Class BffLoginCoordinator

java.lang.Object

io.fluxzero.idp.bff.session.BffLoginCoordinator

public final class BffLoginCoordinator
extends Object

Protected, in-process authorization-code flow above the eventless application-session Models. Not a handler or HTTP endpoint. The caller owns protected ingress, exact egress/custody policy, rate limits and cookie responses. No Runtime transport, signer or validator fallback is selected. The access token remains opaque: each resource call must independently enforce its audience, current identity and grants. This class does not establish management authorization.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	BffLoginCoordinator.LoginRedirect	Explicit access belongs only to the protected cookie/redirect adapter, never ordinary serialization.
static final record	BffLoginCoordinator.SessionOpened	Tokens remain server-side. csrf may be exposed only to the authenticated same-origin browser.

Constructor Summary

Constructors

Constructor	Description
BffLoginCoordinator(io.fluxzero.idp.client.OidcTenantConfig config, io.fluxzero.idp.client.OidcDiscoveryDocument metadata, io.fluxzero.idp.client.OidcTransport transport, io.fluxzero.idp.client.OidcClientAuthentication authentication, Set<String> signingAlgorithms, ModelBffSessionStore sessions, Duration loginLifetime, Duration sessionLifetime)
BffLoginCoordinator(io.fluxzero.idp.client.OidcTenantConfig config, io.fluxzero.idp.client.OidcDiscoveryDocument metadata, io.fluxzero.idp.client.OidcTransport transport, io.fluxzero.idp.client.OidcClientAuthentication authentication, Set<String> signingAlgorithms, ModelBffSessionStore sessions, Duration loginLifetime, Duration sessionLifetime, Duration renewalWindow)

Method Summary

Modifier and Type	Method	Description
BffLoginCoordinator.LoginRedirect	begin(String requestedReturnPath)
BffLoginCoordinator.LoginRedirect	begin(String requestedReturnPath, String redirectUri)	Saves the trusted per-login callback and reuses it verbatim during code exchange.
BffLoginCoordinator.LoginRedirect	begin(String requestedReturnPath, String redirectUri, Map<String,String> parameters)
BffLoginCoordinator.SessionOpened	callback(BrowserHandle cookie, BrowserHandle state, String code, String error, String issuer)	HTTP must reject duplicate parameters before calling.
BffLogoutCoordinator	logoutLifecycle()	Logout shares the same configured issuer, verifier and application-session store.
BffSessionCoordinator	sessionLifecycle()	Session access/refresh uses exactly the login's protocol trust boundary and application store.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

BffLoginCoordinator

public BffLoginCoordinator(io.fluxzero.idp.client.OidcTenantConfig config,
 io.fluxzero.idp.client.OidcDiscoveryDocument metadata,
 io.fluxzero.idp.client.OidcTransport transport,
 io.fluxzero.idp.client.OidcClientAuthentication authentication,
 Set<String> signingAlgorithms,
 ModelBffSessionStore sessions,
 Duration loginLifetime,
 Duration sessionLifetime)

BffLoginCoordinator

public BffLoginCoordinator(io.fluxzero.idp.client.OidcTenantConfig config,
 io.fluxzero.idp.client.OidcDiscoveryDocument metadata,
 io.fluxzero.idp.client.OidcTransport transport,
 io.fluxzero.idp.client.OidcClientAuthentication authentication,
 Set<String> signingAlgorithms,
 ModelBffSessionStore sessions,
 Duration loginLifetime,
 Duration sessionLifetime,
 Duration renewalWindow)

Method Details

begin

public BffLoginCoordinator.LoginRedirect begin(String requestedReturnPath)

begin

public BffLoginCoordinator.LoginRedirect begin(String requestedReturnPath,
 String redirectUri)

Saves the trusted per-login callback and reuses it verbatim during code exchange.

begin

public BffLoginCoordinator.LoginRedirect begin(String requestedReturnPath,
 String redirectUri,
 Map<String,String> parameters)

sessionLifecycle

public BffSessionCoordinator sessionLifecycle()

Session access/refresh uses exactly the login's protocol trust boundary and application store.

logoutLifecycle

public BffLogoutCoordinator logoutLifecycle()

Logout shares the same configured issuer, verifier and application-session store.

callback

public BffLoginCoordinator.SessionOpened callback(BrowserHandle cookie,
 BrowserHandle state,
 String code,
 String error,
 String issuer)

HTTP must reject duplicate parameters before calling. No code exchange occurs before a matching transaction's consume is confirmed. Every later failure requires a new login. Storage/custody/dependency-unavailable exceptions intentionally propagate separately.