Package org.apache.juneau.rest.auth.oauth.flow

Record Class OAuthToken

java.lang.Object

java.lang.Record

org.apache.juneau.rest.auth.oauth.flow.OAuthToken

Record Components:

accessToken - The opaque or JWT access-token string. Never null.

tokenType - The token type per RFC 6749 §5.1 (typically "Bearer"). Never null.

expiresAt - The instant at which the access token expires. May be Instant.MAX when the IdP returned no expires_in.

refreshToken - The refresh token, if the IdP issued one.

scope - The granted scopes, if the IdP returned a scope field.

idToken - The OIDC ID token (a JWT), if the flow scope included openid. Not validated — see idToken().

public record OAuthToken(String accessToken, String tokenType, Instant expiresAt, Optional<String> refreshToken, Optional<Set<String>> scope, Optional<String> idToken)
extends Record

Immutable record returned by every OAuth 2.0 flow helper on a successful token acquisition.

Never log accessToken / refreshToken / idToken. toString() redacts the secret-bearing fields so token material never reaches logs via this record's auto-generated form.

Since:

10.0.0

Constructor Summary

Constructors

Constructor	Description
OAuthToken(String accessToken, String tokenType, Instant expiresAt, Optional<String> refreshToken, Optional<Set<String>> scope, Optional<String> idToken)	Compact constructor enforcing non-null fields.

Method Summary

Modifier and Type	Method	Description
String	accessToken()	Returns the value of the accessToken record component.
final boolean	equals(Object o)	Indicates whether some other object is "equal to" this one.
Instant	expiresAt()	Returns the value of the expiresAt record component.
final int	hashCode()	Returns a hash code value for this object.
Optional<String>	idToken()	The OIDC ID token (a JWT), if the flow scope included openid.
boolean	isExpired(Instant now, Duration skew)	Returns whether the token is past its expiration instant relative to the supplied clock.
Optional<String>	refreshToken()	Returns the value of the refreshToken record component.
Optional<Set<String>>	scope()	Returns the value of the scope record component.
String	tokenType()	Returns the value of the tokenType record component.
String	toString()	Redacts the secret-bearing fields so token material never reaches logs via this record's toString().

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Details

OAuthToken

public OAuthToken(String accessToken,
 String tokenType,
 Instant expiresAt,
 Optional<String> refreshToken,
 Optional<Set<String>> scope,
 Optional<String> idToken)

Compact constructor enforcing non-null fields.

Method Details

isExpired

public boolean isExpired(Instant now,
 Duration skew)

Returns whether the token is past its expiration instant relative to the supplied clock.

Parameters:

now - The reference instant (typically Clock.instant()).

skew - Skew tolerance (subtracted from expiresAt). Must be non-negative.

Returns:

true if now >= expiresAt - skew.

idToken

public Optional<String> idToken()

The OIDC ID token (a JWT), if the flow scope included openid.

SECURITY CAVEAT: this ID token is returned verbatim and is NOT validated by the flow helpers — its signature and its iss / aud / exp / nonce claims are not checked. Callers MUST NOT trust its claims for authentication or authorization decisions without performing full IDTokenValidator-based verification first.

Returns:

The raw ID token, or an empty Optional if the IdP issued none.

toString

public String toString()

Redacts the secret-bearing fields so token material never reaches logs via this record's toString().

Specified by:

toString in class Record

Returns:

A redacted string form disclosing only non-secret metadata.

hashCode

public final int hashCode()

Returns a hash code value for this object. The value is derived from the hash code of each of the record components.

Specified by:

hashCode in class Record

Returns:

a hash code value for this object

equals

public final boolean equals(Object o)

Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).

Specified by:

equals in class Record

Parameters:

o - the object with which to compare

Returns:

true if this object is the same as the o argument; false otherwise.

accessToken

public String accessToken()

Returns the value of the accessToken record component.

Returns:

the value of the accessToken record component

tokenType

public String tokenType()

Returns the value of the tokenType record component.

Returns:

the value of the tokenType record component

expiresAt

public Instant expiresAt()

Returns the value of the expiresAt record component.

Returns:

the value of the expiresAt record component

refreshToken

public Optional<String> refreshToken()

Returns the value of the refreshToken record component.

Returns:

the value of the refreshToken record component

scope

public Optional<Set<String>> scope()

Returns the value of the scope record component.

Returns:

the value of the scope record component