Pass through unrecognized claims in check_token and introspect responses

[duanemay]

Summary

• CheckTokenEndpoint and IntrospectEndpoint both decode a JWT into a Claims/IntrospectionClaims POJO annotated @JsonIgnoreProperties(ignoreUnknown = true), so any top-level claim without a matching field is silently dropped from the response.
• Claims captures unrecognized claims via @JsonAnySetter and re-flattens them back to top level on serialization via @JsonAnyGetter, instead of discarding them.
• RFC 7662 (token introspection) explicitly allows this — section 2.2 says the response "MAY" include extension
  members beyond the standard set, and clients "SHOULD" ignore unrecognized ones.
• Since the catch-all lives on the shared Claims class, this change applies to both /check_token and /introspect — any claim added to a token (e.g. by a custom UaaTokenEnhancer) that isn't one of the explicitly modeled fields now shows up in both endpoints' responses.

Test plan

• IntrospectionClaimsTest — verifies an unrecognized claim round-trips through deserialize/serialize and appears at the top level of the JSON output.
• CheckTokenEndpointTests#additionalClaimsInResult — verifies custom top-level claims added by a UaaTokenEnhancer (ex_groups, ex_prop) are no longer dropped from the /check_token response.
• Existing IntrospectionClaimsTest, IntrospectEndpointTest, and CheckTokenEndpointTests suites pass unchanged.

[Copilot]

🟡 Changes recommended

IntrospectionClaims#getAdditionalClaims() exposes a mutable backing map, which can lead to unintended external mutation of serialized/introspection output.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the token introspection claim model so /introspect responses can include JWT extension (previously-unmapped) top-level claims, instead of silently dropping them during deserialization.

Changes:

• Capture unknown JSON/JWT claim members in IntrospectionClaims via @JsonAnySetter and serialize them back out via @JsonAnyGetter.
• Add a unit test to verify an unmapped claim survives deserialize → serialize and appears at the top level of the JSON output.

File summaries

File	Description
model/src/main/java/org/cloudfoundry/identity/uaa/oauth/token/IntrospectionClaims.java	Adds an “additional claims” map and Jackson any-setter/any-getter flattening to preserve extension members.
model/src/test/java/org/cloudfoundry/identity/uaa/oauth/token/IntrospectionClaimsTest.java	Adds coverage to confirm unknown claims round-trip and reappear in serialized JSON.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The newly added tests include assertions that are currently too weak to reliably validate the intended “flattened at top level” behavior and correct value round-tripping.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite