Class InMemoryPepperService

java.lang.Object

com.svenruppert.jsentinel.credential.password.pepper.InMemoryPepperService

All Implemented Interfaces:

PepperService

public final class InMemoryPepperService
extends Object
implements PepperService

In-process pepper key store for tests, demos and small single-node deployments.

Keys are kept on the heap; the service holds defensive copies so the caller can zero the original bytes. This is not an HSM (see CWE-321 / CWE-798) — the operator must still keep the pepper material out of source control, off the password database and out of audit logs.

For a production deployment, plug in a PepperService implementation backed by a secret manager (HSM, AWS KMS, HashiCorp Vault, Kubernetes Secrets) instead.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	InMemoryPepperService.Builder

Method Summary

Modifier and Type	Method	Description
Optional<String>	activeKeyId()	Currently active pepper key id used by the policy when producing new hashes.
static InMemoryPepperService.Builder	builder()	Builder for multi-key configurations (one active + zero or more retired, used by Phase-3 pepper rotation).
int	knownKeyCount()	Convenience for tests: returns the number of known key ids.
Optional<byte[]>	resolve(String keyId)	Resolves the pepper material for a previously stored hash.
void	wipe()	Zeroes every held key and forgets all key ids.
static InMemoryPepperService	withActiveKey(String keyId, byte[] key)	Convenience: build a service from a single active key.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

withActiveKey

public static InMemoryPepperService withActiveKey(String keyId,
 byte[] key)

Convenience: build a service from a single active key.

builder

public static InMemoryPepperService.Builder builder()

Builder for multi-key configurations (one active + zero or more retired, used by Phase-3 pepper rotation).

activeKeyId

public Optional<String> activeKeyId()

Description copied from interface: PepperService

Currently active pepper key id used by the policy when producing new hashes. Optional.empty() signals that no pepper is applied to new hashes.

Specified by:

activeKeyId in interface PepperService

resolve

public Optional<byte[]> resolve(String keyId)

Description copied from interface: PepperService

Resolves the pepper material for a previously stored hash.

Specified by:

resolve in interface PepperService

Returns:

the pepper bytes, or Optional.empty() when no pepper service knows about this key id

wipe

public void wipe()

Zeroes every held key and forgets all key ids. After this call the service has no active key and resolve(String) returns Optional.empty() for every input.

knownKeyCount

public int knownKeyCount()

Convenience for tests: returns the number of known key ids.