Class OidcIntegration

java.lang.Object
io.fluxzero.idp.bff.OidcIntegration
All Implemented Interfaces:
io.fluxzero.common.Registration, AutoCloseable
public final class OidcIntegration extends Object implements io.fluxzero.common.Registration, AutoCloseable
Optional application HTTP integration. No Spring dependency or network/key access during registration.

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static final record 
    OidcIntegration.Capabilities
    No credentials or keys: the application supplies bounded signing and protected storage operations.

  • Method Summary

    Modifier and Type
    Method
    Description
    io.fluxzero.sdk.web.WebResponse
    backchannelLogout(io.fluxzero.sdk.web.WebRequest request)
    Expose the validated OP logout handler at an application-owned callback route.
    io.fluxzero.sdk.web.WebResponse
    callback(io.fluxzero.sdk.web.WebRequest request)
    Handles an application-owned callback route with the same state, PKCE, nonce and session checks.
    void
    cancel()
    Cancels only this integration; application handlers and the Fluxzero instance remain running.
    void
    close()
     
    static io.fluxzero.sdk.web.SocketSession
    protectSocket(io.fluxzero.sdk.web.SocketSession socket, io.fluxzero.sdk.web.WebRequest openingRequest)
    Wrap the SocketSession before retaining it for server pushes.
    static OidcIntegration
    register(io.fluxzero.sdk.Fluxzero fluxzero)
    Registers once for this Fluxzero instance.
    static OidcIntegration
    register(io.fluxzero.sdk.Fluxzero fluxzero, io.fluxzero.common.application.PropertySource properties)
    Explicit property source for composition; Spring delegates here with the SDK source taking precedence.
    static OidcIntegration
    register(io.fluxzero.sdk.Fluxzero fluxzero, io.fluxzero.common.application.PropertySource properties, OidcIntegration.Capabilities capabilities)
    Explicit application custody; ordinary consumers retain property/file configuration.
    static OidcUserProvider.Identity
    requireIdentity(io.fluxzero.sdk.web.WebRequest request)
    The current application's verified login identity; product authorization remains separate.
    static <T> T
    withResourceAccess(io.fluxzero.sdk.web.WebRequest request, io.fluxzero.idp.client.OidcClient.ResourceTokenRequest target, Function<BffSessionCoordinator.ResourceAccess, T> read)
    Access a product API with a per-request exchanged token.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface io.fluxzero.common.Registration

    merge

  • Method Details

    • register

      public static OidcIntegration register(io.fluxzero.sdk.Fluxzero fluxzero)
      Registers once for this Fluxzero instance. Its shutdown also cancels the registration.

    • register

      public static OidcIntegration register(io.fluxzero.sdk.Fluxzero fluxzero, io.fluxzero.common.application.PropertySource properties)
      Explicit property source for composition; Spring delegates here with the SDK source taking precedence.

    • register

      public static OidcIntegration register(io.fluxzero.sdk.Fluxzero fluxzero, io.fluxzero.common.application.PropertySource properties, OidcIntegration.Capabilities capabilities)
      Explicit application custody; ordinary consumers retain property/file configuration.

    • backchannelLogout

      public io.fluxzero.sdk.web.WebResponse backchannelLogout(io.fluxzero.sdk.web.WebRequest request)
      Expose the validated OP logout handler at an application-owned callback route.

    • callback

      public io.fluxzero.sdk.web.WebResponse callback(io.fluxzero.sdk.web.WebRequest request)
      Handles an application-owned callback route with the same state, PKCE, nonce and session checks.

    • withResourceAccess

      public static <T> T withResourceAccess(io.fluxzero.sdk.web.WebRequest request, io.fluxzero.idp.client.OidcClient.ResourceTokenRequest target, Function<BffSessionCoordinator.ResourceAccess, T> read)
      Access a product API with a per-request exchanged token. Unsafe requests require the original same-origin, CSRF-protected browser request. The callback must use protected in-process transport and return only the sanitized product result, never the credential or request headers. The application owns the configured resource and requested scopes; no browser-selected egress.

    • protectSocket

      public static io.fluxzero.sdk.web.SocketSession protectSocket(io.fluxzero.sdk.web.SocketSession socket, io.fluxzero.sdk.web.WebRequest openingRequest)
      Wrap the SocketSession before retaining it for server pushes. Each send checks the same shared BFF session, including request-driven refresh. No extra session store or scheduler.

    • requireIdentity

      public static OidcUserProvider.Identity requireIdentity(io.fluxzero.sdk.web.WebRequest request)
      The current application's verified login identity; product authorization remains separate.

    • cancel

      public void cancel()
      Cancels only this integration; application handlers and the Fluxzero instance remain running.
      Specified by:
      cancel in interface io.fluxzero.common.Registration

    • close

      public void close()
      Specified by:
      close in interface AutoCloseable