Add Biscuit token support

[sdelamo]

Summary

• Adds optional micronaut-security-biscuit module for validating Biscuit bearer tokens through the existing token authentication pipeline.
• Requires trusted root-key verification, canonical Ed25519 signature preflight, revocation checks, configured/custom authorizer evaluation, bounded run limits, and successful authentication mapping before emitting Authentication.
• Documents dependency, configuration, request facts, customization SPIs, revocation, run limits, and security notes.
• Adds an osv-scanner.toml exception for the approved net.i2p.crypto:eddsa:0.3.0 Biscuit Java transitive risk, expiring on 2026-08-22 and tied to the canonical-signature preflight regression.

Targeting

• Target branch: 5.1.x
• Release target: 5.1.0
• Micronaut organization project selected upstream: 5.1.0 Release (Throw an error if multiple annotations are used. #147)
• Issue type: type: enhancement

Project And Reviewer Routing

• Project link gap: adding this PR to 5.1.0 Release (Throw an error if multiple annotations are used. #147) was attempted, but GitHub GraphQL rejected addProjectV2ItemById because the token lacks the required project scope; current PR project items are empty.
• Reviewer request: GitHub rejected requesting sdelamo because sdelamo is also the pull request author.

PR Assets

No external PR-visible assets are required. The changed user-facing output is the guide page, and publishGuide rendered it successfully.

Verification

• ./gradlew :micronaut-security-biscuit:test --tests io.micronaut.security.token.biscuit.BiscuitTokenValidatorTest --rerun-tasks (16/16)
• ./gradlew :micronaut-security-biscuit:check
• ./gradlew --no-build-cache publishGuide
• ./gradlew :micronaut-security-biscuit:dependencies --configuration api
• ./gradlew :micronaut-security-biscuit:dependencyInsight --configuration runtimeClasspath --dependency net.i2p.crypto:eddsa
• .github/scripts/vulnerability-audit.sh
• git diff --check

Closes #930

---

✨ This message was AI-generated using gpt-5

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds an optional Micronaut Security module (micronaut-security-biscuit) to validate Biscuit bearer tokens through the existing token authentication pipeline, including documentation and tests.

Changes:

• Introduces security-biscuit module with validator, configuration properties, SPIs, and default implementations (root key lookup, revocation, auth mapping).
• Adds canonical Ed25519 signature preflight + authorization/run-limits + revocation gating before emitting Authentication.
• Updates guide TOC and adds a new Biscuit strategy guide page; adds dependency coordinates to version catalog.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/main/docs/guide/toc.yml	Adds Biscuit entry to the authentication strategies documentation TOC.
src/main/docs/guide/authenticationStrategies/biscuit.adoc	New guide page describing setup, policies, customization, and security notes.
settings.gradle	Includes the new security-biscuit Gradle subproject.
security-biscuit/src/test/java/io/micronaut/security/token/biscuit/BiscuitTokenValidatorTest.java	Adds end-to-end and unit-style tests for validator behavior and integration with bearer pipeline.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/package-info.java	Defines package-level requirements and nullness defaults for the new module.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/DefaultBiscuitRootKeyLocator.java	Default root public key resolution from configuration (optionally keyed by key id).
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/DefaultBiscuitAuthenticationFactory.java	Default mapping from authorized Biscuit facts to Micronaut Authentication.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/ConfigurationBiscuitRevocationChecker.java	Revocation checker backed by configured revoked identifiers.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitTokenValidator.java	Core token validator: deserialization, canonical signature preflight, revocation checks, authorizer setup, authorization + mapping.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitTermMapper.java	Converts Biscuit term types into Java values for mapping.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitSignatureValidator.java	Implements canonical-signature preflight checks before Biscuit-Java verification.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitRootKeyLocator.java	SPI interface for locating root public keys (supports key id).
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitRevocationChecker.java	SPI interface for revocation checks.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitConfigurationProperties.java	Configuration properties for Biscuit validation, run limits, auth mapping, revocation ids.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitConfiguration.java	Configuration interface used by the module.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitAuthorizerCustomizer.java	SPI interface for request-based authorizer customization.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitAuthenticationFactory.java	SPI interface for mapping authorized Biscuit to Authentication.
security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitAuthenticationContext.java	Context object passed to authentication factory.
security-biscuit/build.gradle.kts	Defines dependencies and test configuration for the new module.
gradle/libs.versions.toml	Adds managed Biscuit dependency coordinate/version to the version catalog.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud