Add Macaroon token support

[sdelamo]

Summary

• Add optional micronaut-security-macaroons module backed by jmacaroons without exposing jmacaroons types in public Micronaut APIs.
• Add Macaroon token generation/validation through existing TokenGenerator and TokenValidator<HttpRequest<?>> contracts, with explicit root-secret activation and fail-closed first-party caveat handling.
• Document dependency, configuration, bearer-token usage, custom caveat verification, and security limits.

Verification

• ./gradlew :micronaut-security-macaroons:check
• ./gradlew :micronaut-security:test --tests 'io.micronaut.security.token.TokenAuthenticationFetcherSpec' docs
• git diff --check -- settings.gradle gradle/libs.versions.toml security-macaroons src/main/docs/guide/authenticationStrategies/macaroons.adoc src/main/docs/guide/toc.yml

PR Assets

No external rendered assets are required for this change.

Fixes #819

---

✨ This message was AI-generated using gpt-5.3-codex

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds an optional Micronaut Security module that supports Macaroon bearer tokens (generation + validation) using jmacaroons, along with documentation and build integration.

Changes:

• Introduces security-macaroons Gradle submodule with generator/validator implementations and supporting APIs.
• Adds configuration properties, encoding/decoding of claims as first-party caveats, and default authentication/claims factories.
• Documents setup, configuration, usage patterns, and caveat verification.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/main/docs/guide/toc.yml	Adds “Macaroons” entry to authentication strategies TOC
src/main/docs/guide/authenticationStrategies/macaroons.adoc	New guide page describing module usage and security notes
settings.gradle	Registers the new security-macaroons subproject
gradle/libs.versions.toml	Adds managed jmacaroons dependency version/catalog entry
security-macaroons/build.gradle.kts	New submodule build config and dependencies
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/package-info.java	Declares package docs and @NullMarked default
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonTokenValidator.java	Implements TokenValidator<HttpRequest<?>> for Macaroons
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonTokenGenerator.java	Implements TokenGenerator for Macaroon tokens
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonSerializers.java	Maps Micronaut enum to jmacaroons serializers
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonSerialization.java	Introduces supported serialization enum
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonConfigurationProperties.java	Adds config properties for macaroons (secret, formats, caveats, toggles)
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonConfiguration.java	Defines configuration interface contract
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonClaimsCodec.java	Encodes/decodes claims into first-party caveat strings
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonCaveatVerifier.java	Public SPI for custom caveat verification
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonCaveat.java	Public value type representing a first-party caveat
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonAuthenticationFactory.java	Public SPI to build Authentication from verified context
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/MacaroonAuthenticationContext.java	Public context object passed to authentication factory
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/DefaultMacaroonClaimsGenerator.java	Adds a default ClaimsGenerator implementation for macaroons
security-macaroons/src/main/java/io/micronaut/security/token/macaroons/DefaultMacaroonAuthenticationFactory.java	Default implementation of MacaroonAuthenticationFactory
security-macaroons/src/test/java/io/micronaut/security/token/macaroons/MacaroonTokenValidatorTest.java	Adds unit/integration tests for generator/validator behavior

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud