Testing JWT and OAuth2 Endpoints

You do not need Keycloak running. jwt() creates an authenticated JwtAuthenticationToken directly; only the JWT decoder bean must exist, so mock it:

@WebMvcTest(OrderController.class)
@Import({ResourceServerConfig.class, JwtAuthConfig.class})
class OrderControllerJwtTest {

    @Autowired MockMvc mvc;
    @MockitoBean OrderService orderService;
    @MockitoBean JwtDecoder jwtDecoder;              // no call to the issuer during tests

    @Test
    void noTokenGives401() throws Exception {
        mvc.perform(get("/api/orders"))
           .andExpect(status().isUnauthorized())
           .andExpect(header().string("WWW-Authenticate", "Bearer"));
    }

    @Test
    void readScopeGives200() throws Exception {
        when(orderService.findByCustomer("asha")).thenReturn(List.of());
        mvc.perform(get("/api/orders").with(jwt()
                .jwt(j -> j.subject("asha").claim("scope", "orders.read"))
                .authorities(new SimpleGrantedAuthority("SCOPE_orders.read"))))
           .andExpect(status().isOk());
    }

    @Test
    void readScopeCannotPlaceOrders() throws Exception {
        mvc.perform(post("/api/orders").contentType(MediaType.APPLICATION_JSON).content("{}")
                .with(jwt().authorities(new SimpleGrantedAuthority("SCOPE_orders.read"))))
           .andExpect(status().isForbidden());
    }
}

// a user who logged in with Google (oauth2Login)
mvc.perform(get("/api/me").with(oidcLogin()
        .idToken(token -> token.claim("email", "[email protected]").claim("name", "Asha Verma"))
        .authorities(new SimpleGrantedAuthority("ROLE_CUSTOMER"))))
   .andExpect(status().isOk())
   .andExpect(jsonPath("$.email").value("[email protected]"));

// an opaque-token resource server
mvc.perform(get("/api/orders").with(opaqueToken()
        .attributes(a -> a.put("sub", "asha"))
        .authorities(new SimpleGrantedAuthority("SCOPE_orders.read"))))
   .andExpect(status().isOk());