Provide "Third Party" OAuth2 Token Endpoint for Central Server Authentication to FOLIO

Purpose/Overview:
The D2IR API specification requires that the 3rd-party ILS/LSP integrating with INN-Reach provide an OAuth2 token endpoint to provide bearer auth tokens when presented with a valid HTTP Basic authentication request.

Requirements/Scope:

1. Requirement
   • API endpoint: /innreach/v2/oauth2/token (POST)
     • Request headers:

       Accept	String	Yes	Acceptable value: application/json
       Authorization	String	Yes	Authorization in form <token_type> <access_token> as returned by the authorization request
       Content-Type	String	Yes	Acceptable value: application/json
       X-From-Code	String	Yes	Central/local code of sending system (five-character code). The library needs only its own local code and the code for any central systems in which it participates.
       X-Request-Creation-Time	Integer	Yes	Epoch UNIX time stamp, for example: 1544466568
       X-To-Code	String	Yes	Central/local code of destination system (five-character code). The library needs only its own local code and the code for any central systems in which it participates.

     • Request Parameters:
       • grant_type=client_credentials
       • scope=innreach_tp
     • Return 200 Ok and Bearer auth token if key/secret are valid for the X-From-Code system
     • Return 400 Bad Request if request headers missing are missing or incorrect
     • Return 401 Unauthorized if key/secret are incorrect

Approach: 

Acceptance criteria:

• AC: Central server providing correct key/secret pair with all required HTTP header values is able to successfully obtain a valid Bearer auth token

  // 200 OK
  {
      "access_token": "06b42df732f628ae2c3764d86073cd76", 
      "token_type": "Bearer",
      "expires_in": 599
  }
  

• AC: Central server providing an incorrect key/secret pair receives an HTTP response code 401 Unauthorized

  // 401 Unauthorized 
  {
     "error": "invalid_token",
     "error_description": "Token authentication failed"
  }
  

• AC: Central server providing correct or incorrect key/secret pair with malformed or missing required HTTP header values receives a 400 Bad Request error

  // 400 Bad Request 
  {
     "error": "invalid_request",
     "error_description": "The scope parameter is required." 
  }