[Review] Implement access token context encoding framework

[AncD8972]

Mirrored from ai-code-review-evaluation#8.

Test 8

[AncD8972]

🤖 DiffCOT AI Code Review

This PR implements an access token context encoding framework that embeds metadata (session type, token type, grant type) directly into token IDs using a compact encoding scheme. The solution uses a provider-based SPI pattern with 2-character shortcuts for efficient token introspection without database lookups.

Assessment	Score
⚠️ REQUEST_CHANGES	7/10

✅ Positive Aspects

• Well-designed SPI architecture with clean separation of concerns
• Efficient encoding scheme using 2-character shortcuts to minimize token ID bloat
• Good use of factory pattern for dynamic grant type registration and validation
• Comprehensive test coverage for encoding/decoding scenarios
• Proper handling of backward compatibility for legacy tokens without context encoding

💡 Suggestions for Improvement

• Consider adding validation to ensure grant type shortcuts are unique at compile time rather than just runtime
• Add migration strategy documentation for existing deployments with plain token IDs
• Consider edge case handling for extremely long token IDs that might exceed URL/header limits
• Add more comprehensive error messages for malformed token IDs to aid debugging

🔍 Issues Found: 1

• 🔴 High: 1
• 🟡 Medium: 0
• 🟢 Low: 0

See inline comments below for details.

---

Generated by DiffCOT AI Code Review

[AncD8972]

🔴 HIGH | logic_defect

Critical bug in constructor: checking grantType twice instead of rawTokenId. The last null check should validate rawTokenId, not grantType again.

💡 Suggestion: Fix the null check to validate rawTokenId parameter

Suggested change

	public AccessTokenContext(SessionType sessionType, TokenType tokenType, String grantType, String rawTokenId) {
	Objects.requireNonNull(sessionType, "Null sessionType not allowed");
	Objects.requireNonNull(tokenType, "Null tokenType not allowed");
	Objects.requireNonNull(grantType, "Null grantType not allowed");
	Objects.requireNonNull(sessionType, "Null sessionType not allowed");
	Objects.requireNonNull(tokenType, "Null tokenType not allowed");
	Objects.requireNonNull(grantType, "Null grantType not allowed");
	Objects.requireNonNull(rawTokenId, "Null rawTokenId not allowed");