chore: update pg version

.github/workflows/codeql.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2

.github/workflows/publish-package.yml

@@ -6,7 +6,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     # Setup .npmrc file to publish to GitHub Packages
     - uses: actions/setup-node@v3
       with:

.github/workflows/render-diagrams.yaml

@@ -11,7 +11,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: Trepp/actions-render-wsq@v1
         with:
           folder: './diagrams'

.github/workflows/run-tests.yaml

@@ -19,7 +19,7 @@ jobs:
       PGSCHEMA: usher
     steps:
     - run: sudo ethtool -K eth0 tx off rx off
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-node@v3
       with:
         node-version: 18
@@ -28,8 +28,8 @@ jobs:
           database/package-lock.json
           server/package-lock.json
           mockidentityprovider/package-lock.json
-    - name: build docker-compose stack
-      run: docker-compose -f docker-compose-ci.yml up -d
+    - name: build docker compose stack
+      run: docker compose -f docker-compose-ci.yml up -d
     - name: Check running containers
       run: docker ps
     - name: database npm ci

README.md

@@ -48,7 +48,7 @@ You can run the sample client and resource servers, or host them somewhere.  Dur
 This list of links is written for developers that would like to contribute to The Usher's codebase.
 
 * [CONTRIBUTING](./docs/CONTRIBUTING.md) (governance model and process for contributing)
-* [DEVELOP](./docs/DEVELOP.md) (use docker-compose to bring up your dev environment)
+* [DEVELOP](./docs/DEVELOP.md) (use docker compose to bring up your dev environment)
 
 ## What currently works
 

database/README.md

@@ -39,7 +39,18 @@ npm run seed:run
 npm run db-reset-test-data
 ```
 
-### How to add db change (migration)
+### How to upgrade to new Postgres major version
+
+To upgrade between major versions of Postgres, ie. from 13 -> 14, you will have to use a command like [pg_upgrade](https://www.postgresql.org/docs/current/pgupgrade.html) or `pg_dumpall`. If you want to preserve the data from your current database, you can follow [this guide](https://thomasbandt.com/postgres-docker-major-version-upgrade).
+
+If you don't care about preserving the data, then you can simply follow the below steps.
+
+1. stop the docker compose stack
+1. delete the `storage` folder
+1. Update the version number in the docker-compose file
+1. start the docker compose stack again
+
+## How to add db change (migration)
 
 To add a change to the existing database schema, ie. a new table, column, etc you must first create a new db migration using knex. The main point to keep in mind is that each migration file is an incremental change to the schema. This allows someone to re-build the database by running all migration files in the correct (timestamp) order.
 

docker-compose-ci.yml

@@ -1,7 +1,6 @@
-version: '3.8'
 services:
   db:
-    image: postgres:12.9-alpine
+    image: postgres:13.12-alpine
     ports:
       - "5432:5432"
     environment:

docker-compose.yml

@@ -1,18 +1,7 @@
-version: '3.8'
+include:
+  - docker-compose-ci.yml
+
 services:
-  db:
-    image: postgres:12.9-alpine
-    ports:
-      - "5432:5432"
-    environment:
-      - POSTGRES_USER=${PGUSER:-postgres}
-      - POSTGRES_PASSWORD=${PGPASSWORD:-tehsecure}
-    volumes:
-      - ./storage/postgres:/var/lib/postgresql/data
-    networks:
-      main:
-        aliases:
-          - usher-db
   usher-server:
     image: node:18-alpine
     expose: [3001, 9229]
@@ -35,22 +24,3 @@ services:
         aliases:
           - usher-server
     restart: on-failure
-  mockidentityprovider-server:
-    image: node:18-alpine
-    expose: [3002]
-    entrypoint: ["sh", "/app/scripts/run_for_development_mockidentityprovider.sh"]
-    ports:
-      - 3002:3002
-    volumes:
-      - ./:/app
-    networks:
-      main:
-        aliases:
-          - mockidentityprovider
-          - idp.dmgt.com.mock
-          - branded-idp-alias.dmgt.com.mock
-          - notwhitelisted.labs.dmgt.com.mock
-          - whitelisted-but-not-aliased.labs.dmgt.com.mock
-          # These will appear under *.localhost
-networks:
-  main:

docs/DEVELOP.md

@@ -71,9 +71,9 @@ The Usher requires access to a PostgreSQL database. You may run a database insta
 
 See the full database set up and usage instructions in the [database README](../../database).
 
-### Development Environment Setup Using docker-compose
+### Development Environment Setup using docker compose
 
-Here are more details on our preferred development configuration, using docker-compose.  To start a ready-to-go development environment, issue the following command `docker-compose up` in the root directory of the project (above server/ and database/). This command fires up *docker-compose* which runs 3 instances:
+Here are more details on our preferred development configuration, using docker compose.  To start a ready-to-go development environment, issue the following command `docker compose up` in the root directory of the project (above server/ and database/). This command fires up *docker-compose* which runs 3 instances:
 
 1. Postgres database
 2. The Usher server
@@ -87,7 +87,7 @@ When Usher server is running, the following ports will be exposed:
 1. **3002** - Mock identity server
 1. **9229** - Inspector. You may attach your debugger to this port
 
-To exit the process you may use `ctrl-c` or run `docker-compose down`.
+To exit the process you may use `ctrl-c` or run `docker compose down`.
 
 ### Run new database migration / seed / reset db
 

docs/QUICKSTART.md

@@ -9,10 +9,10 @@ If you have Docker (and Docker Compose), it is fairly easy to take The Usher for
 ```sh
 git clone https://github.com/DMGT-TECH/the-usher-server
 cd the-usher-server
-docker-compose up   # Ubuntu: requires apt install docker.io docker-compose
+docker compose up
 ```
 
-Done. This will launch three containers: The Usher server, its database (seeded with test data), and a mock identity server.  All three are accessible via port forwarding on the machine where `docker-compose up` was run.
+Done. 🚀 This will launch three containers: The Usher server, its database (seeded with test data), and a mock identity server.  All three are accessible via port forwarding on the machine where `docker compose up` was run.
 
 ## The Test Drive
 
@@ -26,11 +26,11 @@ The Usher ships with a mock identity provider that simulates Auth0's API endpoin
 
 ```json
 {
-   "access_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ik1UVkVOVUV5TkVZelJrWkZNekpDTURrek5UZzJSRGRGUWpSQ05rWTROemhFUkRaR00wSTFNdyJ9.eyJpc3MiOiJodHRwczovL2RtZ3QtdGVzdC5hdXRoMC5jb20vIiwic3ViIjoiYXV0aDB8NWU0NzJiMmQ4YTQwOWUwZTYyMDI2ODU2IiwiYXVkIjpbImh0dHBzOi8vdXMtY2VudHJhbDEtZG1ndC1vb2N0by5jbG91ZGZ1bmN0aW9ucy5uZXQvdGhlLXVzaGVyIiwiaHR0cHM6Ly9kbWd0LXRlc3QuYXV0aDAuY29tL3VzZXJpbmZvIl0sImlhdCI6MTYxODk1Njc5MiwiZXhwIjoxNjE5MDQzMTkyLCJhenAiOiJTWHZLN3ByUGtSUER5RWxFQ0xPMXJ6TEJLUTNiaE11ciIsInNjb3BlIjoib3BlbmlkIGVtYWlsIiwiZ3R5IjoicGFzc3dvcmQifQ.tGGVnuYGv33G-tov581SUSpt-rDDLNYLhS7Olyp6g6cXnuvg-BWco5csy7MsY_SMhMIM5MslK5PN7n42CPZpSbSb-kcb-QqOXCAdkuNDchXrw-8gtnno7fhvWX8rmV8O4yCbfFyi0giTUJHKzEJozp6IQbKOqRSX38rOic7enKnuPueJ9-Ate78p02qT3EH06tjHtBk7xzgokwPf-EZyDsO9Phk_MJiEAalE-S0a4_ymbAt0-HVn78TpOD5gisGDBWmOXGE557Gs1d2DSB8IW5wP-YLv-StR9AdS1SKf24nPcw76FD_1CxN02zqR3nDAvHtnICcKcVvnpug1mFP61A",
-   "expires_in" : 86400,
-   "id_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ik1UVkVOVUV5TkVZelJrWkZNekpDTURrek5UZzJSRGRGUWpSQ05rWTROemhFUkRaR00wSTFNdyJ9.eyJlbWFpbCI6InRlc3QtdXNlcjFAZG1ndG9vY3RvLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiaXNzIjoiaHR0cHM6Ly9kbWd0LXRlc3QuYXV0aDAuY29tLyIsInN1YiI6ImF1dGgwfDVlNDcyYjJkOGE0MDllMGU2MjAyNjg1NiIsImF1ZCI6IlNYdks3cHJQa1JQRHlFbEVDTE8xcnpMQktRM2JoTXVyIiwiaWF0IjoxNjE4OTU2NzkyLCJleHAiOjE2MTg5OTI3OTJ9.ayecXkRqmq8Llb-Lm_BOKuUk9t0Ovcdacx8ojUB7EC_oNlh6fhIrMTnb6yfkGC4v1CRJmZ-WhiTKvlC5GzWI8Fl6xV_iCX6KrdhuaDyHLA5aHH_1VEGbluzpW39LIpxOkQi1aT6X9LX625-6lO20GKxNnVxTzryCbfUPhcfX0_Uo8zEU-mKycu3ujFB3_D6lQ5Rh1NLHQeFlY1NfUAVqzAVsoHA8xaGAro7gKIq19QPXgj1lvPKDbOMN2z_uK9pTLcd_loxoUP0GiJnplPNOx_9YRbq8Uk69XDacYsZoz58pDLIG59LeBC7UVqECOP97ChGgIHiqZVkqddcKt3feMQ",
-   "scope" : "openid email",
-   "token_type" : "Bearer"
+  "access_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ik1UVkVOVUV5TkVZelJrWkZNekpDTURrek5UZzJSRGRGUWpSQ05rWTROemhFUkRaR00wSTFNdyJ9.eyJpc3MiOiJodHRwczovL2RtZ3QtdGVzdC5hdXRoMC5jb20vIiwic3ViIjoiYXV0aDB8NWU0NzJiMmQ4YTQwOWUwZTYyMDI2ODU2IiwiYXVkIjpbImh0dHBzOi8vdXMtY2VudHJhbDEtZG1ndC1vb2N0by5jbG91ZGZ1bmN0aW9ucy5uZXQvdGhlLXVzaGVyIiwiaHR0cHM6Ly9kbWd0LXRlc3QuYXV0aDAuY29tL3VzZXJpbmZvIl0sImlhdCI6MTYxODk1Njc5MiwiZXhwIjoxNjE5MDQzMTkyLCJhenAiOiJTWHZLN3ByUGtSUER5RWxFQ0xPMXJ6TEJLUTNiaE11ciIsInNjb3BlIjoib3BlbmlkIGVtYWlsIiwiZ3R5IjoicGFzc3dvcmQifQ.tGGVnuYGv33G-tov581SUSpt-rDDLNYLhS7Olyp6g6cXnuvg-BWco5csy7MsY_SMhMIM5MslK5PN7n42CPZpSbSb-kcb-QqOXCAdkuNDchXrw-8gtnno7fhvWX8rmV8O4yCbfFyi0giTUJHKzEJozp6IQbKOqRSX38rOic7enKnuPueJ9-Ate78p02qT3EH06tjHtBk7xzgokwPf-EZyDsO9Phk_MJiEAalE-S0a4_ymbAt0-HVn78TpOD5gisGDBWmOXGE557Gs1d2DSB8IW5wP-YLv-StR9AdS1SKf24nPcw76FD_1CxN02zqR3nDAvHtnICcKcVvnpug1mFP61A",
+  "expires_in" : 86400,
+  "id_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ik1UVkVOVUV5TkVZelJrWkZNekpDTURrek5UZzJSRGRGUWpSQ05rWTROemhFUkRaR00wSTFNdyJ9.eyJlbWFpbCI6InRlc3QtdXNlcjFAZG1ndG9vY3RvLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiaXNzIjoiaHR0cHM6Ly9kbWd0LXRlc3QuYXV0aDAuY29tLyIsInN1YiI6ImF1dGgwfDVlNDcyYjJkOGE0MDllMGU2MjAyNjg1NiIsImF1ZCI6IlNYdks3cHJQa1JQRHlFbEVDTE8xcnpMQktRM2JoTXVyIiwiaWF0IjoxNjE4OTU2NzkyLCJleHAiOjE2MTg5OTI3OTJ9.ayecXkRqmq8Llb-Lm_BOKuUk9t0Ovcdacx8ojUB7EC_oNlh6fhIrMTnb6yfkGC4v1CRJmZ-WhiTKvlC5GzWI8Fl6xV_iCX6KrdhuaDyHLA5aHH_1VEGbluzpW39LIpxOkQi1aT6X9LX625-6lO20GKxNnVxTzryCbfUPhcfX0_Uo8zEU-mKycu3ujFB3_D6lQ5Rh1NLHQeFlY1NfUAVqzAVsoHA8xaGAro7gKIq19QPXgj1lvPKDbOMN2z_uK9pTLcd_loxoUP0GiJnplPNOx_9YRbq8Uk69XDacYsZoz58pDLIG59LeBC7UVqECOP97ChGgIHiqZVkqddcKt3feMQ",
+  "scope" : "openid email",
+  "token_type" : "Bearer"
 }
 ```
 
@@ -48,10 +48,10 @@ curl -X POST "http://localhost:3001/self/token" -H "Content-type: application/js
 
 ```json
 {
-   "access_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMjEtMDQtMTlUMTg6NDk6MTkuMzM2KzAwOjAwIn0.eyJpc3MiOiIkU0VSVkVSX1VSTCIsInN1YiI6ImF1dGgwfDVlNDcyYjJkOGE0MDllMGU2MjAyNjg1NiIsImF6cCI6InRlc3QtY2xpZW50MSIsInJvbGVzIjoidGVzdC1jbGllbnQxOnRlc3Qtcm9sZTEgdGVzdC1jbGllbnQxOnRlc3Qtcm9sZTIgIiwic2NvcGUiOiJ0ZXN0LXBlcm1pc3Npb24xIHRlc3QtcGVybWlzc2lvbjIgdGVzdC1wZXJtaXNzaW9uMyB0ZXN0LXBlcm1pc3Npb240IHRlc3QtcGVybWlzc2lvbjgiLCJleHAiOjE2MTg5NjA2MjEsImlhdCI6MTYxODk1NzAyMX0.XhkKZKF9ob23NcRwYUFd40DoSPMPu9r_ka_fM3boaAqp3i6J74oISjUN8ygWlMbYSZXXjdmvLsfyhbRIqBGO_oFTfiiJYSwVI7peGwDC-rsi6R3mapdMXDWwVsU5omtG4DO_k5TOS1jvQXKQSfXj-D2bNpDzYm0x121TXfE4ZLW1rf2TCNO29Smbm-BBp8xckvp8hq3-XrQG_BeRm2-EnpX5boYnQgHGad7mfjU1gAELx1ryiEwv5-9DgUgkEzAXQuFzGb0_7dob8WMLzsKVdORDj-Rm76mQHVO4OVbIPhn_R0xMXgUaZW80ksTdKagh01y-Y-hWdW62DRRFglyv6A",
-   "expires_in" : 3600,
-   "refresh_token" : "f697eabc-2d9d-47af-afc0-b186a83a983a",
-   "token_type" : "Bearer"
+  "access_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMjEtMDQtMTlUMTg6NDk6MTkuMzM2KzAwOjAwIn0.eyJpc3MiOiIkU0VSVkVSX1VSTCIsInN1YiI6ImF1dGgwfDVlNDcyYjJkOGE0MDllMGU2MjAyNjg1NiIsImF6cCI6InRlc3QtY2xpZW50MSIsInJvbGVzIjoidGVzdC1jbGllbnQxOnRlc3Qtcm9sZTEgdGVzdC1jbGllbnQxOnRlc3Qtcm9sZTIgIiwic2NvcGUiOiJ0ZXN0LXBlcm1pc3Npb24xIHRlc3QtcGVybWlzc2lvbjIgdGVzdC1wZXJtaXNzaW9uMyB0ZXN0LXBlcm1pc3Npb240IHRlc3QtcGVybWlzc2lvbjgiLCJleHAiOjE2MTg5NjA2MjEsImlhdCI6MTYxODk1NzAyMX0.XhkKZKF9ob23NcRwYUFd40DoSPMPu9r_ka_fM3boaAqp3i6J74oISjUN8ygWlMbYSZXXjdmvLsfyhbRIqBGO_oFTfiiJYSwVI7peGwDC-rsi6R3mapdMXDWwVsU5omtG4DO_k5TOS1jvQXKQSfXj-D2bNpDzYm0x121TXfE4ZLW1rf2TCNO29Smbm-BBp8xckvp8hq3-XrQG_BeRm2-EnpX5boYnQgHGad7mfjU1gAELx1ryiEwv5-9DgUgkEzAXQuFzGb0_7dob8WMLzsKVdORDj-Rm76mQHVO4OVbIPhn_R0xMXgUaZW80ksTdKagh01y-Y-hWdW62DRRFglyv6A",
+  "expires_in" : 3600,
+  "refresh_token" : "f697eabc-2d9d-47af-afc0-b186a83a983a",
+  "token_type" : "Bearer"
 }
 ```
 
@@ -77,12 +77,12 @@ curl -X GET "http://localhost:3001/self/permissions" -H "Content-type: applicati
 
 ```json
 {
-   "permission" : [
-      "test-permission1",
-      "test-permission2",
-      "test-permission3",
-      "test-permission4"
-   ]
+  "permission" : [
+    "test-permission1",
+    "test-permission2",
+    "test-permission3",
+    "test-permission4"
+  ]
 }
 ```
 
@@ -92,7 +92,7 @@ Notice from the decoded token above, The Usher's server name is not configured a
 
 Here's how to configure it manually:
 
-1. Take down the server using Ctrl-C or docker-compose down.
+1. Take down the server using Ctrl-C or `docker compose down`.
 1. List your docker containers with docker ps -a  and delete them docker rm ######
 
    ```sh
@@ -107,7 +107,7 @@ Here's how to configure it manually:
 
 1. Copy server/.env.sample to server/.env
 1. Add a line to configure the server url equal to your desired issuer:  `PRESET_SERVER_URL=http://dmgt-oocto.com`
-1. docker-compose up
+1. docker compose up
 
 Note you could ssh into the docker container using `docker exec -it [usher-server-Container-Id] sh` , edit the configuration, and re-launch it.
 
@@ -119,10 +119,10 @@ curl -X POST "http://localhost:3001/self/token" -H "Content-type: application/js
 
 ```json
 {
-   "access_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMjEtMDQtMTlUMTg6NDk6MTkuMzM2KzAwOjAwIn0.eyJpc3MiOiJodHRwOi8vZG1ndC1vb2N0by5jb20iLCJzdWIiOiJhdXRoMHw1ZTQ3MmIyZDhhNDA5ZTBlNjIwMjY4NTYiLCJhenAiOiJ0ZXN0LWNsaWVudDEiLCJyb2xlcyI6InRlc3QtY2xpZW50MTp0ZXN0LXJvbGUxIHRlc3QtY2xpZW50MTp0ZXN0LXJvbGUyICIsInNjb3BlIjoidGVzdC1wZXJtaXNzaW9uMSB0ZXN0LXBlcm1pc3Npb24yIHRlc3QtcGVybWlzc2lvbjMgdGVzdC1wZXJtaXNzaW9uNCB0ZXN0LXBlcm1pc3Npb244IiwiZXhwIjoxNjE4OTYyNDQzLCJpYXQiOjE2MTg5NTg4NDN9.t7m9KtbakZxrWD4ALuVk0UgmQuYv2SGgx8H9SyFsxX7fjAXvQMOJ7P91BUjNLYPGnBG5TCmO2oaC3PqNGiRDLMfKzUa0S9lrepdkf6zFTlL93ScEnFaxrJuKty3UVyk-iDP_2CC46gxu6ihIr28zDu73TawQQjzr1UT4LYhNOK9Zq7tGDHE8WZPuXitbzr4WlhxiXEXxr1D8R6FS6unpp0xCsOl-XKaRMUAVwERk5S3Cub1FFFKJrKJ22PwD4Uss8lQN0WyHlJ6zWlPvDf3TieNVlm1wsxaPTYDbEbbS6CKYMRotC0xRE0xbaggZ-wBEJWzH78ub5TyGMjhdG1FZ2Q",
-   "expires_in" : 3600,
-   "refresh_token" : "629fa7a8-3d73-4143-99ef-b7cf8bfd3291",
-   "token_type" : "Bearer"
+  "access_token" : "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjIwMjEtMDQtMTlUMTg6NDk6MTkuMzM2KzAwOjAwIn0.eyJpc3MiOiJodHRwOi8vZG1ndC1vb2N0by5jb20iLCJzdWIiOiJhdXRoMHw1ZTQ3MmIyZDhhNDA5ZTBlNjIwMjY4NTYiLCJhenAiOiJ0ZXN0LWNsaWVudDEiLCJyb2xlcyI6InRlc3QtY2xpZW50MTp0ZXN0LXJvbGUxIHRlc3QtY2xpZW50MTp0ZXN0LXJvbGUyICIsInNjb3BlIjoidGVzdC1wZXJtaXNzaW9uMSB0ZXN0LXBlcm1pc3Npb24yIHRlc3QtcGVybWlzc2lvbjMgdGVzdC1wZXJtaXNzaW9uNCB0ZXN0LXBlcm1pc3Npb244IiwiZXhwIjoxNjE4OTYyNDQzLCJpYXQiOjE2MTg5NTg4NDN9.t7m9KtbakZxrWD4ALuVk0UgmQuYv2SGgx8H9SyFsxX7fjAXvQMOJ7P91BUjNLYPGnBG5TCmO2oaC3PqNGiRDLMfKzUa0S9lrepdkf6zFTlL93ScEnFaxrJuKty3UVyk-iDP_2CC46gxu6ihIr28zDu73TawQQjzr1UT4LYhNOK9Zq7tGDHE8WZPuXitbzr4WlhxiXEXxr1D8R6FS6unpp0xCsOl-XKaRMUAVwERk5S3Cub1FFFKJrKJ22PwD4Uss8lQN0WyHlJ6zWlPvDf3TieNVlm1wsxaPTYDbEbbS6CKYMRotC0xRE0xbaggZ-wBEJWzH78ub5TyGMjhdG1FZ2Q",
+  "expires_in" : 3600,
+  "refresh_token" : "629fa7a8-3d73-4143-99ef-b7cf8bfd3291",
+  "token_type" : "Bearer"
 }
 ```
 

mockidentityprovider/package.json

@@ -23,7 +23,7 @@
     "helmet": "7.0.0",
     "helmet-csp": "3.4.0",
     "http-errors": "2.0.0",
-    "jsonwebtoken": "9.0.1",
+    "jsonwebtoken": "9.0.2",
     "moment": "2.29.4",
     "nodemon": "3.0.1",
     "pem-jwk": "2.0.0"

server/the-usher-openapi-spec.yaml

@@ -29,6 +29,8 @@ tags:
 #Default security scheme:
 security:
   - bearerSelfAuth: []
+  - bearerAdminAuth: []
+  - bearerClientAdminAuth: []
 
 paths:
   /:
@@ -446,6 +448,8 @@ paths:
             application/json:
               schema:
                 type: object
+        404:
+          $ref: '#/components/responses/NotFound'
 
   /clients/{client_id}/roles:
     parameters:
@@ -465,6 +469,8 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/CollectionOfRoles'
+        404:
+          $ref: '#/components/responses/NotFound'
     post:
       'x-swagger-router-controller': 'clients/roles'
       operationId: createClientRole
@@ -493,6 +499,8 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Role'
+        404:
+          $ref: '#/components/responses/NotFound'
 
   /sessions:
     delete: