Estate Reporting calls use client token instead of user token with estate ID claim #1163

Problem

The UI calls the Estate Reporting API with a client-credentials token. The API now expects a user access token containing the authenticated user's estate ID claim, causing Estate Reporting requests to fail after the authentication contract changed.

Expected behavior

Estate Reporting calls should forward the signed-in user's OIDC access token, with the estate ID claim issued by the security service.

Client-credentials tokens should remain in use only for APIs that explicitly require application/client authentication.

Proposed resolution

• Request the Estate Reporting scope during OIDC sign-in.
• Ensure access tokens are saved in the authenticated session.
• Add a user access-token provider that reads the token from the authenticated OIDC cookie/session.
• Use the user token for Estate Reporting client methods.
• Keep the existing client-credentials token flow for Transaction Processor and File Processor calls.
• Confirm the security service issues the estate ID claim in the user access token and that Estate Reporting validates the same claim.

Acceptance criteria

• Authenticated users can load Estate Reporting pages successfully.
• Estate Reporting receives a user token rather than a client-credentials token.
• The token contains the expected estate ID claim.
• Transaction Processor and File Processor calls continue to use their existing client token flow.
• Missing authentication or missing access tokens produce a clear failure.
• Dependency injection does not resolve scoped authentication services from a singleton provider.
• Automated tests cover successful token retrieval and unauthenticated/missing-token cases.

Context

During implementation, resolving IAuthenticationService directly from a singleton token provider caused:

Cannot consume scoped service Microsoft.AspNetCore.Authentication.IAuthenticationService from singleton EstateManagementUI.BusinessLogic.Client.IUserAccessTokenProvider.

The provider must either use an appropriate scoped lifetime or resolve the authentication service within the active request scope.