Package io.fluxzero.idp.bff.session
package io.fluxzero.idp.bff.session
-
ClassDescriptionProtected, in-process authorization-code flow above the eventless application-session Models.Explicit access belongs only to the protected cookie/redirect adapter, never ordinary serialization.Tokens remain server-side. csrf may be exposed only to the authenticated same-origin browser.A consumed, denied or invalid login requires a fresh attempt; dependency failures are separate.Local application logout and session-required back-channel logout.Invalid logout evidence; contains no token, identifier or dependency failure details.Protected session access, with single-owner token refresh and no authorization decisions.In-process only; the owning resource API still validates signature, audience, scopes and current grants.In-process credential access, never a browser DTO or ordinary message.Identity and browser mutation proof only; no ID, access or refresh token is exposed.A 256-bit opaque browser capability.Cookie/CSRF policy shared by application BFFs; it never establishes identity or authorization.File input for the shared AES-256-GCM implementation.AES-256-GCM session protection with a lazily supplied, application-scoped key ring.Reusable application-session lifecycle, independent of IDP management, tenants and user mapping.In-process value only.The session mutation did not report a confirmed commit.Workload-owned authenticated encryption.Authenticated ciphertext and a non-secret key version.Fail-closed custody failure; no provider message, plaintext or key detail escapes this boundary.Another request owns refresh.