esignet-core/src/main/java/io/mosip/esignet/core/dto/ServerProfile.java (1)

12-17: Consider initializing featureMap to prevent potential NPE.

While the current usage in AppConfig.serverProfile() always sets the map, initializing the field defensively would prevent accidental NPE if the DTO is used elsewhere without explicit initialization.

♻️ Optional defensive initialization

 `@Data`
 public class ServerProfile {
 
     private String name;
-    private Map<String, String> featureMap;
+    private Map<String, String> featureMap = new HashMap<>();
 }

esignet-service/src/test/java/io/mosip/esignet/AppConfigTest.java (2)

34-35: Remove unused @Value annotation.

The @Value annotation has no effect in a @ExtendWith(MockitoExtension.class) test since Spring's property injection is not active. The field is never used as all tests set the value via ReflectionTestUtils.

♻️ Remove dead code

-    `@Value`("${mosip.esignet.server.profile:none}")
-    private String serverProfile;
-
     `@Test`
     void serverProfile_ServerProfileIsNone_returnsWithNoFeatures() throws EsignetException {

---

57-63: Test relies on implicit repository behavior for null input.

The test serverProfile_NullProfile_ThrowsException passes because findByProfileName(null) returns null or empty list. However, this test doesn't mock the repository behavior, making the assertion dependent on default mock behavior (returning null). Consider explicitly mocking for clarity.

♻️ Add explicit mock for clarity

 `@Test`
 void serverProfile_NullProfile_ThrowsException() {
     ReflectionTestUtils.setField(appConfig, "serverProfile", null);
+    when(serverProfileRepository.findByProfileName(null)).thenReturn(null);

     EsignetException exception = assertThrows(EsignetException.class, () -> appConfig.serverProfile());
     assertEquals("INVALID_SERVER_PROFILE", exception.getMessage());
 }

esignet-core/src/test/java/io/mosip/esignet/core/IdentityProviderUtilTest.java (3)

231-241: Test name no longer reflects what is being tested.

The test getJWKString_withInvalidAlgForRSA_thenFail now tests an empty string for alg, not an invalid algorithm for RSA keys. Consider renaming to getJWKString_withEmptyAlg_thenFail for clarity.

Suggested rename

-    public void getJWKString_withInvalidAlgForRSA_thenFail() {
+    public void getJWKString_withEmptyAlg_thenFail() {

---

243-254: Test name no longer reflects what is being tested.

The test getJWKString_withInvalidUse_thenFail now tests a blank string for use, not an invalid use value. Consider renaming to getJWKString_withBlankUse_thenFail for clarity.

Suggested rename

-    public void getJWKString_withInvalidUse_thenFail() {
+    public void getJWKString_withBlankUse_thenFail() {

---

174-192: Missing test coverage for the new behavior allowing null alg/use.

The existing tests getJWKString_withMissingAlg_thenFail and getJWKString_withMissingUse_thenFail pass due to missing RSA key components (n, e), not because of missing alg/use. With the implementation change now allowing null alg and use, consider adding positive test cases that verify a complete RSA JWK without alg or use succeeds.

Suggested additional test

`@Test`
public void getJWKString_withValidRSAKeyWithoutAlgAndUse_thenPass() {
    Map<String, Object> jwkMap = new HashMap<>();
    jwkMap.put("kty", "RSA");
    jwkMap.put("n", "oahUIzUup5kqncCkHk5Zb1pRrLx7e6YtM-9jX1f5e6mHnZFkC2LJUZ0sEh0n5Y5KnQfW9s7d7gK2b8P0EEl0h3ZyHkWzA3YbsgzB4pDxP4RxMZ1I8xD2z3UvfA1zjvKDHz6wEweq4hVJ8nS8GzZJ2E_vb3s");
    jwkMap.put("e", "AQAB");
    // No alg or use - should now pass
    String jwkJson = IdentityProviderUtil.getJWKString(jwkMap);
    Assertions.assertTrue(jwkJson.contains("\"kty\":\"RSA\""));
}