Package org.apache.juneau.rest.client.mcp.auth

Class EphemeralStore

java.lang.Object

org.apache.juneau.rest.client.mcp.auth.EphemeralStore

public class EphemeralStore
extends Object

Single-use, TTL-bounded store for the per-authorization state → (codeVerifier, expectedIssuer) association created when an interactive authorization-code + PKCE flow is started and consumed when the loopback redirect arrives.

Relocation of the EphemeralStore pattern from juneau-rest-server-auth-oidc-rp for headless (CLI/desktop) use. The browser-session redirectTarget/nonce shape is dropped; this headless variant stores the PKCE code_verifier and the discovered expectedIssuer used for the SEP-2468 iss check on the callback.

Security properties:

• Single-use — consume(String) atomically removes the entry, so a replayed callback with the same state fails.
• TTL-bounded — entries older than the configured TTL are treated as a miss and swept.
• Size-bounded — an LRU cap (default 1000) prevents unbounded growth from abandoned attempts.

Thread-safe.

Since:

10.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	EphemeralStore.PendingAuthorization	A pending-authorization association awaiting the IdP loopback callback.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_MAX_ENTRIES	Default maximum number of in-flight authorization attempts retained.
static final Duration	DEFAULT_TTL	Default time-to-live for a pending authorization (the user has at most a few minutes at the IdP).

Constructor Summary

Constructors

Constructor	Description
EphemeralStore(Duration ttl, int maxEntries, Clock clock)	Constructor.

Method Summary

Modifier and Type	Method	Description
Optional<EphemeralStore.PendingAuthorization>	consume(String state)	Atomically removes and returns the pending-authorization association for state, if present and not expired.
static EphemeralStore	create()	Creates a store with the default TTL, size cap, and system UTC clock.
int	size()	Returns the current entry count.
void	store(String state, String codeVerifier, URI expectedIssuer)	Stores a pending-authorization association keyed by state.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_MAX_ENTRIES

public static final int DEFAULT_MAX_ENTRIES

Default maximum number of in-flight authorization attempts retained.

See Also:

• Constant Field Values

DEFAULT_TTL

public static final Duration DEFAULT_TTL

Default time-to-live for a pending authorization (the user has at most a few minutes at the IdP).

Constructor Details

EphemeralStore

public EphemeralStore(Duration ttl,
 int maxEntries,
 Clock clock)

Constructor.

Parameters:

ttl - The single-use TTL. Must be positive and not exceed 30 minutes.

maxEntries - The LRU size cap. Must be positive.

clock - The clock for TTL comparisons. Must not be null.

Method Details

create

public static EphemeralStore create()

Creates a store with the default TTL, size cap, and system UTC clock.

Returns:

A new store.

store

public void store(String state,
 String codeVerifier,
 URI expectedIssuer)

Stores a pending-authorization association keyed by state.

Parameters:

state - The opaque state value. Must not be null or blank.

codeVerifier - The PKCE code_verifier. Must not be null or blank.

expectedIssuer - The discovered issuer for the SEP-2468 iss check. May be null.

consume

public Optional<EphemeralStore.PendingAuthorization> consume(String state)

Atomically removes and returns the pending-authorization association for state, if present and not expired.

Parameters:

state - The state value from the callback. Must not be null.

Returns:

The association, or Optional.empty() if absent or expired.

size

public int size()

Returns the current entry count. Primarily for tests and metrics.

Returns:

The entry count.