fix(localega-tsd-proxy): return 403 when export token verification fails

[yasinmiran]

Summary

POST /export/gdi maps a token that fails verification onto the controller catch-all and answers 500, which tells the caller the fault is ours. After #862 a forged visa in an otherwise valid passport starts throwing SignatureException from clearinghouse, so this is the path that would regress. A forged or expired access token already 500s on main today, because parseVerified throws JwtException with nobody mapping it, and that half is live whether or not #862 lands first.

The wrap lives in ExportRequestService.exportRequestGDI. JwtException from parseVerified and from getControlledAccessGrantsVisas becomes GenericException(FORBIDDEN, "Token verification failed"), which the controller already turns into 403, and an empty visa list stays 403 with "No valid visas found for this resource". Call order is the original one: verify the access token, reject a missing subject with 400, then fetch visas. /export/fega never parses a token, so it is left alone.

Status is 403, matching this module's AAIAspect (present-but-bad token is 403; missing header is 401) and the empty-visa case already on this endpoint. sda-doa answers 401 for the same failure, which is a fair reading of a credential that does not verify. Distinguishing a forgery from an empty passport, which is what #790 asked for, then sits on the response body rather than on two different statuses.

Closes #863.

Test plan

• ./gradlew :services:localega-tsd-proxy:test --tests no.elixir.fega.ltp.services.ExportRequestServiceTest

The four tests pin forged access token and forged visa to 403 with "Token verification failed", empty visa list to 403 with the existing empty-passport message, and a blank subject to 400 without calling getControlledAccessGrantsVisas.

[Copilot]

Pull request overview

This PR fixes the export endpoint’s error mapping so that JWT verification failures (access token or visa/passport token verification) return HTTP 403 via GenericException, instead of falling through to the controller catch-all and returning HTTP 500.

Changes:

• Wraps parseVerified(...) and getControlledAccessGrantsVisas(...) in ExportRequestService.exportRequestGDI(...) to translate JwtException into GenericException(FORBIDDEN, "Token verification failed").
• Adds unit tests covering forged access token, forged visa, empty visa list, and blank subject behavior for exportRequestGDI.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
services/localega-tsd-proxy/src/main/java/no/elixir/fega/ltp/services/ExportRequestService.java	Maps JWT verification exceptions to 403 Forbidden to avoid controller catch-all 500.
services/localega-tsd-proxy/src/test/java/no/elixir/fega/ltp/services/ExportRequestServiceTest.java	Adds regression tests ensuring token/visa verification failures and edge cases map to the intended responses.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.