Package org.apache.juneau.rest.server.mcp.v20260728

Class EphemeralKeyProvider

java.lang.Object
org.apache.juneau.rest.server.mcp.v20260728.EphemeralKeyProvider
All Implemented Interfaces:
KeyProvider
public class EphemeralKeyProvider extends Object implements KeyProvider
Built-in default KeyProvider: a random AES-256 key with a random keyId, both fixed for the lifetime of the instance.

Not restart-durable and not shareable across process instances by design — mirrors AeadRequestStateCodec's pre-KeyProvider ephemeral-key behavior exactly, including the cross-instance-unseal-fails guarantee (see AeadRequestStateCodec_Test's a06), just relocated one layer down. Operators who need cross-restart or multi-instance RESUME must supply StaticKeyProvider (or a custom KeyProvider) instead of relying on this default.

Since:
10.0.0

  • Constructor Details

    • EphemeralKeyProvider

      public EphemeralKeyProvider()
      Constructor. Generates a fresh, per-instance AES-256 key and a fresh, per-instance random keyId.

  • Method Details

    • currentKey

      public KeyedSecret currentKey()
      Description copied from interface: KeyProvider
      The key to seal new tokens with, together with its identifier.

      May return a different value over time — a changing return value is the sanctioned mechanism for live runtime key rotation in a custom provider. Built-in providers (EphemeralKeyProvider, StaticKeyProvider) return a fixed value for the lifetime of the instance.

      Specified by:
      currentKey in interface KeyProvider
      Returns:
      The current sealing key. Never null.

    • resolveKey

      public Optional<SecretKey> resolveKey(String keyId)
      Description copied from interface: KeyProvider
      Resolves a keyId seen on an incoming token to the key that sealed it.
      Specified by:
      resolveKey in interface KeyProvider
      Parameters:
      keyId - The key identifier read from the untrusted, client-supplied token, before decryption. Never null.
      Returns:
      The resolved key, or Optional.empty() if keyId is unknown or retired. Never throws.