Package org.apache.juneau.rest.server.mcp.v20260728

Class StaticKeyProvider

java.lang.Object
org.apache.juneau.rest.server.mcp.v20260728.StaticKeyProvider
All Implemented Interfaces:
KeyProvider
public final class StaticKeyProvider extends Object implements KeyProvider
Built-in, immutable, static-at-startup KeyProvider: an operator-supplied keyring of one or more AES keys, one of which is designated the current sealing key. Unlike EphemeralKeyProvider, the keyring is fixed at construction time (via StaticKeyProvider.Builder or of(String, SecretKey)) rather than generated randomly, so it can be shared across process instances — the fix for horizontally-scaled MRTR RESUME (see AeadRequestStateCodec).
Example:

KeyProvider kp = StaticKeyProvider.create() .addKey("2026-08-a", k1) .current("2026-08-a") .addKey("2026-07-z", kOld) .build(); // Or, for the common single-shared-key case: KeyProvider kp2 = StaticKeyProvider.of("2026-08-a", k1);

Since:
10.0.0

  • Method Details

    • create

      public static StaticKeyProvider.Builder create()
      Creates a new StaticKeyProvider.Builder.
      Returns:
      A new builder. Never null.

    • of

      public static StaticKeyProvider of(String keyId, SecretKey key)
      One-liner for the common single-shared-key case: a provider with exactly one key, designated current.
      Parameters:
      keyId - The key's identifier. Must not be null or blank.
      key - The key material. Must not be null.
      Returns:
      A new, immutable StaticKeyProvider holding just this one key. Never null.
      Throws:
      IllegalArgumentException - If keyId is null/blank or key is null.

    • aesKey

      public static SecretKey aesKey(byte[] value)
      Builds an AES SecretKey from raw key bytes.
      Parameters:
      value - The raw AES key bytes (16/24/32 bytes for AES-128/192/256). Must not be null.
      Returns:
      A new AES SecretKey wrapping value. Never null.

    • aesKey

      public static SecretKey aesKey(String base64)
      Builds an AES SecretKey from base64-encoded key bytes.
      Parameters:
      base64 - The base64-encoded AES key bytes. Must not be null or blank.
      Returns:
      A new AES SecretKey wrapping the decoded bytes. Never null.

    • currentKey

      public KeyedSecret currentKey()
      Description copied from interface: KeyProvider
      The key to seal new tokens with, together with its identifier.

      May return a different value over time — a changing return value is the sanctioned mechanism for live runtime key rotation in a custom provider. Built-in providers (EphemeralKeyProvider, StaticKeyProvider) return a fixed value for the lifetime of the instance.

      Specified by:
      currentKey in interface KeyProvider
      Returns:
      The current sealing key. Never null.

    • resolveKey

      public Optional<SecretKey> resolveKey(String keyId)
      Description copied from interface: KeyProvider
      Resolves a keyId seen on an incoming token to the key that sealed it.
      Specified by:
      resolveKey in interface KeyProvider
      Parameters:
      keyId - The key identifier read from the untrusted, client-supplied token, before decryption. Never null.
      Returns:
      The resolved key, or Optional.empty() if keyId is unknown or retired. Never throws.