Class ApiKeyAuthenticationService

java.lang.Object

com.svenruppert.jsentinel.authentication.ApiKeyAuthenticationService

@ExperimentalJSentinelApi
public final class ApiKeyAuthenticationService
extends Object

Authentication facade for long-lived API keys, sitting on top of an ApiKeyStore + PasswordHasher.

authenticate(plainKey) hashes the candidate with the PasswordHasher (the same shape works: hash(char[]) → String), looks the record up in the store, applies the lifecycle invariants (isActive) and:

• on success: updates lastUsedAt, publishes ApiKeyUsed, returns the record;
• on failure: publishes ApiKeyDenied with a short reason ("Unknown", "ForeignTenant", "Revoked", "Expired") and returns Optional.empty().

The caller (REST adapter / app code) reads the returned record's scopes and treats them as the permission set granted by the request. The framework does not narrow the subject's standing permissions further — scopes are the entire authorization surface of an API-key request.

Bound to one TenantId at construction. Multi-tenant deployments instantiate one service per tenant.

Constructor Summary

Constructors

Constructor	Description
ApiKeyAuthenticationService(ApiKeyStore store, PasswordHasher hasher, JSentinelAuditService auditService)	Convenience constructor: tenant TenantId.DEFAULT, system clock.
ApiKeyAuthenticationService(ApiKeyStore store, PasswordHasher hasher, JSentinelAuditService auditService, TenantId tenant, Clock clock)	Full constructor.

Method Summary

Modifier and Type	Method	Description
Optional<ApiKeyRecord>	authenticate(String plainKey)	Authenticates the supplied plain key.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ApiKeyAuthenticationService

public ApiKeyAuthenticationService(ApiKeyStore store,
 PasswordHasher hasher,
 JSentinelAuditService auditService)

Convenience constructor: tenant TenantId.DEFAULT, system clock.

Parameters:

store - API-key store; non-null

hasher - hasher used to hash plain keys for lookup; non-null

auditService - audit sink; non-null

ApiKeyAuthenticationService

public ApiKeyAuthenticationService(ApiKeyStore store,
 PasswordHasher hasher,
 JSentinelAuditService auditService,
 TenantId tenant,
 Clock clock)

Full constructor.

Parameters:

store - API-key store; non-null

hasher - hasher used to hash plain keys for lookup; non-null

auditService - audit sink; non-null

tenant - tenant scope; null becomes TenantId.DEFAULT

clock - time source; non-null

Method Details

authenticate

public Optional<ApiKeyRecord> authenticate(String plainKey)

Authenticates the supplied plain key.

Parameters:

plainKey - plain key value (from a header / cookie); null/blank yields empty

Returns:

active record on success, empty on every failure mode