Package io.fluxzero.idp.bff.session
package io.fluxzero.idp.bff.session
-
ClassDescriptionProtected, in-process authorization-code flow above the eventless application-session Models.Explicit access belongs only to the protected cookie/redirect adapter, never ordinary serialization.Tokens remain server-side. csrf may be exposed only to the authenticated same-origin browser.A consumed, denied or invalid login requires a fresh attempt; dependency failures are separate.Local application logout and session-required back-channel logout.Invalid logout evidence; contains no token, identifier or dependency failure details.Protected session access, with single-owner token refresh and no authorization decisions.In-process credential access, never a browser DTO or ordinary message.A 256-bit opaque browser capability.Cookie/CSRF policy shared by application BFFs; it never establishes identity or authorization.AES-256-GCM session protection with a lazily supplied, application-scoped key ring.Reusable application-session lifecycle, independent of IDP management, tenants and user mapping.In-process value only.The session mutation did not report a confirmed commit.Workload-owned authenticated encryption.Only authenticated ciphertext and a non-secret key version may enter either Model document.Fail-closed custody failure; no provider message, plaintext or key detail escapes this boundary.Another request owns refresh.