Package org.apache.juneau.rest.client.mcp.auth

Class McpScopeAccumulator

java.lang.Object
org.apache.juneau.rest.client.mcp.auth.McpScopeAccumulator
public class McpScopeAccumulator extends Object
Computes and tracks the SEP-2350 step-up scope union — the set of scopes a client re-authorizes with after a server emits a per-operation insufficient_scope challenge.

The mandated minimum union (SEP-2350 "Step-Up Authorization Flow" step 2) is {previously-requested} ∪ {challenge scopes}, which preserves previously-granted permissions when servers emit per-operation challenges. union(Collection, Collection) computes exactly that. The broader overload union(Collection, Collection, Collection, Collection, Collection) additionally folds in the opt-in contributors the spec permits a client to consult (granted-token scopes, cached PRM scopes_supported, and client-metadata scope) — supplying them widens the union; omitting them keeps the default at the mandated minimum.

The union is order-preserving (LinkedHashSet) with exact-string dedup only — scopes are opaque strings, so repo and repo:read are both retained (no hierarchy-aware dedup client-side; hierarchy reasoning is the server's MUST).

As an instance, this class also maintains per-(resource, issuer) accumulated state so a step-up driver can carry the growing union across successive challenges for the same resource/AS. Thread-safe.

Since:
10.0.0

  • Constructor Details

  • Method Details

    • union

      public static Set<String> union(Collection<String> previouslyRequested, Collection<String> challengeScopes)
      Computes the mandated-minimum step-up union: previouslyRequested ∪ challengeScopes, order-preserving with exact-string dedup.
      Parameters:
      previouslyRequested - The scope set the client previously requested (may be null / empty).
      challengeScopes - The scopes from the server's insufficient_scope challenge (may be null / empty).
      Returns:
      A new order-preserving union set. Never null.

    • union

      public static Set<String> union(Collection<String> previouslyRequested, Collection<String> challengeScopes, Collection<String> grantedTokenScopes, Collection<String> prmScopesSupported, Collection<String> clientMetadataScope)
      Computes the broadened step-up union, folding in the opt-in contributors the SEP-2350 Scope Selection Strategy permits a client to consult. Order-preserving; exact-string dedup. Any null contributor is treated as empty.
      Parameters:
      previouslyRequested - The scope set the client previously requested.
      challengeScopes - The scopes from the server's insufficient_scope challenge.
      grantedTokenScopes - The scopes on the currently-held token (opt-in).
      prmScopesSupported - The cached PRM scopes_supported (opt-in).
      clientMetadataScope - The scope declared in client metadata (opt-in).
      Returns:
      A new order-preserving union set. Never null.

    • seed

      public McpScopeAccumulator seed(URI resource, URI issuer, Collection<String> previouslyRequested)
      Seeds the accumulated state for a (resource, issuer) key with the client's previously-requested scopes, unioning into any existing entry for that key rather than replacing it.

      Unioning (not overwriting) matters when a shared accumulator is seeded more than once for the same key — e.g. two builds against one shared accumulator, or a re-seed after some challenge scopes were already accumulated — so no previously-tracked scope is ever lost.

      Parameters:
      resource - The RFC 8707 resource indicator. Must not be null.
      issuer - The authorization server issuer. Must not be null.
      previouslyRequested - The previously-requested scopes. May be null / empty.
      Returns:
      This object.

    • accumulate

      public Set<String> accumulate(URI resource, URI issuer, Collection<String> challengeScopes)
      Unions the given challenge scopes into the accumulated state for the (resource, issuer) key and returns the updated union.
      Parameters:
      resource - The RFC 8707 resource indicator. Must not be null.
      issuer - The authorization server issuer. Must not be null.
      challengeScopes - The scopes from the latest insufficient_scope challenge. May be null / empty.
      Returns:
      A copy of the updated accumulated union for the key. Never null.

    • current

      public Set<String> current(URI resource, URI issuer)
      Returns a copy of the currently-accumulated union for the (resource, issuer) key.
      Parameters:
      resource - The RFC 8707 resource indicator. Must not be null.
      issuer - The authorization server issuer. Must not be null.
      Returns:
      A copy of the current accumulated union (empty if the key was never seeded/accumulated).