Package co.ankatech.ankasecure.sdk.auth

Class SuppliedTokenSource

java.lang.Object
co.ankatech.ankasecure.sdk.auth.SuppliedTokenSource
All Implemented Interfaces:
TokenSource, AutoCloseable
public final class SuppliedTokenSource extends Object implements TokenSource
An ANKASecure access token the caller already holds, presented as a token source so that everything above TokenSource works identically whether the SDK obtained the token or was handed one.

This is not a credential kind and it takes no part in TokenSourceChain. It presents nothing and proves nothing: some other component - a sidecar, a broker, an outer application layer that authenticated once for many SDK instances - did the proving, and this simply carries the result. The SDK has always had that door open, in the constructor that accepts a manual access token; what it lacked was a way for the door to lead to the same place as every other one.

It cannot re-mint, and says so rather than pretending

There is no credential here to mint from. invalidate() therefore ends the session: the token is discarded, the transport is unbound, and the next call fails with a message that names the situation. The alternative - returning the same dead token forever - would turn one clear failure into an unbounded run of opaque 401s.

  • Constructor Summary

    Constructors
    Constructor
    Description
    SuppliedTokenSource(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient client, String token)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    String
    accessToken()
    Returns a token that is valid now, minting one if none is cached or the cached one is inside the refresh window, and binding whatever it returns to the transport.
    void
    close()
    Releases any credential this source retains for re-minting, and discards the cached token.
    void
    invalidate()
    Discards the cached token and unbinds it from the transport, so the next TokenSource.accessToken() mints a fresh one.
    AuthMechanism
    mechanism()
    Names the credential kind this source presents.
    String
    toString()
    The wrapper redacts; at most a six-character prefix of the token can appear.

    Methods inherited from class java.lang.Object

    equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface co.ankatech.ankasecure.sdk.auth.TokenSource

    currentTokenExpiry

  • Constructor Details

    • SuppliedTokenSource

      public SuppliedTokenSource(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient client, String token)
      Parameters:
      client - the transport to bind the token to
      token - the access token; copied, so the caller may keep or clear their own
      Throws:
      NullPointerException - if either argument is null
      IllegalArgumentException - if token is blank

  • Method Details

    • accessToken

      public String accessToken() throws AnkaSecureSdkException
      Description copied from interface: TokenSource
      Returns a token that is valid now, minting one if none is cached or the cached one is inside the refresh window, and binding whatever it returns to the transport.

      Concurrent callers of a stale source do not stampede the token endpoint: exactly one mints and the rest observe its result.

      Specified by:
      accessToken in interface TokenSource
      Returns:
      the ANKASecure access token; never null and never blank
      Throws:
      AnkaSecureSdkException - if a token cannot be obtained. A failure leaves any previously cached token untouched rather than poisoning the cache with the failure.

    • invalidate

      public void invalidate()
      Description copied from interface: TokenSource
      Discards the cached token and unbinds it from the transport, so the next TokenSource.accessToken() mints a fresh one.

      This is what a caller does on a 401 it did not expect. A token can be refused while still unexpired locally - revoked at logout, superseded by a revocation epoch, or invalidated by a role change - and the local exp claim cannot see any of that.

      Idempotent, and safe to call on a source that has never minted.

      Specified by:
      invalidate in interface TokenSource

    • close

      public void close()
      Description copied from interface: TokenSource
      Releases any credential this source retains for re-minting, and discards the cached token.

      Idempotent. Overridden to drop the checked exception AutoCloseable declares, so a try-with-resources over a token source needs no catch clause.

      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface TokenSource

    • mechanism

      public AuthMechanism mechanism()
      Description copied from interface: TokenSource
      Names the credential kind this source presents. Diagnostic only; nothing branches on it.
      Specified by:
      mechanism in interface TokenSource
      Returns:
      the mechanism; never null

    • toString

      public String toString()
      The wrapper redacts; at most a six-character prefix of the token can appear.
      Overrides:
      toString in class Object