feat(java): forced access token refresh and expiry buffer

[dgawande12]

Description

• Adds ability to force refresh OAuth2 access tokens
• Introduces configurable proactive offset buffer to refresh tokens before actual expiration time
• Improves test coverage and reduces duplication in token-handling tests

Links

ENSC-2344

Testing

Checklist

Ensure the following things have been met before requesting a review:

• Follows all project developer guide and coding standards.
• Tests have been written for the change, when applicable.
• Confidential information (credentials, auth tokens, etc...) is not included.

[acleary-0]

Checkmarx One – Scan Summary & Details – 6083d55f-fd17-4ef2-b150-2f8eb3c1b301

New Issues (6)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-11226	Maven-ch.qos.logback:logback-core-1.3.15	details Recommended version: 1.5.19 Description: Arbitrary Code Execution (ACE) vulnerability in conditional configuration file processing by QOS.CH logback-core versions through 1.5.18 in Java ap... Attack Vector: LOCAL Attack Complexity: LOW ID: Oi78HyXmlhKQ%2B08EgOhitfnHDnhlP5DMIzyPTaRkXWE%3D Vulnerable Package
	Unpinned Actions Full Length Commit SHA	/pr-checks.yml: 18	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: nbvde%2Fv4%2BRDlqk5tZp22hg3O428%3D
	Unpinned Actions Full Length Commit SHA	/fortify.yml: 29	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: 4ponLjQ9YqM1Tqnjw%2BAGo5j2lcc%3D
	Unpinned Actions Full Length Commit SHA	/codeql-analysis.yml: 32	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: fRa7hSVmi165a0KbDv%2FtTthoeGE%3D
	Unpinned Actions Full Length Commit SHA	/codeql-analysis.yml: 37	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: %2Bjf06qtFq%2FhiwToB0qWaTcnrWUs%3D
	Unpinned Actions Full Length Commit SHA	/codeql-analysis.yml: 40	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: hghq8Fs7C%2Bgxpck6NX7jOZnmotE%3D

Fixed Issues (7)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2023-6378	Maven-ch.qos.logback:logback-core-1.2.11
	CVE-2023-6378	Maven-ch.qos.logback:logback-classic-1.2.11
	CVE-2023-6481	Maven-ch.qos.logback:logback-core-1.2.11
	CVE-2023-41329	Maven-com.github.tomakehurst:wiremock-jre8-standalone-2.35.0
	CVE-2024-12798	Maven-ch.qos.logback:logback-classic-1.2.11
	CVE-2024-12798	Maven-ch.qos.logback:logback-core-1.2.11
	CVE-2024-12801	Maven-ch.qos.logback:logback-core-1.2.11

---

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

[gdulafactset]

Some comments.