Record Class ApiKeyRecord

java.lang.Object
java.lang.Record
com.svenruppert.jsentinel.authentication.ApiKeyRecord
Record Components:
keyHash - non-blank API-key hash
tenant - tenant scope; null becomes TenantId.DEFAULT
subjectId - subject that issued the key
name - non-blank human-readable label
scopes - immutable permission set the key grants; null becomes empty
createdAt - issuance instant
expiresAt - absolute expiry; if present must be strictly after createdAt; empty for keys without expiry
lastUsedAt - last successful authentication; if present must not predate createdAt
revokedAt - revocation instant; if present must not predate createdAt
@ExperimentalJSentinelApi public record ApiKeyRecord(String keyHash, TenantId tenant, SubjectId subjectId, String name, Set<PermissionName> scopes, Instant createdAt, Optional<Instant> expiresAt, Optional<Instant> lastUsedAt, Optional<Instant> revokedAt) extends Record
Persistent representation of a single long-lived API key.

Stores only the hash of the key; the plain value is shown to the user exactly once at creation time and never persisted. Each key carries its own scope set — usually a subset of the issuing subject's permissions, narrowed to the operations the key holder needs.

Lifecycle states reachable through the with… helpers:

  • fresh — lastUsedAt + revokedAt empty.
  • used — lastUsedAt present, revokedAt empty; isActive(Instant) still true.
  • revoked — revokedAt present; isActive(Instant) always false thereafter.
  • expired — expiresAt present and now >= expiresAt; isActive(Instant) also false.

  • Constructor Details

  • Method Details

    • withLastUsedAt

      public ApiKeyRecord withLastUsedAt(Instant at)
      Returns a copy with lastUsedAt() set to at.
      Parameters:
      at - instant the key was used; non-null
      Returns:
      new record

    • withRevokedAt

      public ApiKeyRecord withRevokedAt(Instant at)
      Returns a copy with revokedAt() set to at.
      Parameters:
      at - instant the key was revoked; non-null
      Returns:
      new record

    • isRevoked

      public boolean isRevoked()
      Whether revokedAt() is present.

    • isExpired

      public boolean isExpired(Instant now)
      Whether the key is expired at now. A key without an expiresAt() value never expires.
      Parameters:
      now - reference instant; non-null
      Returns:
      whether the key is expired

    • isActive

      public boolean isActive(Instant now)
      Whether the key is admissible at now — neither revoked nor expired.
      Parameters:
      now - reference instant; non-null
      Returns:
      whether the key can authenticate

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • keyHash

      public String keyHash()
      Returns the value of the keyHash record component.
      Returns:
      the value of the keyHash record component

    • tenant

      public TenantId tenant()
      Returns the value of the tenant record component.
      Returns:
      the value of the tenant record component

    • subjectId

      public SubjectId subjectId()
      Returns the value of the subjectId record component.
      Returns:
      the value of the subjectId record component

    • name

      public String name()
      Returns the value of the name record component.
      Returns:
      the value of the name record component

    • scopes

      public Set<PermissionName> scopes()
      Returns the value of the scopes record component.
      Returns:
      the value of the scopes record component

    • createdAt

      public Instant createdAt()
      Returns the value of the createdAt record component.
      Returns:
      the value of the createdAt record component

    • expiresAt

      public Optional<Instant> expiresAt()
      Returns the value of the expiresAt record component.
      Returns:
      the value of the expiresAt record component

    • lastUsedAt

      public Optional<Instant> lastUsedAt()
      Returns the value of the lastUsedAt record component.
      Returns:
      the value of the lastUsedAt record component

    • revokedAt

      public Optional<Instant> revokedAt()
      Returns the value of the revokedAt record component.
      Returns:
      the value of the revokedAt record component