Class FluxzeroIdpStub

java.lang.Object
io.fluxzero.idp.testsupport.localstub.FluxzeroIdpStub
All Implemented Interfaces:
AutoCloseable
@NoUserRequired @ServeStatic(value="/login", resourcePath="classpath:/local-stub-idp", fallbackFile="login.html", maxAgeSeconds=0) public class FluxzeroIdpStub extends Object implements AutoCloseable
In-memory OIDC tenant used by Fluxzero applications during local development tests.

The stub exposes the same high-level contract as a real Fluxzero IDP tenant: discovery, JWKS, authorization-code-with-PKCE, token exchange, userinfo and logout. The difference is the trust boundary. Each JVM run creates a fresh RSA signing key, keeps session/code state in memory and carries the short-lived login request in a signed cookie, so tokens are only meaningful for the current local process.

Keep this class tenant-shaped. It should help application code exercise the real BFF login flow without depending on a live production IDP, not provide shortcuts that bypass issuer, audience, token-use, temporal or signature validation.

The login ceremony accepts a single local username and emits that value as the token subject. Application code remains responsible for mapping that subject to a domain user, so tests can pre-create users such as user, admin or manager and then sign in with the same value.

  • Constructor Details

    • FluxzeroIdpStub

      public FluxzeroIdpStub()

  • Method Details

    • currentIssuer

      public static Optional<String> currentIssuer()
      Returns the active local issuer without implicitly creating stub state.
      Returns:
      local issuer when the stub has been initialized

    • reset

      public static void reset()
      Clears the shared local signing key and all in-memory login state.

    • appBaseUrl

      public String appBaseUrl()

    • issuer

      public String issuer()

    • clientId

      public String clientId()

    • redirectUri

      public String redirectUri()

    • resourceAudience

      public String resourceAudience()

    • tenantId

      public String tenantId()

    • scope

      public String scope()

    • clear

      public void clear()

    • close

      public void close()
      Specified by:
      close in interface AutoCloseable

    • verifyToken

      public io.fluxzero.idp.client.JwtClaims verifyToken(io.fluxzero.idp.client.TokenValidationRequest request)
      Verifies a token that was signed by this local stub.

      This mirrors the production validation invariants while using the in-memory signing key instead of issuer JWKS discovery. It is meant for test-classpath validators only.

      Parameters:
      request - expected issuer, audience, token use and clock
      Returns:
      normalized claims from a valid local stub token