Record Class OidcLoginState

java.lang.Object
java.lang.Record
io.fluxzero.idp.client.OidcLoginState
Record Components:
state - CSRF/correlation value sent to the authorization endpoint and checked on callback
codeVerifier - PKCE verifier kept by the BFF until token exchange
redirectTo - safe application-local URL to return to after the callback
expiresAt - expiry for this login attempt
public record OidcLoginState(String state, String codeVerifier, String redirectTo, Instant expiresAt) extends Record
Stateless BFF login transaction data for one OIDC Authorization Code + PKCE attempt.

The application stores this data client-side in an encrypted, authenticated cookie using OidcLoginStateCodec. That keeps callback handling independent from a specific BFF instance while preserving the usual OIDC checks: callback state correlation, PKCE verifier retention and short-lived expiry.

  • Constructor Details

    • OidcLoginState

      public OidcLoginState(String state, String codeVerifier, String redirectTo, Instant expiresAt)
      Creates an instance of a OidcLoginState record class.
      Parameters:
      state - the value for the state record component
      codeVerifier - the value for the codeVerifier record component
      redirectTo - the value for the redirectTo record component
      expiresAt - the value for the expiresAt record component

  • Method Details

    • create

      public static OidcLoginState create(String redirectTo, Duration timeToLive, Instant now)
      Creates a new login state expiring after the supplied time-to-live.
      Parameters:
      redirectTo - safe application-local URL to return to after login
      timeToLive - maximum lifetime for this login attempt
      now - current time
      Returns:
      new login state with random state and PKCE verifier

    • create

      public static OidcLoginState create(String redirectTo, Duration timeToLive)
      Creates a new login state using the system clock.

    • pkce

      public Pkce pkce()
      Returns the PKCE pair derived from the stored verifier.

    • matchesState

      public boolean matchesState(String callbackState)
      Returns true when the callback state matches this login attempt.

    • isExpired

      public boolean isExpired(Instant now)
      Returns true when this login attempt is expired at the supplied time.

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • state

      public String state()
      Returns the value of the state record component.
      Returns:
      the value of the state record component

    • codeVerifier

      public String codeVerifier()
      Returns the value of the codeVerifier record component.
      Returns:
      the value of the codeVerifier record component

    • redirectTo

      public String redirectTo()
      Returns the value of the redirectTo record component.
      Returns:
      the value of the redirectTo record component

    • expiresAt

      public Instant expiresAt()
      Returns the value of the expiresAt record component.
      Returns:
      the value of the expiresAt record component