Package io.fluxzero.idp.client

package io.fluxzero.idp.client

Shared Fluxzero IDP client helpers for Fluxzero applications.

This module intentionally owns only the protocol-shaped pieces that are reusable for every Fluxzero application: tenant configuration, discovery, PKCE authorization-code exchange and JWT validation. For BFF flows, OidcLoginStateCodec can store the short-lived PKCE login transaction in an encrypted cookie so callbacks are not bound to a single backend instance. Application-specific user mapping remains outside this module. Applications are expected to keep their own SenderProvider or equivalent user provider because mapping an OIDC subject and claims to domain roles, aggregates and permissions is part of the customer domain.

The same application code should be able to run against the production Fluxzero IDP from src/main/java and against the local stub IDP from the test classpath. Token validation is therefore selected through ServiceLoader: the default validator verifies RS256 tokens through issuer discovery and JWKS, while tests can contribute a validator that trusts the in-process local stub signing key. The security invariants are the same in both cases: issuer, audience, token use, validity window and signature must all be checked.

Class	Description
FormCodec	Minimal form-url-encoding helper for OIDC endpoints.
JwksTokenValidator	Default Fluxzero OIDC token validator for RS256 JWTs exposed through a tenant JWKS endpoint.
JwtClaims	Normalized claims extracted from a validated OIDC JWT.
OidcClient	Small OIDC client for authorization-code-with-PKCE application flows.
OidcClient.TokenResponse	Raw token response returned by an OIDC tenant.
OidcClientCredentials	Credentials used by a confidential application when exchanging an authorization code.
OidcDiscovery	Fetches and caches OIDC discovery documents for configured issuers.
OidcDiscoveryDocument	OIDC discovery metadata used by Fluxzero application authentication helpers.
OidcLoginState	Stateless BFF login transaction data for one OIDC Authorization Code + PKCE attempt.
OidcLoginStateCodec	Encodes OidcLoginState into an encrypted, authenticated, cookie-safe value.
OidcTenantConfig	Tenant-specific OIDC settings for a Fluxzero application.
OidcTokenEndpointAuthMethod	Client authentication method used at the OIDC token endpoint.
Pkce	PKCE verifier and S256 challenge pair.
TokenValidationException	Runtime exception raised when OIDC token exchange, discovery, or validation fails.
TokenValidationRequest	Parameters for validating an ID or access token against a configured OIDC tenant.
TokenValidator	Strategy for validating OIDC JWTs.
TokenValidators	ServiceLoader-backed token validator selector.