Add public getAccessToken() methods to expose OAuth2 tokens from client credentials

[Copilot]

This PR adds public getAccessToken() methods to both OpenFgaApi and OpenFgaClient to allow users to retrieve the OAuth2 access token obtained from the client credentials endpoint. This enables users to include the same token in their own API calls to other services.

Problem

Previously, the SDK internally managed OAuth2 tokens but provided no way for users to access them. Users who needed to make API calls to other services that accept the same OAuth2 token had no way to retrieve it from the SDK.

Solution

Added public getAccessToken() methods to both client classes:

// High-level client usage
OpenFgaClient client = new OpenFgaClient(clientConfiguration);
String token = client.getAccessToken().get();

// Low-level API usage  
OpenFgaApi api = new OpenFgaApi(configuration);
api.getAccessToken().thenAccept(token -> {
    // Use token asynchronously
});

Key Features

• Client credentials only: Methods only work when using CLIENT_CREDENTIALS authentication, throwing IllegalStateException for other auth methods
• Async support: Returns CompletableFuture<String> for non-blocking token retrieval
• Automatic token management: Leverages existing caching and refresh logic
• Thread-safe: Safe for concurrent access across multiple threads
• Consistent API: Both OpenFgaApi and OpenFgaClient provide the same functionality

Implementation Details

The implementation is minimal and surgical:

• Exposes existing internal OAuth2Client functionality through new public methods
• No changes to existing token management logic
• Maintains all existing caching and refresh behavior
• Follows established SDK patterns and error handling conventions

Testing

Added comprehensive test coverage including:

• Successful token retrieval with client credentials
• Error cases for API token and no credentials configurations
• Integration with existing mock HTTP infrastructure
• All 375+ existing tests continue to pass with no regressions

Use Cases

This enables users to:

• Make authenticated requests to other APIs using the same OAuth2 token
• Pass tokens to other parts of their application
• Implement custom authentication workflows
• Debug and log token information for troubleshooting

The changes are fully backward compatible with zero breaking changes to existing functionality.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• invalid-hostname-that-does-not-exist.local
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/java-sdk/java-sdk/build/tmp/test/work -Dorg.gradle.native=false -javaagent:/home/REDACTED/work/java-sdk/java-sdk/build/tmp/.cache/expanded/zip_0bd0851504e6286cb5fc6f37a81e25cc/jacocoagent.jar=destfile=build/jacoco/test.exec,append=true,inclnolocationclasses=false,dumponexit=true,output=file,jmx=false @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath15454675414686019558txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 1' (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/java-sdk/java-sdk/build/tmp/test/work -Dorg.gradle.native=false -javaagent:/home/REDACTED/work/java-sdk/java-sdk/build/tmp/.cache/expanded/zip_0bd0851504e6286cb5fc6f37a81e25cc/jacocoagent.jar=destfile=build/jacoco/test.exec,append=true,inclnolocationclasses=false,dumponexit=true,output=file,jmx=false @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath10115047697685244126txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 5' (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR adds public getAccessToken() methods to both OpenFgaApi and OpenFgaClient classes to expose OAuth2 tokens obtained from client credentials authentication. This allows users to retrieve and reuse the same token for API calls to other services.

• Adds getAccessToken() method to both API and client classes with CLIENT_CREDENTIALS validation
• Returns CompletableFuture<String> for asynchronous token retrieval
• Includes comprehensive test coverage for success and error scenarios

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/main/java/dev/openfga/sdk/api/OpenFgaApi.java	Implements core getAccessToken() method with CLIENT_CREDENTIALS validation
src/main/java/dev/openfga/sdk/api/client/OpenFgaClient.java	Adds wrapper getAccessToken() method that delegates to the API class
src/test/java/dev/openfga/sdk/api/OpenFgaApiTest.java	Tests for API class including success, API token error, and no credentials scenarios
src/test/java/dev/openfga/sdk/api/client/OpenFgaClientTest.java	Tests for client class covering success and API token error cases

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}