Package org.apache.juneau.rest.server.mcp.v20260728

Record Class KeyedSecret

java.lang.Object
java.lang.Record
org.apache.juneau.rest.server.mcp.v20260728.KeyedSecret
Record Components:
keyId - An opaque, operator-chosen short identifier for key (e.g. "2026-08-a"). Must not be null or blank, and is length-bounded so a sealed token's cleartext keyId wire segment (see AeadRequestStateCodec's versioned wire format) stays bounded.
key - The key material. Must not be null. The AEAD codec is AES-GCM-specific by design, so non-AES key material fails at cipher-init time in AeadRequestStateCodec, not here.
public record KeyedSecret(String keyId, SecretKey key) extends Record
A key paired with the identifier an operator chose for it, as returned by KeyProvider.currentKey() and resolved by KeyProvider.resolveKey(String).

Never log key. Mirrors RequestStateCodec's "never log" contract for the sealed token: this record holds the actual sealing key, so toString() deliberately redacts key rather than relying on the record's auto-generated form, which would print whatever a custom/HSM SecretKey impl's own toString() legally chooses to include.

Since:
10.0.0

  • Constructor Summary

    Constructors
    Constructor
    Description
    KeyedSecret(String keyId, SecretKey key)
    Compact constructor — validates keyId is non-null/non-blank/length-bounded and key is non-null.

  • Method Summary

    Modifier and Type
    Method
    Description
    final boolean
    equals(Object o)
    Indicates whether some other object is "equal to" this one.
    final int
    hashCode()
    Returns a hash code value for this object.
    SecretKey
    key()
    Returns the value of the key record component.
    String
    keyId()
    Returns the value of the keyId record component.
    String
    toString()
    Redacts key so key material never reaches logs via this record's toString().

    Methods inherited from class java.lang.Object

    clone, finalize, getClass, notify, notifyAll, wait, wait, wait

  • Constructor Details

    • KeyedSecret

      public KeyedSecret(String keyId, SecretKey key)
      Compact constructor — validates keyId is non-null/non-blank/length-bounded and key is non-null.

  • Method Details

    • toString

      public String toString()
      Redacts key so key material never reaches logs via this record's toString().
      Specified by:
      toString in class Record

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • keyId

      public String keyId()
      Returns the value of the keyId record component.
      Returns:
      the value of the keyId record component

    • key

      public SecretKey key()
      Returns the value of the key record component.
      Returns:
      the value of the key record component