Как работает аутентификация и авторизация в Jira Cloud приложениях?

User → Redirect → Atlassian Auth Server
     ← Login + Consent →
     ← Callback + code
     → Exchange code → token
     ← Access token + Refresh token

@Configuration
public class JiraOAuth2Config {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .oauth2Client(Customizer.withDefaults())
                .build();
    }

    @Bean
    public ClientRegistration jiraClientRegistration(
            @Value("${jira.oauth2.client-id}") String clientId,
            @Value("${jira.oauth2.client-secret}") String clientSecret) {
        return ClientRegistration.withRegistrationId("jira")
                .clientId(clientId)
                .clientSecret(clientSecret)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .redirectUri("{baseUrl}/callback")
                .authorizationUri("https://auth.atlassian.com/authorize")
                .tokenUri("https://auth.atlassian.com/oauth/token")
                .scope("read:jira-work", "write:jira-work", "read:jira-user")
                .build();
    }
}

import api, { route } from '@forge/api';

// От имени пользователя (scopes из manifest.yml)
const userResponse = await api.asUser().requestJira(route`/rest/api/3/myself`);

// От имени приложения
const appResponse = await api.asApp().requestJira(route`/rest/api/3/issue/PROJ-123`);