Class BffSessionCoordinator

java.lang.Object

io.fluxzero.idp.bff.session.BffSessionCoordinator

public final class BffSessionCoordinator
extends Object

Protected session access, with single-owner token refresh and no authorization decisions.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	BffSessionCoordinator.ResourceAccess	In-process only; the owning resource API still validates signature, audience, scopes and current grants.
static final record	BffSessionCoordinator.SessionAccess	In-process credential access, never a browser DTO or ordinary message.

Method Summary

Modifier and Type	Method	Description
Optional<BffSessionCoordinator.SessionAccess>	access(BrowserHandle cookie)	Empty means a fresh login is needed.
Optional<BffSessionCoordinator.SessionAccess>	access(BrowserHandle cookie, Duration refreshWait)	Waits only for another consumer's confirmed refresh; never retries an uncertain token exchange.
Optional<BffSessionCoordinator.ResourceAccess>	resourceAccess(BrowserHandle cookie, io.fluxzero.idp.client.OidcClient.ResourceTokenRequest request)	Exchanges only a current session's own credential.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

access

public Optional<BffSessionCoordinator.SessionAccess> access(BrowserHandle cookie)

Empty means a fresh login is needed. A live refresh claim or unavailable dependency is a distinct temporary failure. Neither outcome authorizes a resource request or claims logout. Token access belongs exclusively to the consuming protected in-process BFF adapter.

access

public Optional<BffSessionCoordinator.SessionAccess> access(BrowserHandle cookie,
 Duration refreshWait)

Waits only for another consumer's confirmed refresh; never retries an uncertain token exchange.

resourceAccess

public Optional<BffSessionCoordinator.ResourceAccess> resourceAccess(BrowserHandle cookie,
 io.fluxzero.idp.client.OidcClient.ResourceTokenRequest request)

Exchanges only a current session's own credential. Nothing is cached under a mutable tenant selection.