Add Biscuit token support - #2203
Open
sdelamo wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds an optional Micronaut Security module (micronaut-security-biscuit) to validate Biscuit bearer tokens through the existing token authentication pipeline, including documentation and tests.
Changes:
- Introduces
security-biscuitmodule with validator, configuration properties, SPIs, and default implementations (root key lookup, revocation, auth mapping). - Adds canonical Ed25519 signature preflight + authorization/run-limits + revocation gating before emitting
Authentication. - Updates guide TOC and adds a new Biscuit strategy guide page; adds dependency coordinates to version catalog.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| src/main/docs/guide/toc.yml | Adds Biscuit entry to the authentication strategies documentation TOC. |
| src/main/docs/guide/authenticationStrategies/biscuit.adoc | New guide page describing setup, policies, customization, and security notes. |
| settings.gradle | Includes the new security-biscuit Gradle subproject. |
| security-biscuit/src/test/java/io/micronaut/security/token/biscuit/BiscuitTokenValidatorTest.java | Adds end-to-end and unit-style tests for validator behavior and integration with bearer pipeline. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/package-info.java | Defines package-level requirements and nullness defaults for the new module. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/DefaultBiscuitRootKeyLocator.java | Default root public key resolution from configuration (optionally keyed by key id). |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/DefaultBiscuitAuthenticationFactory.java | Default mapping from authorized Biscuit facts to Micronaut Authentication. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/ConfigurationBiscuitRevocationChecker.java | Revocation checker backed by configured revoked identifiers. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitTokenValidator.java | Core token validator: deserialization, canonical signature preflight, revocation checks, authorizer setup, authorization + mapping. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitTermMapper.java | Converts Biscuit term types into Java values for mapping. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitSignatureValidator.java | Implements canonical-signature preflight checks before Biscuit-Java verification. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitRootKeyLocator.java | SPI interface for locating root public keys (supports key id). |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitRevocationChecker.java | SPI interface for revocation checks. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitConfigurationProperties.java | Configuration properties for Biscuit validation, run limits, auth mapping, revocation ids. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitConfiguration.java | Configuration interface used by the module. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitAuthorizerCustomizer.java | SPI interface for request-based authorizer customization. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitAuthenticationFactory.java | SPI interface for mapping authorized Biscuit to Authentication. |
| security-biscuit/src/main/java/io/micronaut/security/token/biscuit/BiscuitAuthenticationContext.java | Context object passed to authentication factory. |
| security-biscuit/build.gradle.kts | Defines dependencies and test configuration for the new module. |
| gradle/libs.versions.toml | Adds managed Biscuit dependency coordinate/version to the version catalog. |
sdelamo
force-pushed
the
paperclip/mng-243-biscuit-support
branch
from
May 22, 2026 12:10
050a6ee to
c6c9b68
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
micronaut-security-biscuitmodule for validating Biscuit bearer tokens through the existing token authentication pipeline.Authentication.osv-scanner.tomlexception for the approvednet.i2p.crypto:eddsa:0.3.0Biscuit Java transitive risk, expiring on 2026-08-22 and tied to the canonical-signature preflight regression.Targeting
5.1.x5.1.05.1.0 Release(Throw an error if multiple annotations are used. #147)type: enhancementProject And Reviewer Routing
5.1.0 Release(Throw an error if multiple annotations are used. #147) was attempted, but GitHub GraphQL rejectedaddProjectV2ItemByIdbecause the token lacks the requiredprojectscope; current PR project items are empty.sdelamobecausesdelamois also the pull request author.PR Assets
No external PR-visible assets are required. The changed user-facing output is the guide page, and
publishGuiderendered it successfully.Verification
./gradlew :micronaut-security-biscuit:test --tests io.micronaut.security.token.biscuit.BiscuitTokenValidatorTest --rerun-tasks(16/16)./gradlew :micronaut-security-biscuit:check./gradlew --no-build-cache publishGuide./gradlew :micronaut-security-biscuit:dependencies --configuration api./gradlew :micronaut-security-biscuit:dependencyInsight --configuration runtimeClasspath --dependency net.i2p.crypto:eddsa.github/scripts/vulnerability-audit.shgit diff --checkCloses #930
✨ This message was AI-generated using gpt-5