In
`@jans-core/service/src/main/java/io/jans/service/security/protect/BaseAuthorizationProtection.java`:
- Around line 12-13: Update the BaseAuthorizationProtection.processAuthorization
contract to explicitly document the expected bearerToken format and null/empty
handling: state whether bearerToken must be the raw access token (no "Bearer "
prefix) or may include the "Bearer " prefix and that implementations must strip
the prefix if present, and specify how null or empty values are treated (e.g.,
return a 401/unauthorized Response or throw a defined exception). Add this
Javadoc to the interface method processAuthorization(String bearerToken,
ResourceInfo resourceInfo) and ensure any implementations of
BaseAuthorizationProtection follow the documented behavior (strip prefix if
allowed, validate null/empty and return the documented Response).

In `@jans-linux-setup/jans_setup/schema/jans_schema.json`:
- Around line 4081-4085: The schema rename removed backward compatibility for
the attribute; restore it by adding the legacy name "severetyLevel" as an alias
(or include it in the "names" array) alongside the new "severityLevel" entry in
jans_schema.json so both names map to the same attribute definition (or,
alternatively, implement and reference an explicit migration step to transform
existing "severetyLevel" data to "severityLevel"); update the attribute
definition that currently lists "severityLevel" to include "severetyLevel" as
well so existing deployments continue to work.

In `@jans-linux-setup/jans_setup/setup_app/data/jetty_app_configuration.json`:
- Line 83: The jetty modules list currently enables cleartext HTTP/2 via
"http2c", exposing gRPC audit traffic; update configuration so http2c is not
enabled by default (remove or conditionally add "http2c" based on a new flag) OR
enable TLS by default in the GrpcConfiguration by setting useTls = true and
populating tlsCertChainFilePath and tlsPrivateKeyFilePath (and any related TLS
options) so BRIDGE-mode gRPC traffic is encrypted; reference the "modules" entry
(remove/guard "http2c") and the GrpcConfiguration fields useTls,
tlsCertChainFilePath to locate where to change settings and ensure documentation
notes the requirement if you choose to keep http2c behind an explicit opt-in.

In `@jans-linux-setup/jans_setup/setup_app/installers/jans_auth.py`:
- Around line 59-61: The jetty modules string in
self.jetty_app_configuration[self.service_name]['jetty']['modules'] is being
mutated with "+= ',http2c'", which can append duplicate "http2c" entries across
repeated install() calls; before appending, check the existing modules (split by
commas and strip whitespace) and only add "http2c" if it's not already present,
then join back into the modules string and proceed to call
self.install_jettyService(...).

In `@jans-linux-setup/jans_setup/templates/apache/https_jans.conf.mako`:
- Around line 166-167: In the apache template block guarded by
context.get('install_jans_lock') (the ProxyPass line in https_jans.conf.mako),
remove the stray trailing single-quote character at the end of the ProxyPass
directive so the URL token ends with /api/v1/configuration rather than
/api/v1/configuration'; update the ProxyPass entry for
/.well-known/lock-server-configuration to use the correct URL token (no trailing
quote) to avoid Apache parse errors.
- Around line 147-151: The current directives use both "Require all granted" and
"Require method GET POST", which are OR'd and make the method restriction
ineffective; either remove the "Require all granted" directive or wrap both in a
"<RequireAll>" container so that access is allowed only for GET and POST. Locate
the block containing "Require all granted" and "Require method GET POST" in
https_jans.conf.mako and apply one of the two fixes: delete the "Require all
granted" line if only method restriction is intended, or replace the two
standalone Require lines with a "<RequireAll>" container enclosing both
requirements to enforce both conditions.

In
`@jans-lock/lock-server/cedarling/src/main/java/io/jans/lock/cedarling/service/CedarlingProtectionService.java`:
- Around line 87-89: In CedarlingProtectionService (the block checking
requestedPermissions), replace the non-idiomatic check
"requestedPermissions.size() == 0" with the idiomatic collection check
"requestedPermissions.isEmpty()" so the conditional reads e.g. if
(requestedPermissions.isEmpty()) { return simpleResponse(INTERNAL_SERVER_ERROR,
"Access to operation is not correct"); } to improve readability and performance.
- Around line 82-83: The code in CedarlingProtectionService currently removes
the "Bearer" prefix using a case-sensitive regex and logs the full bearerToken
(log.debug("Validating token {}", bearerToken)), which risks auth failures and
credential leakage; update the prefix removal to use a case-insensitive pattern
like "(?i)Bearer\\s+" (matching other extractBearerToken implementations) and
remove or replace the debug call so it does not emit the full token (e.g., log
only that a token was received or log a masked/hashed token) while keeping the
variable name bearerToken and the validation flow intact.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/audit/HealthEntry.java`:
- Around line 131-147: The equals() and hashCode() implementations in
HealthEntry currently omit the inum field (which is annotated ignoreDuringUpdate
= true and likely serves as the unique identifier), so add inum to both equality
checks and the hash calculation to ensure entries with different inum are not
considered equal; specifically update HealthEntry.equals to include
Objects.equals(inum, that.inum) in the returned conjunction and update
HealthEntry.hashCode to include inum in the Objects.hash(...) call (or
alternatively, if content-only equality is desired, add a clear Javadoc on
HealthEntry explaining why inum is intentionally excluded).
- Around line 70-73: The engineStatus field in HealthEntry is missing an
explicit Jackson mapping; add the `@JsonProperty`("engineStatus") annotation to
the engineStatus field (which already has `@JsonObject` and `@AttributeName`(name =
"engineStatus")) so its JSON name is explicit and consistent with the other
fields in the HealthEntry class.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/config/BaseDnConfiguration.java`:
- Around line 1-7: Update the copyright year in the file containing class
BaseDnConfiguration from 2024 to the correct year (e.g., 2026) to reflect the PR
creation date; locate the header comment block at the top of the file (the
multi-line comment preceding the class declaration) and change the "(c) 2024,
Janssen Project" text to "(c) 2026, Janssen Project" (or the appropriate year),
keeping the existing license text intact.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/config/Conf.java`:
- Line 1: The file's top-of-file comment opener is invalid ("/*/*") causing a
compilation error; in Conf.java (the Conf class/source), replace the malformed
opener with a standard block comment opener (e.g., "/*") so the comment starts
correctly and no stray tokens remain—ensure the rest of the header comment and
closing "*/" remain intact.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/config/GrpcServerMode.java`:
- Around line 9-37: GrpcServerMode currently only defines `@JsonValue` getMode()
which serializes the enum but does not provide a way for Jackson to deserialize
strings like "bridge" or "plain_server"; add a static factory annotated with
`@JsonCreator` (e.g., public static GrpcServerMode fromString(String mode)) that
maps the incoming string to the correct enum constant (matching the mode field,
case- and null-safe, and throwing or returning a default if unmatched) so
DataMapperService.readValue() can deserialize JSON into GrpcServerMode
correctly.

In `@jans-lock/lock-server/service/pom.xml`:
- Around line 66-85: The protobuf-maven-plugin block hardcodes protoc and grpc
plugin versions (protocArtifact and pluginArtifact); change these to use
BOM-managed properties (e.g. refer to ${protobuf.version} and ${grpc.version} or
the existing BOM property used for protobuf-java) instead of literal "4.33.2"
and "1.78.0" in the protobuf-maven-plugin configuration, and add a
protobuf.version property to the jans-bom (or reuse the protobuf-java property
at line 827) so the plugin picks up the BOM-managed version; keep the pluginId
and execution (id "compile_proto") unchanged.
- Around line 164-172: The POM currently declares the javax.servlet-api
dependency which conflicts with grpc-servlet-jakarta and the project's Jakarta
APIs; remove the <artifactId>javax.servlet-api</artifactId> dependency
declaration and either replace it with the Jakarta servlet artifact
(<artifactId>jakarta.servlet-api</artifactId>) if you need a compile-time
provided stub or simply delete the dependency so the Jakarta EE runtime provides
it, ensuring grpc-servlet-jakarta is used consistently with the jakarta.servlet
namespace.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/filter/AuthorizationProcessingFilter.java`:
- Around line 98-99: The file is missing a blank line between method
definitions; add one empty line after the end of the extractBearerToken() method
so that there is a blank line before the declaration of
unprotectedApiResponse(String name) to match the file's formatting conventions.
- Around line 90-98: The Bearer token extraction logic in
AuthorizationProcessingFilter.extractBearerToken() is duplicated in
CedarlingAuthorizationProcessingFilter; update HeaderUtils.extractBearerToken()
so it performs the same case-insensitive "Bearer\\s+" removal but returns null
when the Authorization header is missing or doesn't start with a Bearer token,
then replace AuthorizationProcessingFilter.extractBearerToken() and the
corresponding method in CedarlingAuthorizationProcessingFilter to call
HeaderUtils.extractBearerToken() instead of duplicating the logic.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/security/GrpcAuthorizationInterceptor.java`:
- Around line 94-123: The code calls extractResourceInfo(methodName) and passes
the possibly null ResourceInfo into
authorizationProtection.processAuthorization, which can cause NPEs or improper
authorization; update the interceptor to check the result of extractResourceInfo
and fail-closed when it's null: if ResourceInfo resourceInfo is null, log a
warning including methodName, perform audit logging as a denied request (use
AuditLogEntry and applicationAuditLogger.log with success=false), map an
appropriate HTTP-to-gRPC status and close the call with call.close(...), then
return an empty ServerCall.Listener; only call processAuthorization and
Contexts.interceptCall when resourceInfo is non-null. Ensure references:
extractResourceInfo, ResourceInfo, processAuthorization, AuditLogEntry,
applicationAuditLogger, mapHttpStatusToGrpcStatus, methodName, call, and next.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/server/GrpcServerStarter.java`:
- Around line 67-103: The startup ignores GrpcConfiguration.useTls; update
startGrpcServer to derive an effective mode (e.g., effectiveMode) using both
grpcConfiguration.getServerMode() and grpcConfiguration.isUseTls() so that
useTls=true forces TLS behavior even if serverMode is BRIDGE/default, then
branch on effectiveMode (GrpcServerMode.TLS_SERVER vs PLAIN_SERVER) when
building the server; refer to startGrpcServer,
GrpcConfiguration.getServerMode(), GrpcConfiguration.isUseTls(), and
GrpcServerMode to locate where to compute the effective mode and apply it to the
Netty vs ServerBuilder logic.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/servlet/GrpcAuditServlet.java`:
- Around line 71-74: The log message in GrpcAuditServlet.initializeGrpc() has a
typo ("initializion"); update the log.info call in the initializeGrpc method to
use the correct spelling (e.g., "gRPC adapter initialization") so the
initialization log is spelled correctly and consistent with other messages.
- Around line 165-177: The current URI normalization in GrpcAuditServlet can
yield an empty or missing-leading-slash requestURI/servletPath when stripping
the contextPath (from request.getRequestURI()), which breaks gRPC method
resolution; after computing this.requestURI (and before setting
this.servletPath) ensure the stripped value is non-empty and starts with a
leading '/' (e.g., if substring yields "" or does not startWith("/"), prefix a
"/"), then set this.servletPath from the normalized this.requestURI (otherwise
fall back to request.getServletPath()); update the logic around
request.getRequestURI(), request.getContextPath(), this.requestURI and
this.servletPath accordingly.
- Around line 153-163: The GrpcRequestWrapper currently uses locale-sensitive
toLowerCase for HTTP header normalization and lookups which can break ASCII
headers (e.g., Turkish locale); update header normalization and lookup calls to
use Locale.ROOT: change headers.put(name.toLowerCase(Locale.ROOT), values) in
the GrpcRequestWrapper constructor and change
headers.get(name.toLowerCase(Locale.ROOT)) wherever header lookups occur (e.g.,
the methods referencing the map at the two noted retrieval sites), and add the
import for java.util.Locale; this ensures locale-insensitive lowercasing for
header names.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/openid/OpenIdProtection.java`:
- Around line 13-16: OpenIdProtection currently redeclares processAuthorization
which is already inherited from BaseAuthorizationProtection; remove the
redundant method declaration (processAuthorization(String bearerToken,
ResourceInfo resourceInfo)) from the OpenIdProtection interface so it simply
extends BaseAuthorizationProtection without re-declaring the inherited method.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/openid/OpenIdProtectionService.java`:
- Line 93: The code in OpenIdProtectionService currently strips the bearer
prefix using a case-sensitive regex ("Bearer\\s+"), causing failure for
lowercase variations; change the replacement to use a case-insensitive pattern
(e.g., use the "(?i)Bearer\\s+" regex) when modifying bearerToken so it matches
"Bearer", "bearer", etc., to be consistent with
AuthorizationProcessingFilter.extractBearerToken().

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/ws/rs/audit/AuditRestWebServiceImpl.java`:
- Around line 366-368: There's a typo in the StatService method name: change
reportOpearation to reportOperation across the codebase; update the StatService
interface declaration, all implementing classes (e.g., classes implementing
StatService), and every call site such as AuditRestWebServiceImpl where
statService.reportOpearation(...) is invoked so they call
statService.reportOperation(...). Ensure method signatures remain the same aside
from the corrected name and run/adjust any package-level imports or references
affected by the rename.
- Around line 411-443: persistBulkAuditData currently iterates and calls
auditService.addLogEntry/addHealthEntry/addTelemetryEntry one-by-one, which is
non-atomic and inefficient; change this by either (A) adding batch methods on
AuditService (e.g. addLogEntries(List<LogEntry>),
addHealthEntries(List<HealthEntry>), addTelemetryEntries(List<TelemetryEntry>))
and have persistBulkAuditData call those batch methods instead of per-entry
calls, or (B) wrap the persistBulkAuditData operation in a transactional
boundary (e.g., annotate persistBulkAuditData or its caller with `@Transactional`)
and ensure AuditService implementations participate in the transaction so all
entries are committed or rolled back together. Ensure corresponding AuditService
interface and implementations are updated to support the chosen approach and
handle errors consistently.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/util/HeaderUtils.java`:
- Around line 62-74: The method in HeaderUtils that extracts bearer tokens
currently checks trimmed.toLowerCase().startsWith("bearer ") and then
redundantly checks trimmed.startsWith("Bearer "), and finally returns the header
as-is for non-bearer schemes; change it so you remove the second redundant
startsWith check (the toLowerCase check already covers case variants) and change
the non-bearer fallback to return null (not the original header) so only bearer
tokens are extracted (keep the existing substring(7).trim() logic when a bearer
prefix is detected).

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/util/ServerUtil.java`:
- Around line 141-170: In getGrpcClientIpAddress(io.grpc.ServerCall<?, ?> call,
Metadata headers) change the lookup order to prefer the socket address from
call.getAttributes() (io.grpc.Grpc.TRANSPORT_ATTR_REMOTE_ADDR) before trusting
client-controllable headers (getIpFromHeaders), and only consult headers when a
trusted-proxy configuration is enabled; also make the socket-address extraction
null-safe by not calling InetSocketAddress.getAddress().getHostAddress()
directly—use InetSocketAddress.getHostString() as a safe fallback or check
getAddress() for null before calling getHostAddress() to avoid NPEs; update any
related logic in GrpcAuthorizationInterceptor that relies on this method to
ensure authorization uses the socket-derived IP unless proxy trust is explicitly
configured.

In `@jans-lock/lock-server/service/src/main/proto/grpc/audit.proto`:
- Around line 79-83: The shared AuditResponse message is too coarse for bulk
RPCs; update the proto definition for AuditResponse (used by RPCs handling
multiple records) to include granular bulk-processing fields such as int32
processed_count, int32 failed_count and repeated AuditFailure failures (define
AuditFailure with index/id and string error_message), and optionally a repeated
string failed_ids or map<string,string> failure_details so callers can
distinguish partial successes and inspect per-item errors while preserving
existing success/message fields.
- Around line 35-38: Replace the open string fields with proto enums: define
enums (e.g., EventType, SeverityLevel, DecisionResult, and EntryStatus) in this
proto and change the message fields event_type, severity_level, decision_result
and the status fields in HealthEntry/TelemetryEntry to use those enum types
instead of string; ensure each enum has explicit numeric values and update any
generated code or usages to refer to the new enum symbols (EventType,
SeverityLevel, DecisionResult, EntryStatus) so callers use the typed enum values
rather than freeform strings.

In `@jans-bom/pom.xml`:
- Around line 27-30: The pom declares <grpc.version>1.78.0</grpc.version> while
resteasy-grpc-bom:1.0.0.Final manages protoc-gen-grpc-java at 1.73.0; to fix,
run a full build and runtime smoke tests to validate gRPC 1.78.0 with
resteasy-grpc-bom 1.0.0.Final, and if you observe classpath or plugin
incompatibilities, either align versions by setting the protoc-gen-grpc-java
plugin version to 1.78.0 (override the plugin managed by resteasy-grpc-bom) or
downgrade grpc.version to 1.73.0 so they match; locate these properties in the
pom (grpc.version, grpc-bridge.version, and the resteasy-grpc-bom import) and
update or add the plugin override accordingly, then re-run CI and integration
tests to confirm no conflicts.

In `@jans-lock/lock-server.yaml`:
- Around line 694-700: The policyStats schema repeats the same description
inside additionalProperties; remove the description field from the
additionalProperties block and keep the single description on the parent
policyStats object to eliminate redundancy (target symbols: policyStats and its
additionalProperties entry).

In
`@jans-lock/lock-server/cedarling/src/main/java/io/jans/lock/cedarling/config/BootstrapConfig.java`:
- Around line 1-5: The license header in class BootstrapConfig currently uses
the non-standard phrase "Apache License (2004)"; update the header comment to
use the standard reference "Apache License, Version 2.0" (or include the SPDX
identifier "Apache-2.0") and ensure the formatting matches other project source
files—replace the existing line in the top-of-file comment block in
BootstrapConfig.java accordingly.

In
`@jans-lock/lock-server/cedarling/src/main/java/io/jans/lock/cedarling/service/filter/CedarlingAuthorizationProcessingFilter.java`:
- Around line 90-98: extractBearerToken currently returns the raw Authorization
header when it doesn't contain a Bearer token (e.g., "Basic ..."), which then
propagates invalid values to processAuthorization; update extractBearerToken to
explicitly validate the Bearer scheme before returning a token by checking the
header matches the Bearer pattern (case-insensitive) or starts with "Bearer "
ignoring case, then extract and trim the token, otherwise return null so only
valid Bearer tokens reach processAuthorization.

In
`@jans-lock/lock-server/cedarling/src/main/java/io/jans/lock/cedarling/service/inject/CedarlingPolicy.java`:
- Around line 1-5: Update the file header in CedarlingPolicy.java to use the
standard license name "Apache License, Version 2.0" instead of "Apache License
(2004)" and adjust the copyright years to reflect the creation-to-current span
(e.g., "2022-2025" or "2022, 2025"); modify only the file comment block at the
top of CedarlingPolicy.java to make these textual changes so the license and
copyright statements are accurate and standard.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/audit/LogEntry.java`:
- Around line 217-242: The equals() and hashCode() implementations in LogEntry
currently omit the immutable persisted identifier inum (and the inherited DN),
causing distinct persisted entries to compare equal; update
LogEntry.equals(Object o) to include Objects.equals(inum, logEntry.inum) (and if
you rely on the parent Entry DN, include Objects.equals(getDn(),
logEntry.getDn()) or the dn field) in the chain of comparisons, and add inum
(and dn/getDn()) to the Objects.hash(...) call in LogEntry.hashCode() so
identity includes the persisted identifier.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/config/cedarling/LogLevel.java`:
- Around line 2-4: Update the license header in LogLevel.java to use the
standard Apache phrasing: replace "Apache License (2004)" with "Apache License,
Version 2.0" and use the canonical URL
"https://www.apache.org/licenses/LICENSE-2.0"; ensure the header matches the
project's standard template (same wording, copyright line format) for the
LogLevel class so future files are consistent.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/config/Conf.java`:
- Line 7: Remove the extra blank line after the license header in Conf.java so
the file follows Java formatting conventions; ensure there is a single blank
line (or none if header ends immediately) before the package declaration
"package io.jans.lock.model.config;" so the file header and package statement
are directly adjacent and consistently formatted.

In
`@jans-lock/lock-server/model/src/main/java/io/jans/lock/model/config/grpc/GrpcConfiguration.java`:
- Around line 27-29: The grpcPort field in GrpcConfiguration allows any int but
should be constrained to valid TCP ports (1–65535); add validation to prevent
invalid values by annotating the grpcPort field with
javax.validation.constraints.Min(1) and javax.validation.constraints.Max(65535)
and/or add a guard in the GrpcConfiguration.setGrpcPort(int) setter that throws
IllegalArgumentException for values outside 1–65535; update the field
documentation if needed so the schema and runtime validation both enforce the
valid port range.
- Around line 31-42: Add validation to GrpcConfiguration to enforce TLS config
consistency: when the boolean field useTls is true, ensure tlsCertChainFilePath
and tlsPrivateKeyFilePath are non-blank and throw a clear IllegalStateException
if either is missing; implement this as a public validate() method on the
GrpcConfiguration class (or annotate with Bean Validation if preferred) and call
validate() before gRPC server startup so fields useTls, tlsCertChainFilePath,
and tlsPrivateKeyFilePath are checked early.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/audit/GrpcAuditServiceImpl.java`:
- Line 56: Change the routine gRPC invocation logs in GrpcAuditServiceImpl from
INFO to DEBUG to reduce verbosity: replace log.info(...) with log.debug(...) in
the methods processHealth, processBulkHealth, processLog, processBulkLog,
processTelemetry, and processBulkTelemetry; keep INFO-level logs only for
significant events (errors or notable state changes) and ensure the same log
message text is preserved when switching to DEBUG.
- Around line 65-68: The catch blocks in GrpcAuditServiceImpl currently call
responseObserver.onError(e) with raw exceptions (and log.error(..., e)), which
can leak internal stack traces to gRPC clients; change those catch handlers to
log the exception internally (using log.error) but pass a wrapped
StatusRuntimeException to responseObserver.onError, e.g., create a
StatusRuntimeException via Status.INTERNAL.withDescription("Error processing
<operation>").withCause(null).asRuntimeException() or similar (include minimal
safe description), and replace direct responseObserver.onError(e) calls with
responseObserver.onError(wrappedException); apply the same pattern to every
catch block in GrpcAuditServiceImpl, ensuring you reference
responseObserver.onError and use Status.*.asRuntimeException() to create the
wrapper.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/audit/GrpcAuditServiceProvider.java`:
- Around line 39-48: The init() method in GrpcAuditServiceProvider should
validate injected dependencies before using them: check that
auditRestWebService, mapper, and log are not null and throw a clear
IllegalStateException (or log an explicit error) if any are null, then only
instantiate grpcAuditService = new GrpcAuditServiceImpl(...). Add these null
checks at the start of init() to fail-fast with a descriptive message
referencing the missing dependency names so the cause is clear when CDI
injection fails.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/security/GrpcAuthorizationInterceptor.java`:
- Around line 65-66: The constant AUTHORIZATION_METADATA_KEY in
GrpcAuthorizationInterceptor is unused (the code calls
HeaderUtils.findAndExtractBearerToken(headers) instead); remove the unused field
declaration to clean up the class and imports, and ensure no other references
remain to AUTHORIZATION_METADATA_KEY after deletion so compilation is
unaffected.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/server/GrpcServerStarter.java`:
- Around line 140-165: The stopGrpcServer method leaves the grpcServer field
non-null after shutdown, which can cause stale state on later restarts; update
stopGrpcServer to set grpcServer = null after a successful shutdown path and
also after the InterruptedException handling (i.e., after forcing shutdown in
both the normal and catch paths) so that the grpcServer reference is cleared for
future reinitialization; locate the method stopGrpcServer and the grpcServer
field to add the null assignment in all exit paths.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/OpenIdService.java`:
- Around line 2-4: Update the file header in OpenIdService.java to use the
standardized Apache License, Version 2.0 header used elsewhere (e.g.,
ConfigurationService.java) and change the copyright year to 2025 (or use the
range "2022-2025" if you prefer); specifically replace the existing top-of-file
block comment with the current project license template and updated year(s) so
the class OpenIdService reflects the consistent license header format across the
codebase.

In `@jans-lock/lock-server/service/src/main/proto/grpc/audit.proto`:
- Around line 1-9: The proto declares package io.jans.lock.audit (and outer
classname AuditProto) but the file lives outside the expected io/jans/lock/audit
directory, causing Buf lint failures; fix by either moving this proto file into
the repository proto root subdirectory path io/jans/lock/audit so the filesystem
matches the declared package, or update the package declaration to match the
current directory layout (and update references to AuditProto accordingly);
alternatively, if you intentionally keep the current layout, add/configure
buf.yaml to allow this directory mapping so Buf won’t reject files with package
io.jans.lock.audit.

In
`@jans-lock/lock-server/server/src/test/manual/automatic_audit_enpoints_tests.sh`:
- Around line 11-15: Replace the hardcoded placeholders (HOST, GRPC_ADDR,
CLIENT_ID, CLIENT_SECRET, INVALID_TOKEN) with environment-driven values: read
each from process/env (e.g., HOST=${HOST:-} style) and enforce required checks
so the script exits with a clear error if any required variable (CLIENT_ID,
CLIENT_SECRET, HOST) is missing; allow an optional override for INVALID_TOKEN
and GRPC_ADDR, and document sourcing a local .env or exporting env vars in the
script header so secrets are never committed.
- Around line 171-239: The failure handlers currently echo the raw command and
output (see functions check_http_success, check_http_should_fail,
check_grpc_success, check_grpc_should_fail), which can leak Authorization:
Bearer tokens; sanitize before printing by constructing a safe_cmd that pipes
the original cmd through a redaction filter (e.g., sed to replace
'Authorization: Bearer <token>' with 'Authorization: Bearer <redacted>' and/or
remove '--header "Authorization: Bearer ..."' portions) and use safe_cmd in all
"Command:" logs, and similarly run the printed output through a redaction step
(e.g., safe_output=$(echo "$output" | sed -E 's/(Authorization:
Bearer)[[:space:]]+[^[:space:]]+/\1 <redacted>/gi')) before echoing "Output:" so
no bearer tokens appear in logs; update all places that echo $cmd or echo
"$output" in those four functions to use the redacted variables.
- Around line 202-218: The two bare redirections in the helper functions (the
standalone “> res.txt” lines immediately before the if eval blocks in the
functions such as check_grpc_should_fail) should be replaced with an explicit
no-op command to silence ShellCheck SC2188; update those lines to use a no-op
like : > res.txt (or true > res.txt) so the intent to truncate the file is
explicit while keeping the rest of the function (the eval "$cmd" >res.txt 2>&1
logic and the function names check_grpc_should_fail / the corresponding
pass-check function) unchanged.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/security/GrpcAuthorizationInterceptor.java`:
- Around line 212-236: The inner class GrpcResourceInfo currently holds an
implicit reference to its enclosing GrpcAuthorizationInterceptor instance;
declare it as a static nested class (change "class GrpcResourceInfo" to "static
class GrpcResourceInfo") so it no longer captures the outer instance, keeping
constructors and methods (getResourceMethod, getResourceClass, toString)
unchanged; ensure imports and usages inside GrpcAuthorizationInterceptor still
compile after making GrpcResourceInfo static.
- Around line 169-201: extractResourceInfo currently only inspects
AuditRestWebService.class and is therefore not extensible; change it to accept
or obtain a collection of service classes (e.g., pass a List<Class<?>> or use a
ServiceLoader/registry) and iterate over those when calling
getProtectionApiMethod so new gRPC service classes can be discovered without
modifying this method. In getProtectionApiMethod, replace
Optional.ofNullable(grpcResourceInfo) with Optional.of(grpcResourceInfo) because
grpcResourceInfo is never null at that point; keep referencing the methods
extractResourceInfo, getProtectionApiMethod, AuditRestWebService, and
GrpcResourceInfo to locate the changes.
- Around line 123-131: The catch block in GrpcAuthorizationInterceptor that logs
and closes the call on exceptions should also record an audit entry like the
existing authorization-failure path: call the same audit logging routine used
for authorization failures (use the same audit service/method invoked for
failures) with the methodName, the exception message and exception details
before or immediately after log.error and before call.close; ensure the audit
entry marks it as an exception/internal error and includes sufficient context
(methodName and exception) so it appears in the security audit trail.

In
`@jans-lock/lock-server/server/src/test/manual/automatic_audit_enpoints_tests.sh`:
- Around line 199-239: The helper functions check_grpc_success and
check_grpc_should_fail write to a hardcoded res.txt which is never removed;
create a temporary file at script start (e.g., RESFILE=$(mktemp)) and install a
trap to rm -f "$RESFILE" on EXIT (and ERR if desired), then update both
check_grpc_success and check_grpc_should_fail to redirect to "$RESFILE" instead
of res.txt so the file is unique and automatically cleaned up when the script
exits.
- Around line 1-16: Add explicit prerequisite checks immediately after set -euo
pipefail: verify binaries curl, jq, and grpcurl exist (use command -v or which
and exit non-zero with a clear message if missing) and verify the audit.proto
file exists (test -f and exit with a clear error). Place these checks near the
top of the script (after set -euo pipefail) so the script fails fast before
using HOST, GRPC_ADDR, CLIENT_ID, CLIENT_SECRET or INVALID_TOKEN; ensure each
check prints which prerequisite is missing and exits non-zero.

In
`@jans-lock/lock-server/service/src/main/java/io/jans/lock/service/grpc/security/GrpcAuthorizationInterceptor.java`:
- Around line 205-207: Rename the misspelled helper method optAnnnotation to
optAnnotation (change method signature: private static <T extends Annotation>
Optional<T> optAnnotation(AnnotatedElement elem, Class<T> cls)) and update all
call sites, notably the call inside getProtectedApiAnnotation, to use
optAnnotation; preserve the method's generics, return type, parameters and
static/private modifiers so behavior remains unchanged.

In
`@jans-core/service/src/main/java/io/jans/service/security/api/ProtectedApi.java`:
- Around line 20-23: Update the Javadoc on the grpcMethodName() element of the
ProtectedApi interface: remove the surrounding backticks so the Javadoc tag is a
proper `@return` tag (e.g. change "`@return` gRPC method name..." to "@return gRPC
method name mapped to this endpoint (empty if not applicable)"). Ensure the tag
appears on its own line in the Javadoc block above the String grpcMethodName()
default "" declaration.

In
`@jans-lock/lock-server/service/src/main/policy/audit/telemetry_bulk_write.json`:
- Around line 1-11: The Cedar policy files (e.g., the policy with
`@id`("lock_audit_telemetry_write") stored as telemetry_bulk_write.json) are using
Cedar syntax but have a .json extension, which will cause Biome JSON parsing
errors; fix this by either renaming these policy files to use a .cedar extension
(e.g., telemetry_bulk_write.cedar, health_write.cedar, get_policy.cedar) or add
a Biome override in biome.json that disables the linter for the policy directory
(targeting the policy path under lock-server/service/src/main/policy) so Biome
skips parsing these files as JSON.