feat: back the OAuth2 consent session with Spring Session JDBC

The auth-code consent flow needs an HttpSession to carry the authenticated
principal from /oauth2/session-bootstrap into /oauth2/authorize. Storing it in
JDBC (Spring Session) keeps it shared across replicas so the app stays otherwise
stateless; the schema is managed by Liquibase, not Spring Session.

Author: bdshadow

backend/app/src/main/resources/application.yaml

@@ -8,6 +8,12 @@ spring:
     redis:
       repositories:
         enabled: false
+  session:
+    # JDBC-backed HTTP sessions (shared across replicas) for the OAuth2 consent flow; the app is otherwise stateless.
+    # The schema is created by Liquibase (db/changelog/spring-session), not by Spring Session.
+    store-type: jdbc
+    jdbc:
+      initialize-schema: never
   mvc:
     pathmatch:
       matching-strategy: ant_path_matcher

backend/data/build.gradle

@@ -184,6 +184,9 @@ dependencies {
     implementation libs.jjwtImpl
     implementation libs.jjwtJackson
     api libs.springSecurityOauth2AuthServer
+    // Shared JDBC session store so the OAuth2 consent flow's HttpSession survives across replicas (the app is
+    // otherwise stateless). See db/changelog/spring-session/spring-session.xml for the schema.
+    api 'org.springframework.session:spring-session-jdbc'
     implementation libs.jacksonModuleKotlin
     implementation 'net.datafaker:datafaker:2.4.4'
     implementation 'jaxen:jaxen:1.2.0'

backend/data/src/main/resources/db/changelog/schema.xml

@@ -5877,4 +5877,5 @@
         </sql>
     </changeSet>
     <include file="db/changelog/oauth2/oauth2-server.xml"/>
+    <include file="db/changelog/spring-session/spring-session.xml"/>
 </databaseChangeLog>

backend/data/src/main/resources/db/changelog/spring-session/spring-session.xml

@@ -0,0 +1,47 @@
+<?xml version="1.1" encoding="UTF-8" standalone="no"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.20.xsd">
+
+    <!--
+        Spring Session JDBC schema (spring-session-jdbc). Backs the OAuth2 consent flow's HttpSession with the shared
+        Postgres so the bootstrapped SecurityContext is visible on any replica. Source: classpath resource
+        org/springframework/session/jdbc/schema-postgresql.sql. These tables are NOT JPA entities, so they are listed in
+        gradle/liquibase.gradle excludeObjects. spring.session.jdbc.initialize-schema=never leaves creation to us.
+    -->
+
+    <changeSet author="dbocharov" id="spring-session">
+        <sql dbms="postgresql" splitStatements="false">
+            CREATE TABLE SPRING_SESSION (
+                PRIMARY_ID CHAR(36) NOT NULL,
+                SESSION_ID CHAR(36) NOT NULL,
+                CREATION_TIME BIGINT NOT NULL,
+                LAST_ACCESS_TIME BIGINT NOT NULL,
+                MAX_INACTIVE_INTERVAL INT NOT NULL,
+                EXPIRY_TIME BIGINT NOT NULL,
+                PRINCIPAL_NAME VARCHAR(100),
+                CONSTRAINT SPRING_SESSION_PK PRIMARY KEY (PRIMARY_ID)
+            );
+
+            CREATE UNIQUE INDEX SPRING_SESSION_IX1 ON SPRING_SESSION (SESSION_ID);
+            CREATE INDEX SPRING_SESSION_IX2 ON SPRING_SESSION (EXPIRY_TIME);
+            CREATE INDEX SPRING_SESSION_IX3 ON SPRING_SESSION (PRINCIPAL_NAME);
+
+            CREATE TABLE SPRING_SESSION_ATTRIBUTES (
+                SESSION_PRIMARY_ID CHAR(36) NOT NULL,
+                ATTRIBUTE_NAME VARCHAR(200) NOT NULL,
+                ATTRIBUTE_BYTES BYTEA NOT NULL,
+                CONSTRAINT SPRING_SESSION_ATTRIBUTES_PK PRIMARY KEY (SESSION_PRIMARY_ID, ATTRIBUTE_NAME),
+                CONSTRAINT SPRING_SESSION_ATTRIBUTES_FK FOREIGN KEY (SESSION_PRIMARY_ID)
+                    REFERENCES SPRING_SESSION(PRIMARY_ID) ON DELETE CASCADE
+            );
+        </sql>
+        <rollback>
+            <sql>
+                DROP TABLE SPRING_SESSION_ATTRIBUTES;
+                DROP TABLE SPRING_SESSION;
+            </sql>
+        </rollback>
+    </changeSet>
+
+</databaseChangeLog>

gradle/liquibase.gradle

@@ -43,7 +43,10 @@ ext {
                             // Spring Authorization Server tables (not JPA entities): managed by db/changelog/oauth2/oauth2-server.xml
                             "table:oauth2_registered_client,"+
                             "table:oauth2_authorization,"+
-                            "table:oauth2_authorization_consent"
+                            "table:oauth2_authorization_consent,"+
+                            // Spring Session tables (not JPA entities): managed by db/changelog/spring-session/spring-session.xml
+                            "table:spring_session,"+
+                            "table:spring_session_attributes"
                 }
             }
         }