All Classes and Interfaces
Class
Description
Adapter-neutral attempt context passed into
AbuseDetectionService.evaluate(AbuseAttemptContext) and
AbuseDetectionService.recordOutcome(AbuseAttemptContext, AttemptOutcome).Categories of credential-sensitive operations the
AbuseDetectionService tracks independently.Progressive reaction returned by
AbuseDetectionService.evaluate(AbuseAttemptContext).The attempt may proceed unconditionally.
Refuse the attempt.
Honour the attempt but pause for
delay first — a soft
brake that slows automated scanners without locking the user
out.Require step-up authentication / captcha / additional check
before the attempt may proceed.
Multi-dimensional abuse detection contract.
Counter dimension used by
AbuseDetectionService.Per-dimension and per-attempt-type limits consumed by
InMemoryAbuseDetectionService.Single sliding-window limit definition.
Named patterns detectable by the
AbusePatternMonitor.Higher-level abuse-pattern detector that sits next to the
AbuseDetectionService.Tunables for the three pattern detectors.
Privacy-minimised signal emitted by an
AbusePatternMonitor detector when a pattern crosses its
threshold.Vaadin-free context for access evaluation.
Vaadin-free result of an authorization-phase evaluation.
Access is granted.
Access is denied and should redirect to a target route.
Access is denied and should reroute to an error page.
Access is denied and should reroute with one route parameter.
Access is denied and should reroute with multiple route parameters.
Access to a protected route or endpoint was refused.
Thrown when an in-process security guard refuses an action because the
current subject lacks the required role or permission.
Evaluates whether the current subject has access to a route target.
A subject was granted access to a protected route or endpoint.
SPI for fine-grained action checks.
A guarded action call was denied — the subject did not satisfy the
required
ActionPermission.Stable, typed identifier for a fine-grained business action.
Application-side seam used by
InitialAdminBootstrapService to
answer "is anyone an administrator?"Pairs a restriction annotation instance with the
evaluator class declared via
JSentinelAnnotation.Opaque API key.
Authentication facade for long-lived API keys, sitting on top of
an
ApiKeyStore + PasswordHasher.Emitted when an API-key authentication was refused — unknown
key, expired, revoked, or in a foreign tenant.
Persistent representation of a single long-lived API key.
Persistent store for
ApiKeyRecords — backs the planned
API-key authentication flow (V00.70 Phase 7b).Emitted when an API-key was successfully used to authenticate a
request — i.e.
Outcome of an attempt, fed back to
AbuseDetectionService.recordOutcome(AbuseAttemptContext, AttemptOutcome) so the counters can
react.Persisted form of an
AuditEvent.Sealed root of the typed security audit event hierarchy.
Persistent counterpart to
AuditSink.Filter passed to
JSentinelAuditService.query(...).Write-only destination for
AuditEvents.SPI contract for credential validation and subject loading.
Semantic adapter-neutral authorization decision.
A subject is available but lacks the required authority.
Access is granted.
A subject is authenticated but a step-up challenge is required
before access can be granted.
No authenticated subject is available.
Evaluates access and returns a semantic adapter-neutral decision.
Maps a user subject to its authorization data.
Opaque bearer token, typically carried as
Authorization: Bearer <value>.The first administrator was successfully created via the bootstrap flow.
Bootstrap configuration record.
Loads
BootstrapConfiguration from system properties and environment
variables.Operating mode of the first-run bootstrap mechanism.
One-shot startup orchestrator.
Persistent first-run-bootstrap state for one tenant.
Single source of truth for "is the system uninitialized?".
Persistent store for
BootstrapState per tenant.Adapter-neutral, leak-safe view of the bootstrap state.
One-time bootstrap token.
Generates fresh
BootstrapTokens using SecureRandom and a
32-character ambiguity-free alphabet (drops O 0 I 1).Tells the operator how to obtain the current bootstrap token.
A bootstrap-token submission was rejected.
Storage for the current bootstrap token.
The login attempt policy locked a username/client because it crossed a
failure threshold.
Reproducible calibration result for a single password-hash algorithm.
Dependency-free file-based load/save of
CalibrationProfile.Operator-configured behaviour when a
CompromisedPasswordChecker returns
CompromisedPasswordResult.CheckFailed.JSentinelAuditService that fans every published event out to:
a primary RingBufferAuditSink used as the query backend, and
zero or more additional AuditSinks (logging, file, SIEM, …).
Every sink runs independently — a failing extra sink does not stop the
fan-out and never causes publish(...) to throw.SPI for compromised-password lookups.
Operator-controlled policy that governs when the compromised
password check runs and how a failed check is interpreted.
Sealed result of a
CompromisedPasswordChecker call.The checker could not produce a verdict — network outage,
malformed response, timeout, etc.
The candidate password is not present in the checker's data
source.
Structured failure reason — never carries password material,
URLs or response bodies.
The candidate password matched a known compromised entry.
Prints a one-time setup banner with the actual bootstrap token to the
server console.
Context-aware password validator that wraps the structural
PasswordInputValidator with the checks the Konzept §14
mandates: a password must not contain its user's username, the
local part of their email, the email domain, or any of the
operator-supplied forbidden terms (CWE-521 / CWE-287).Predicate factories that branch on fields of the wrapped
AccessContext
— the operation name, the resource type, and the adapter-provided
attribute map.Command consumed by
InitialAdminBootstrapService.createInitialAdmin(CreateInitialAdminCommand).Translates
CredentialVerificationResults into the new
credential audit events and pushes them through
JSentinelAuditService.Backend-neutral sink for
CredentialMetricEvents.Adapter-neutral decision derived from a credential's current
lifecycle status.
Permanent block (typically
COMPROMISED or DISABLED).Temporary block (typically
LOCKED).Credentials verified, but the user must change the password before
the session may proceed.
Normal login allowed.
A reset token is outstanding for this credential.
Owns the lifecycle of stored credentials and the rules for moving
between
CredentialStatus values.Sealed family of data-minimised metric events emitted by
security-core.
Abuse pattern detector fired.
One
PasswordHashingService.hash call completed.The KDF execution limiter shed an inbound verification.
A credential moved between lifecycle states.
A successful verification triggered a transparent rehash.
One
PasswordHashingService.verify call completed.Persisted credential row, returned by
CredentialStore reads
and used as the compare-and-swap witness on writes.A successful verification triggered a transparent rehash of the
stored credential.
Lifecycle state of a stored credential.
Credential lifecycle status transitioned from
fromStatus to
toStatus.Persistence-neutral credential store.
Discriminating metadatum for the credential subsystem introduced with
version
00.71.00.Outcome of a compare-and-swap update against the
CredentialStore.No record existed under the supplied username.
The witness did not match the persisted record.
The CAS succeeded;
newRecord is the value now stored.Failed password verification, carrying the internal differentiated
classification so audit sinks can distinguish unknown user from
wrong password, broken envelope, missing provider or rejected pepper
key.
Structured outcome of a credential verification.
Verification did not succeed.
Successful verification.
Successful password verification, recorded by the credential audit
publisher so audit sinks see the same outcome the
LoginAttemptPolicy recorded.No-arg
JSentinelAuditService suitable for META-INF/services
registration.Reference
DummyVerificationService.Reference
PasswordHashingService.Thrown by
DefaultPasswordHashingService.hash(char[]) when the limiter is saturated.Reference
PasswordHashPolicy backed by explicit, immutable
maps.Mutable assembler.
Reference
PasswordHashValidator.In-memory
TenantAwarePasswordHashPolicyResolver that
stores a global default plus optional per-tenant overrides.In-memory
TenantAwarePepperReferenceResolver.Why the verification pipeline took the dummy KDF path.
Performs a comparable KDF run when the verification pipeline cannot
proceed against the supplied envelope (unknown user, malformed
envelope, missing provider, unknown pepper key).
Emitted when an email-verification token is issued for a subject /
email pair.
Email-verification workflow over an
EmailVerificationTokenStore.Tuple returned from
request: the plain token
(caller forwards it via the notification sender) and the
persisted record (handy for tests / audit hooks).Persistent representation of a single email-verification token.
Persistent store for
EmailVerificationTokenRecords —
backs the planned email-verification workflow (V00.70 Phase 7).Emitted when an email-verification token is consumed and the
email is considered verified.
Operator-declared, time-bounded credential emergency override.
Structured incident category.
Marks a type or method as part of the experimental security API.
Tells the operator that the token has been written to a file.
File-backed token store for
BootstrapMode.PERSISTENT_FILE.Operator-declared FIPS operating profile.
Provides the set of permission names assigned to a subject.
Provides the set of role names assigned to a subject.
Result of an
OutboundTokenStrategy — a single HTTP header
the consumer's HTTP client applies before sending.Single-entry orchestrator that converts a
CreateInitialAdminCommand
into either a freshly created administrator or a non-leaking failure
code.In-memory reference implementation of
AbuseDetectionService.In-memory
ApiKeyStore backed by a
LinkedHashMap so InMemoryApiKeyStore.listBySubject(TenantId, SubjectId)
preserves insertion order.In-memory
AuditEventStore backed by a single tenant-scoped
list.In-memory token store used by
BootstrapMode.TRANSIENT_CONSOLE.In-memory
CredentialStore backed by
ConcurrentHashMap, suitable for tests, demos and small
single-node deployments.In-memory
EmailVerificationTokenStore backed by a
ConcurrentHashMap keyed on the token hash.In-memory
JSentinelVersionStore backed by a
ConcurrentHashMap.In-memory
LoginAttemptPolicy suitable for single-node demos
and small deployments.In-memory
LoginAttemptStore backed by a single
ConcurrentHashMap.In-memory
PasswordResetTokenStore backed by a
ConcurrentHashMap keyed on the token hash.In-process pepper key store for tests, demos and small single-node
deployments.
Thread-safe in-memory
PolicyRegistry.Default
RateLimitPolicy backed by a RateLimitStore.In-memory
RateLimitStore backed by a per-key
ConcurrentLinkedDeque of timestamps.In-memory
RefreshTokenStore backed by a
ConcurrentHashMap.In-memory
RememberMeTokenStore backed by a
ConcurrentHashMap keyed on the token hash.Thread-safe in-memory
ResourceResolverRegistry backed by a
ConcurrentHashMap.In-memory
RoleAssignmentStore backed by a
ConcurrentHashMap.In-memory
SessionStore backed by a
LinkedHashMap so InMemorySessionStore.findBySubject(TenantId, SubjectId)
returns insertion-ordered results.In-memory
SubjectSessionRegistry suitable for single-node
deployments and demos.Single-slot in-memory store.
Differentiated, internal-only classification of credential verification
outcomes.
Thrown by
CredentialLifecycleService.transition(String, CredentialStatus, CredentialStatus, String) when the
requested transition is not part of the configured state machine.This annotation is to be placed on other annotations, marking them as restriction-annotations and
assigning evaluator classes to them.
Scans annotated elements for
JSentinelAnnotation-meta-annotated
restriction annotations and resolves the corresponding evaluator class.Read/write facade for security audit events.
Central enforcement entry point shared by the
SecuredProxy dynamic-proxy path in security-standalone
and the wrapper classes generated by the security-processor
annotation processor.Adapter-neutral notification payload handed to a
JSentinelNotificationSender.Notification category — one per lifecycle hook.
Account-lifecycle notification dispatcher.
Pre-built policies for the most common access-control patterns.
Central resolver for security-related SPI services.
Reduced security identity used for access decisions.
Monotonically-increasing version of a subject's security-relevant
state (roles, permissions, password, …).
Adapter-neutral security-version drift detector.
Adapter-neutral enforcement layer on top of
JSentinelVersionCheck.Sealed outcome of an
JSentinelVersionEnforcer.enforce(SubjectId, TenantId, JSentinelVersion, String, String) call.The request continues — versions match.
The request must be refused — session security version no
longer matches.
Composite key under which
JSentinelVersionStore tracks the
current JSentinelVersion of a subject.Result of a
JSentinelVersionCheck.check(JSentinelVersionKey, JSentinelVersion) call against a
session snapshot.Session is still current — its snapshot matches the subject's
stored version.
Session has drifted — its snapshot differs from the subject's
stored version.
Persistent counter store for
JSentinelVersion per
JSentinelVersionKey.Bounds the number of KDF invocations that may run concurrently.
Permit handle.
Resource budget for the
KdfExecutionLimiter.Offline
CompromisedPasswordChecker backed by an operator-
supplied blocklist.Default
JSentinelNotificationSender that writes a single
INFO line per notification — useful for demos and tests that
need lifecycle flows to complete without a real mail provider.Tunable thresholds for
InMemoryLoginAttemptPolicy and any
other LoginAttemptPolicy that wants the same vocabulary.Loads
LoginAttemptConfiguration from system properties and
environment variables, with a caller-supplied default.Adapter-neutral input to a
LoginAttemptPolicy decision.The attempt may proceed.
The caller is locked out.
Composite key under which
LoginAttemptStore tracks
failed-attempt counters and the last failure instant.Policy that throttles repeated failed login attempts.
Persistent counter store for the
LoginAttemptPolicy family.A login attempt was rejected — credentials wrong, account unknown, or
blocked by an upstream policy.
Credentials were accepted and the subject is now authenticated.
Consumer-side callback for
LogoutService events.A subject's session was terminated by an explicit logout.
Scope of a logout request.
Bundles the logout flow so callers do not have to manually orchestrate
subject removal, session invalidation and navigation.
Operational helper for incident response: bulk-transition every
named credential into a single target status (typically
CredentialStatus.MUST_CHANGE or
CredentialStatus.COMPROMISED).Aggregate report of a mass status change.
Trivial password policy that only enforces a minimum length.
Result of a navigation security decision.
The subject exists but lacks the required roles or permissions.
Navigation is allowed.
The user is already logged in but is navigating to the login page.
The route is restricted and no subject is in the session.
Pure decision service for navigation security.
Vaadin-free context for making navigation security decisions.
Carrier record handed to
AdministratorAccountStore.createAdministrator(NewAdministrator).Limiter that never blocks and never rejects.
Default
CompromisedPasswordChecker for deployments that
deliberately operate without external breach data.Default
CredentialJSentinelMetrics that records nothing.Default
JSentinelAuditService — discards every event and never
retains anything.Default
LoginAttemptPolicy — never throttles, never records.Default
LogoutService — discards every call.Phase-1a placeholder for
PepperService.Default
RoleHierarchy: a held role implies only itself.Default
SessionPolicy — every navigation continues, login and
logout do nothing.OIDC access token.
Filters
SecuredOperationDescriptors against a JSentinelSubject.Input record for
OutboundTokenStrategy.resolve(OutboundCall, java.util.Optional).Thread-local bridge between the V00.74 wrapper (runtime
PropagatingProxy or compile-time <Type>Propagating)
and the application's HTTP client.Pluggable "how does the inbound token reach the downstream call" SPI.
Produces a
CalibrationProfile for a specific algorithm by
running the underlying KDF and measuring its runtime.Default
OutboundTokenStrategy — forwards a bearer-style
inbound token as Authorization: Bearer <value>.The current lifecycle status forbids credential changes (e.g.
A concurrent password change won the compare-and-swap race.
Re-authentication failed — the supplied current password does not
verify (CWE-620).
The new password violated the input policy (length, control chars,
etc.) and was rejected before hashing.
No credential exists under the supplied username.
Password successfully changed.
Atomic, policy-driven password change.
Adapter-neutral user / application context consumed by the
ContextAwarePasswordValidator.Typed representation of a stored password hash.
Self-describing envelope codec for Phase-1a password-hash strings.
Parsed view of a self-describing password-hash envelope.
Password hashing abstraction.
Thrown by
PasswordHashCodec when the supplied input cannot be
parsed as a valid Phase-1a envelope.Known envelope wire-format versions.
Front-door facade for the Phase-1a password hashing and verification
pipeline.
Wiring helpers for the Phase-1a
PasswordHashingService.Algorithm-specific validator for a
parameters map carried by a
password-hash envelope.Lookup of
PasswordHashParameterValidators by algorithm
identifier.Active password-hashing policy.
Service-provider contract for a concrete password hashing
implementation.
Lookup of
PasswordHashProviders by stored envelope metadata.Pair of an encoded envelope string and its parsed counterpart.
Immutable result of a password-hashing operation.
Thrown by
PasswordHashValidator when a structurally well-formed
envelope is rejected by the active PasswordHashPolicy.Validates a parsed envelope against the active policy before
a KDF is executed.
The candidate password did not match any retained historical
entry — proceed.
The candidate password matched one of the retained historical
verifiers and must be rejected.
Single archived password verifier — the full envelope as it was
stored at the time.
Opt-in password-history policy.
Coordinates the optional password-history check.
Persistence-neutral storage of historical password verifiers.
Operator-configurable input hygiene rules for password material.
Structured outcome of
PasswordInputValidator.validate(SecretValue, PasswordInputPolicy).Checks password input against the
PasswordInputPolicy.Reason that input was rejected by the
PasswordInputValidator.Normalises password material under the active
PasswordInputPolicy so that two equivalent Unicode
representations of the same characters compare equal across
hash/verify (CWE-176).Validates a candidate password against the minimum acceptance rules.
Emitted when a password-reset token is consumed and the password
has been replaced.
Emitted when a password-reset token is issued for a subject.
Password-reset workflow over a
PasswordResetTokenStore.Password reset core service.
Tuple returned from
request: the plain token
(caller forwards it to the user via the notification sender)
and the persisted record (handy for tests / audit hooks).Persistent representation of a single password-reset token.
Persistent store for
PasswordResetTokenRecords — backs the
planned password-reset workflow (V00.70 Phase 7).Phase-1a reference parameters for the PBKDF2 password hashing path.
Calibrates the PBKDF2-HMAC-SHA-256 iteration count for a target
verification runtime.
Stable parameter-key constants used by the PBKDF2 envelope.
Parameter validator for the Phase-1a PBKDF2 algorithm.
PBKDF2-HMAC-SHA256 hasher using only JDK APIs.
JDK/JCA-only PBKDF2 password hash provider.
Applies the optional post-KDF pepper as
HMAC-SHA-256(pepperKey, kdfOutput).Control-flow exception for pepper-application failures.
Resolved pepper material handed to a
PasswordHashProvider.Resolves the pepper material associated with a stored pepper key id.
Extension of
AuthorizationService that requires permission
support.Base implementation for permission-based access evaluation.
Application-provided catalog of known permissions.
Stateless permission/role checks.
Generic permission matching helper.
Wrapper for a permission name string.
Named, single-shot authorisation rule.
Fluent builder for
Policy instances.Input to a
Policy evaluation.Outcome of a
Policy evaluation.Access is permitted.
Access is denied.
Step-up mechanism a policy may ask for.
Subject is authenticated but a step-up challenge is required before
access can be granted.
Bridge from the policy-specific
PolicyDecision sealed hierarchy
down to the adapter-neutral AuthorizationDecision contract used
by the existing AuthorizationEvaluator pipeline.A named
Policy was evaluated against a PolicyContext.Lookup + evaluation SPI for named policies.
Marker for client interfaces / methods whose outbound HTTP call must
carry a
PropagateTokenAdvisor-resolved header (typically the
Bearer token of the current subject, optionally exchanged via
TokenExchangeStrategy).Pluggable advisor that turns a
PropagateToken-annotated call
+ the current TokenCredential into an HeaderValue to
bind on the outbound HTTP request.Stateless default advisor: looks up the strategy by
PropagateToken.strategy() via
JSentinelServiceResolver.findOutboundTokenStrategy(String),
calls its resolve with the store's current credential, and
— when PropagateToken.header() is non-empty — overrides the
strategy's chosen header name.Delegates evaluation to a project-provided
AuthorizationEvaluator.Evaluates
ProtectedBy by delegating to the evaluator declared on the
annotation instance.Provider-level outcome of running a KDF and comparing the derived
material against the stored inner hash.
Generic, public-facing failure classification used by UI- and API-near
layers to react to a denied credential verification.
Result of a
RateLimitPolicy.tryAcquire(RateLimitKey) call.The event was admitted; the caller proceeds.
The event was refused — the per-window count is already at or
above the configured limit.
Emitted by
RateLimitPolicy.tryAcquire when an event was
refused because the per-key event count within the configured
window equals or exceeds the limit.Composite key under which
RateLimitStore tracks event
timestamps for sliding-window rate-limiting.Pluggable rate-limiting decision point — separate from
LoginAttemptPolicy (which is purpose-built for password-guessing
detection) and from
SessionPolicy (which is about session lifetime).Persistent event store for sliding-window rate-limiting policies
(V00.70 Phase 7c).
Refresh token.
Persistent representation of a single rotating refresh token.
Persistent store for
RefreshTokenRecords — backs the
planned rotating-refresh-token flow (V00.70 Phase 7b).Whether a successfully verified credential should be transparently
rehashed under the currently active policy.
Computes whether a successfully verified envelope must be
transparently rehashed under the active policy.
Concrete reason that causes a stored credential to be flagged for
transparent rehashing on the next successful verification.
Persistent representation of a single "remember me" token.
Persistent store for
RememberMeTokenRecords — backs the
planned "remember me" / persistent-login flow (V00.70 Phase 7).Requires the current subject to hold all listed
permissions (AND-semantics).
Generic evaluator for
RequiresAllPermissions — AND-semantics
across the listed permissions.Requires the current subject to hold at least one
of the listed permissions (OR-semantics).
Generic evaluator for
RequiresAnyPermission — OR-semantics
across the listed permissions.Requires the current subject to have all listed permissions.
Generic evaluator for
RequiresPermission.Requires the named
Policy (registered with the resolved
PolicyRegistry) to Allow the current request.Bridges
RequiresPolicy into the existing
AuthorizationEvaluator pipeline.Requires the current subject to have at least one listed role.
Generic evaluator for
RequiresRole.Outcome of
PasswordResetService.issue(String, Duration).Returned token.
Persisted password-reset token.
Lifecycle of a stored password-reset token.
Persistence-neutral storage of password-reset tokens.
Composite of an adapter-neutral
AccessContext and the
concrete ResourceRef the request is about.Coarse resource estimate produced by a
PasswordHashProvider
for a given parameter set.Predicate factories that branch on the
ResourceRef carried
by a PolicyContext.Stable reference to a concrete protected resource — the domain
object an admission rule wants to reason about (a document, a user,
a project, …).
Application-provided adapter that materialises a
ResourceRef into a domain object and exposes the attributes
a policy might want to reason about (owner id, status, …).Lookup of
ResourceResolvers by resource type and one-shot
ResourceResolverRegistry.resolveAttributes(ResourceRef) pipeline for policy
predicates.Bounded in-memory ring buffer of
AuditEvents.A role was assigned to a subject by an administrator action.
Composite key under which
RoleAssignmentStore tracks the
set of roles assigned to a subject.Persists the role assignments of every subject, keyed on
RoleAssignmentKey.Base implementation for role-based access evaluation.
Contract for role-based access evaluators.
Application-provided role inheritance graph.
Generic role matching helper.
Wrapper for a role name string.
Application-provided mapping from roles to permissions.
Merges role-to-permission lookups for a set of roles.
A role was revoked from a subject by an administrator action.
Short-lived container for password / pepper / token material.
Compile-time trigger for the
security-processor annotation
processor.Adapter-neutral description of a secured operation.
Registry of
SecuredOperationDescriptors, looked up by id.Two-part token used for password-reset, email-verification and
remember-me flows.
KdfExecutionLimiter backed by a fair Semaphore.Adapter-neutral session view for the
SessionPolicy.A new session was opened for a subject (typically after successful login).
Outcome of a
SessionPolicy.beforeNavigation(SessionContext)
decision.The navigation may proceed unchanged.
The session must be invalidated.
The subject must re-authenticate.
A session was ended by the policy because it crossed an inactivity or
absolute-lifetime threshold.
Adapter-neutral instruction returned after a successful password
change.
Strongly-typed identifier of an authenticated session.
A session was forcibly invalidated by application or framework code
(rotation after login, role change, password reset, admin action).
Adapter-neutral query input for
SessionPolicy.evaluate(SessionMetadata).Pluggable session policy.
Outcome of
SessionPolicy.evaluate(SessionMetadata).The session is older than the configured absolute lifetime.
The session may continue.
The session was idle longer than the configured idle timeout.
Persistent representation of a single authenticated session.
Emitted when a request was refused because the session's
security-version snapshot no longer matches the subject's
current version.
Lifecycle state of a
SessionRecord.Store for
SessionRecords, keyed on SessionId.Default
ActionAuthorizationService that checks an
ActionPermission against the subject's permission set obtained
via the configured AuthorizationService.Immutable, programmatically-built
RoleHierarchy.Fluent builder for
StaticRoleHierarchy.Static, immutable
RolePermissionMapping.An adapter challenged the subject for a step-up authentication —
either via an HTTP
401 + WWW-Authenticate response (REST) or
by rerouting to a configured step-up route (Vaadin).Bootstrap-state service backed by a
BootstrapStateStore.JSentinelAuditService that persists events through an
AuditEventStore (Phase 2).LoginAttemptPolicy that stores its failure counters in a
LoginAttemptStore."Remember me" / persistent-login service built on top of a
RememberMeTokenStore and a PasswordHasher.Tuple returned from
StoreBackedRememberMeService.issue(SubjectId, Duration): the plain token (caller
passes it to the client carrier and drops it) and the
persisted record (handy for tests / audit hooks).AuthorizationService that looks roles up in a
RoleAssignmentStore.SubjectSessionRegistry that stores its
(subject, sessionId) associations as full
SessionRecords in a SessionStore.Adapter-neutral default
LogoutService implementation.Strongly-typed wrapper around the application's stable subject
identifier.
Predicate factories that branch on the
JSentinelSubject carried
by a PolicyContext.Tracks active sessions per
SubjectId.Abstraction for storing and retrieving the current security subject (user).
Resolver for the active
SubjectStore.SPI that resolves the
PasswordHashPolicy for a given
TenantCredentialContext.SPI that resolves the active
PepperReference for a
tenant context.Tenant scope of an in-flight credential operation.
Identifier for the tenant scope of a security decision.
Marker for
TokenCredentialStore implementations that are safe
to use from multiple threads.Minimal
SessionPolicy with idle timeout, absolute lifetime, and
optional session-id rotation after login.Tunable thresholds.
Sealed type for inbound / outbound tokens flowing through the V00.74
token-propagation pipeline.
Persistence-neutral store for the current subject's
TokenCredential.Persisted half of a
SelectorVerifierToken: the non-secret
selector plus the digest of the verifier.Selector/verifier token issuance and verification.
Emitted when a refresh-token rotation succeeded — the old token
was consumed and a fresh access + refresh pair was issued.
Access + rotating refresh token issuance on top of a
RefreshTokenStore.The supplied token's selector does not match the stored digest's
selector.
A new user account was added to the directory.
A user account was removed from the directory.
Successful output of
PasswordHashValidator.validate(PasswordHashEnvelope, PasswordHashPolicy).