test: rewrite JwksCacheSpec JWKS cache fixture

[sdelamo]

Closes #2172

Summary

• Rewrites JwksCacheSpec provider fixtures to generate JWTs directly from mutable RSA/JWKS configuration.
• Removes the flaky /login, /refresh, test authentication provider, and @Refreshable token-generator path.
• Preserves the JWKS fetch, cache reuse, same-kid replacement, kid rotation, no-kid token, and invalid-token cache-expiry assertions through the protected /hello endpoint.

Review Notes

• Target branch: 5.1.x
• Release target: 5.1.0 Release
• Type label: type: bug
• Selected Micronaut organization project: 5.1.0 Release
• Live project link status: not applied by this run because gh returned INSUFFICIENT_SCOPES for addProjectV2ItemById (project scope required; token has read:project), and the local Paperclip plugin tool route returned Board access required.
• Reviewer request status: attempted to request sdelamo, the linked GitHub issue creator; GitHub rejected it because the reviewer is also the pull request author.
• QA ambiguity note: projectVersion had previously been observed as 5.0.1-SNAPSHOT, but the live default and approved target branch are 5.1.x, so this PR targets the 5.1.0 Release board.

PR Assets

No rendered output or generated artifact changed, so no PR-visible asset upload is required.

Verification

./gradlew :micronaut-security-jwt:cleanTest :micronaut-security-jwt:test --tests 'io.micronaut.security.token.jwt.signature.jwks.JwksCacheSpec.JWK are cached' -Ddevelocity.predictiveTestSelection.enabled=false --no-build-cache

Result: BUILD SUCCESSFUL; 1 selected feature passed.

git diff --check -- security-jwt/src/test/groovy/io/micronaut/security/token/jwt/signature/jwks/JwksCacheSpec.groovy

Result: no whitespace errors.

rg '@Refreshable|/login|/refresh|MockAuthenticationProvider|SuccessAuthenticationScenario|Replaces\(TokenGenerator|BearerAccessRefreshToken|password' security-jwt/src/test/groovy/io/micronaut/security/token/jwt/signature/jwks/JwksCacheSpec.groovy

Result: no matches.

---

✨ This message was AI-generated using gpt-5

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Refactors JwksCacheSpec to remove flaky auth flows and instead generate JWTs directly from mutable RSA/JWKS test configuration, while preserving the JWKS caching/rotation assertions via the protected /hello endpoint.

Changes:

• Removed /login, /refresh, mock auth providers, and @Refreshable token-generator replacement path.
• Added direct access-token generation using JwtTokenGenerator + mutable RSASignatureGeneratorConfiguration.
• Updated signature configuration fixtures to eagerly (re)generate RSA keys/JWKS on demand (refreshKey, rotateKid, clearKid).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sdelamo]

Submitting the pending follow-up reply so the resolved thread has visible context.

---

✨ This message was AI-generated using gpt-5