DC scope enforcement vocabulary doesn't match AS-issued ESPI FB scopes — customer tokens 403 on all resources #157

Confirmed cross-service scope mismatch (AS issues one vocabulary, DC enforces another)

AS issues (seeded third_party client, AuthorizationServerConfig):

scope = "FB=4_5_15;IntervalDuration=3600;BlockDuration=monthly;HistoryLength=13"

DC uses the stock SpringOpaqueTokenIntrospector (no custom authority mapping), so Spring converts that scope to the authority:

SCOPE_FB=4_5_15;IntervalDuration=3600;BlockDuration=monthly;HistoryLength=13

DC enforces (openespi-datacustodian/.../config/SecurityConfiguration.java):

.requestMatchers(HttpMethod.GET, "/espi/1_1/resource/UsagePoint/**")
    .hasAnyAuthority("SCOPE_FB_15_READ_3rd_party", "SCOPE_FB_16_READ_3rd_party",
                     "SCOPE_FB_36_READ_3rd_party", "SCOPE_DataCustodian_Admin_Access")

The authority a customer token actually carries (SCOPE_FB=4_5_15;...) matches none of these matchers ⇒ every customer-token call to /UsagePoint, /MeterReading, /Subscription/*/UsagePoint, etc. returns 403.

Why it's gone unnoticed

• AS tests don't run end-to-end against DC; DC API tests mock the introspector and stub authorities like SCOPE_FB_15_READ_3rd_party, so they pass while a real token fails. Classic mock drift — the gap Cross-service contract tests for the AS↔DC back-channel (lightweight shared-fixture, no Spring Cloud) #150 (AS↔DC contract test) is meant to close.

Likely intended design

ESPI 4.0 scopes are FB=... function-block strings (the standard vocabulary the AS issues; see the FB-scope parser from PR A / [scope memory]). DC's FB_15_READ_3rd_party is a legacy/ad-hoc naming. The fix is almost certainly a custom DC authority mapping — an OpaqueTokenIntrospector (or Converter<OAuth2AuthenticatedPrincipal, ...>) that parses the ESPI FB scope into the function-block authorities DC enforces — reusing PR A's parser — rather than relying on stock raw SCOPE_<rawscope> mapping. Alternatively, align the two vocabularies.

Scope of fix

• Decide the canonical authority vocabulary (ESPI FB grammar vs. DC's FB_n_READ/WRITE_3rd_party).
• Implement the AS-scope → DC-authority mapping (custom introspector/authority converter).
• Pin it with the Cross-service contract tests for the AS↔DC back-channel (lightweight shared-fixture, no Spring Cloud) #150 contract test so it can't drift again.

Surfaced during DC-plan seam analysis (folds into #150).