services/src/main/java/org/keycloak/protocol/oidc/grants/PermissionGrantTypeFactory.java (1)

38-41: Inconsistent: use a GRANT_SHORTCUT constant for the shortcut value.

Other factories in this PR (e.g., CibaGrantTypeFactory) define public static final String GRANT_SHORTCUT = "ci" and reference it from getShortcut(). This factory returns a string literal directly. Using a constant enables test code and encoding logic to reference the shortcut symbolically (e.g., PermissionGrantTypeFactory.GRANT_SHORTCUT).

Proposed fix

 public class PermissionGrantTypeFactory implements OAuth2GrantTypeFactory {
 
+    public static final String GRANT_SHORTCUT = "pg";
+
     `@Override`
     public String getId() {
         return OAuth2Constants.UMA_GRANT_TYPE;
     }
 
     `@Override`
     public String getShortcut() {
-        return "pg";
+        return GRANT_SHORTCUT;
     }

services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantTypeFactory.java (1)

40-43: Same as other factories: extract a GRANT_SHORTCUT constant for consistency.

See the comment on PermissionGrantTypeFactory — the same pattern applies here.

Proposed fix

 public class TokenExchangeGrantTypeFactory implements OAuth2GrantTypeFactory, EnvironmentDependentProviderFactory {
 
+    public static final String GRANT_SHORTCUT = "te";
+
     `@Override`
     public String getId() {
         return OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE;
     }
 
     `@Override`
     public String getShortcut() {
-        return "te";
+        return GRANT_SHORTCUT;
     }

services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantTypeFactory.java (1)

38-41: Same pattern: extract a GRANT_SHORTCUT constant.

Consistent with CibaGrantTypeFactory and the recommendations on the other factories.

Proposed fix

 public class ResourceOwnerPasswordCredentialsGrantTypeFactory implements OAuth2GrantTypeFactory {
 
+    public static final String GRANT_SHORTCUT = "ro";
+
     `@Override`
     public String getId() {
         return OAuth2Constants.PASSWORD;
     }
 
     `@Override`
     public String getShortcut() {
-        return "ro";
+        return GRANT_SHORTCUT;
     }

services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantTypeFactory.java (1)

38-41: Consider extracting "cc" to a public static final constant for consistency.

This factory currently returns a string literal while other similar factories (AuthorizationCodeGrantTypeFactory, RefreshTokenGrantTypeFactory, CibaGrantTypeFactory, DeviceGrantTypeFactory) define a GRANT_SHORTCUT constant. The constant pattern is particularly useful since tests reference these shortcuts (e.g., AssertEvents.java uses them for token assertions).

♻️ Suggested change

 public class ClientCredentialsGrantTypeFactory implements OAuth2GrantTypeFactory {
 
+    public static final String GRANT_SHORTCUT = "cc";
+
     `@Override`
     public String getId() {
         return OAuth2Constants.CLIENT_CREDENTIALS;
     }
 
     `@Override`
     public String getShortcut() {
-        return "cc";
+        return GRANT_SHORTCUT;
     }

services/src/test/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderTest.java (1)

53-62: Assert.assertEquals parameter order is swapped throughout.

JUnit's assertEquals convention is (expected, actual). All assertions in this class have them reversed (e.g., Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.TRANSIENT) puts actual first). This won't break tests but produces confusing failure messages like "expected TRANSIENT but was ONLINE" instead of "expected ONLINE but was TRANSIENT".

♻️ Example fix for one test (apply same pattern to all)

-        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.TRANSIENT);
-        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.LIGHTWEIGHT);
-        Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.CLIENT_CREDENTIALS);
-        Assert.assertEquals(ctx.getRawTokenId(), "1234");
+        Assert.assertEquals(AccessTokenContext.SessionType.TRANSIENT, ctx.getSessionType());
+        Assert.assertEquals(AccessTokenContext.TokenType.LIGHTWEIGHT, ctx.getTokenType());
+        Assert.assertEquals(OAuth2Constants.CLIENT_CREDENTIALS, ctx.getGrantType());
+        Assert.assertEquals("1234", ctx.getRawTokenId());

services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderFactory.java (1)

41-42: Package-private fields grantsByShortcuts and grantsToShortcuts are directly mutated by tests.

These fields are accessed and overwritten in DefaultTokenContextEncoderProviderTest.before(). While functional for same-package tests, this tightly couples tests to internal state. Consider adding package-private setter methods or a test-only constructor to make the intent clearer.