All Classes and Interfaces
Class
Description
Accepted signed logout identity; only hashes, never the token or raw issuer/client/sid/jti.
Protected, in-process authorization-code flow above the eventless application-session Models.
Explicit access belongs only to the protected cookie/redirect adapter, never ordinary serialization.
Tokens remain server-side. csrf may be exposed only to the authenticated same-origin browser.
A consumed, denied or invalid login requires a fresh attempt; dependency failures are separate.
Local application logout and session-required back-channel logout.
Invalid logout evidence; contains no token, identifier or dependency failure details.
Protected session access, with single-owner token refresh and no authorization decisions.
In-process only; the owning resource API still validates signature, audience, scopes and current grants.
In-process credential access, never a browser DTO or ordinary message.
Identity and browser mutation proof only; no ID, access or refresh token is exposed.
A 256-bit opaque browser capability.
Cookie/CSRF policy shared by application BFFs; it never establishes identity or authorization.
Verifies public routing context without making Edge a requirement for direct requests.
Only digests and public routing context; never headers, cookies or bearer credentials.
File input for the shared AES-256-GCM implementation.
Explicit Fluxzero claim view over an already verified OIDC user.
External identity coordinates; they do not grant application roles or permissions.
Application mapper opting into Fluxzero-specific claims.
AES-256-GCM session protection with a lazily supplied, application-scoped key ring.
Reusable application-session lifecycle, independent of IDP management, tenants and user mapping.
Spring Boot entry point.
Optional application HTTP integration.
No credentials or keys: the application supplies bounded signing and protected storage operations.
Bounded return navigation for an app embedded in a deployment-approved shell.
Import this configuration in plain Spring; Spring Boot discovers it automatically.
Verified identity from any configured OIDC issuer.
Maps a verified session identity to the application's current User, including its own roles and account status.
Resolves browser requests through the registered
OidcIntegration.Claims from the validated ID token in the encrypted session; never implied application roles.
Explicit unencrypted persistence only.
A hashed issuer/client/sid binding, including a terminal logout fence; never an identity session.
In-process value only.
The session mutation did not report a confirmed commit.
Local deterministic transitions only.
Replay identity and exact RP fence share one commit; external verification already completed.
Workload-owned authenticated encryption.
Authenticated ciphertext and a non-secret key version.
Fail-closed custody failure; no provider message, plaintext or key detail escapes this boundary.
Another request owns refresh.