthoritiesEmptyThenThrowIllegalArgumentException() {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 56

              	@Test
	public void buildWhenAuthoritiesEmptyThenThrowIllegalArgumentException() {
		OAuth2AuthorizationConsent.Builder builder = OAuth2AuthorizationConsent.withId("some-client", "some-user");
		assertThatIllegalArgumentException()
				.isThrownBy(builder::build)
				.withMessage("authorities cannot be empty");
	}

	@Test

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 56

              	@Test
	public void buildWhenAuthoritiesEmptyThenThrowIllegalArgumentException() {
		OAuth2AuthorizationConsent.Builder builder = OAuth2AuthorizationConsent.withId("some-client", "some-user");
		assertThatIllegalArgumentException()
				.isThrownBy(builder::build)
				.withMessage("authorities cannot be empty");
	}

	@Test

            

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationTokenTests.java
23 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 39

               * @since 0.0.3
 */
public class OAuth2RefreshTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");


            

Reported by PMD.

Private field 'registeredClient' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 39

               * @since 0.0.3
 */
public class OAuth2RefreshTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");


            

Reported by PMD.

Private field 'clientPrincipal' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 40

               */
public class OAuth2RefreshTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 40

               */
public class OAuth2RefreshTokenAuthenticationTokenTests {
	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test

            

Reported by PMD.

Private field 'scopes' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 42

              	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenRefreshTokenNullOrEmptyThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken(null, this.clientPrincipal, this.scopes, this.additionalParameters))

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 42

              	private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenRefreshTokenNullOrEmptyThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken(null, this.clientPrincipal, this.scopes, this.additionalParameters))

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 43

              	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenRefreshTokenNullOrEmptyThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken(null, this.clientPrincipal, this.scopes, this.additionalParameters))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

Private field 'additionalParameters' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 43

              	private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
			this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret());
	private Set<String> scopes = Collections.singleton("scope1");
	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenRefreshTokenNullOrEmptyThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken(null, this.clientPrincipal, this.scopes, this.additionalParameters))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

Unit tests should not contain more than 1 assert(s).
Design

Line: 46

              	private Map<String, Object> additionalParameters = Collections.singletonMap("param1", "value1");

	@Test
	public void constructorWhenRefreshTokenNullOrEmptyThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken(null, this.clientPrincipal, this.scopes, this.additionalParameters))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("refreshToken cannot be empty");
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken("", this.clientPrincipal, this.scopes, this.additionalParameters))
				.isInstanceOf(IllegalArgumentException.class)

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 47

              
	@Test
	public void constructorWhenRefreshTokenNullOrEmptyThenThrowIllegalArgumentException() {
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken(null, this.clientPrincipal, this.scopes, this.additionalParameters))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("refreshToken cannot be empty");
		assertThatThrownBy(() -> new OAuth2RefreshTokenAuthenticationToken("", this.clientPrincipal, this.scopes, this.additionalParameters))
				.isInstanceOf(IllegalArgumentException.class)
				.hasMessage("refreshToken cannot be empty");

            

Reported by PMD.