Record Class RefreshTokenRecord

java.lang.Object
java.lang.Record
com.svenruppert.jsentinel.authentication.RefreshTokenRecord
Record Components:
tokenHash - non-blank token hash
tenant - tenant scope; null becomes TenantId.DEFAULT
subjectId - subject the token authenticates
createdAt - issuance instant
expiresAt - absolute expiry, strictly after createdAt
replacedByHash - hash of the successor token, empty until the first rotation
revokedAt - revocation instant, empty until revoked
@ExperimentalJSentinelApi public record RefreshTokenRecord(String tokenHash, TenantId tenant, SubjectId subjectId, Instant createdAt, Instant expiresAt, Optional<String> replacedByHash, Optional<Instant> revokedAt) extends Record
Persistent representation of a single rotating refresh token.

Hash-only; the plain value is handed to the client exactly once when issued and is presented back on every token-rotation request. Rotation works like this:

  1. Issue refresh token A. replacedByHash empty.
  2. Client presents A, server issues access token + new refresh token B. A is updated with replacedByHash = hash(B); B starts with replacedByHash empty.
  3. If A is ever presented again after step 2, it has replacedByHash set — that is the signal that someone replayed an already-rotated token. The auth flow should revoke the entire chain (the implementation handles that; this record only carries the link).

  • Constructor Details

  • Method Details

    • withReplacedBy

      public RefreshTokenRecord withReplacedBy(String successorHash)
      Returns a copy linking this record to its successor.
      Parameters:
      successorHash - hash of the new token; non-blank
      Returns:
      new record with replacedByHash set

    • withRevokedAt

      public RefreshTokenRecord withRevokedAt(Instant at)
      Returns a copy marked revoked at at.
      Parameters:
      at - revocation instant; non-null
      Returns:
      new record with revokedAt set

    • isRevoked

      public boolean isRevoked()
      Whether revokedAt() is present.

    • isReplaced

      public boolean isReplaced()
      Whether replacedByHash() is present.

    • isExpired

      public boolean isExpired(Instant now)
      Whether the token is past expiry at now.
      Parameters:
      now - reference instant; non-null
      Returns:
      whether the token is expired

    • isActive

      public boolean isActive(Instant now)
      Whether the token is admissible — not revoked, not replaced, not expired.
      Parameters:
      now - reference instant; non-null
      Returns:
      whether the token can be used for rotation

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • tokenHash

      public String tokenHash()
      Returns the value of the tokenHash record component.
      Returns:
      the value of the tokenHash record component

    • tenant

      public TenantId tenant()
      Returns the value of the tenant record component.
      Returns:
      the value of the tenant record component

    • subjectId

      public SubjectId subjectId()
      Returns the value of the subjectId record component.
      Returns:
      the value of the subjectId record component

    • createdAt

      public Instant createdAt()
      Returns the value of the createdAt record component.
      Returns:
      the value of the createdAt record component

    • expiresAt

      public Instant expiresAt()
      Returns the value of the expiresAt record component.
      Returns:
      the value of the expiresAt record component

    • replacedByHash

      public Optional<String> replacedByHash()
      Returns the value of the replacedByHash record component.
      Returns:
      the value of the replacedByHash record component

    • revokedAt

      public Optional<Instant> revokedAt()
      Returns the value of the revokedAt record component.
      Returns:
      the value of the revokedAt record component