Package co.ankatech.ankasecure.sdk.auth

Class FileExternalTokenProvider

java.lang.Object
co.ankatech.ankasecure.sdk.auth.FileExternalTokenProvider
All Implemented Interfaces:
ExternalTokenProvider
public final class FileExternalTokenProvider extends Object implements ExternalTokenProvider
Reads an externally minted token from a file the operator named.

This is the ordinary shape of workload identity on a platform that already solves it: a projected service-account token on Kubernetes, a sidecar's output, an agent that refreshes a credential on a timer. Something else owns minting and refreshing; the SDK's job is to read the current contents at the moment it needs them.

Re-read on every mint, never cached

The file is the source of truth precisely because an external agent rewrites it. A provider that read it once would hold a token that expires while a perfectly fresh one sits on disk - and the resulting failure looks like a revoked credential rather than a stale read.

The path comes from configuration and from nothing else

It is fixed when this provider is constructed and cannot be changed afterwards. Nothing the server returns reaches it. That is not incidental: a path a response could steer would let whoever controls the response choose which of the caller's files gets read and posted.

  • Constructor Details

    • FileExternalTokenProvider

      public FileExternalTokenProvider(Path path)
      Parameters:
      path - the file holding the external token; captured as an absolute path at construction
      Throws:
      NullPointerException - if path is null

  • Method Details

    • fetchExternalToken

      public SecretChars fetchExternalToken()
      Description copied from interface: ExternalTokenProvider
      Produces the current external token.

      How current it is belongs to the implementation, and the two answers are both correct for their case. A provider that READS an out-of-band token re-reads on every call, because something else refreshes it and a copy held here is a copy that expires without anyone noticing. A provider that OBTAINS the token itself knows the lifetime its issuer stated for it, so it may reuse one inside that lifetime - and when the issuer states no lifetime, it falls back to fetching per call rather than guessing one.

      Specified by:
      fetchExternalToken in interface ExternalTokenProvider
      Returns:
      the token; the caller takes ownership and closes it

    • kind

      public ExternalTokenSourceKind kind()
      Description copied from interface: ExternalTokenProvider
      Which of the configured source kinds this provider is, or null for a consumer-supplied provider that is none of them.
      Specified by:
      kind in interface ExternalTokenProvider
      Returns:
      the kind, or null when the provider is the consumer's own

    • describe

      public String describe()
      Description copied from interface: ExternalTokenProvider
      A short operator-facing description of WHERE the token comes from - a path, a command name, an issuer - for diagnostics. It must never contain the token.
      Specified by:
      describe in interface ExternalTokenProvider
      Returns:
      the description; never null

    • toString

      public String toString()
      The path is the diagnostic an operator needs and is not itself a secret.
      Overrides:
      toString in class Object

    • path

      public Path path()
      The file this provider reads. Exposed so a containment check can assert that the path a running SDK actually uses is the configured one.
      Returns:
      the absolute path; never null