Class PasswordResetService

java.lang.Object

com.svenruppert.jsentinel.credential.reset.PasswordResetService

public final class PasswordResetService
extends Object

Password reset core service.

Issue

issue(String, Duration) mints a SelectorVerifierToken through TokenDigestService, persists the digest with the supplied TTL, and transitions the credential to CredentialStatus.RESET_PENDING. The verifier is returned to the caller exactly once; the store retains only the digest (CWE-522 / CWE-209 / CWE-640).

Consume

consume(String, SecretValue) parses the wire token, looks up the digest record by selector, checks expiry and status, verifies the verifier digest in constant time (TokenDigestService.verifyVerifier(SelectorVerifierToken, TokenDigestRecord)), validates the new password against the input policy, hashes it, performs a compare-and-swap on the credential's encoded hash and finally CAS-marks the reset token CONSUMED — all single-use (CWE-362 / CWE-640).

Every failure variant collapses to the same generic public response at the adapter boundary; the differentiated reason stays inside the audit trail (CWE-209).

Constructor Summary

Constructors

Constructor	Description
PasswordResetService(CredentialStore credentialStore, ResetTokenStore resetStore, TokenDigestService tokens, PasswordHashingService hashingService, PasswordInputValidator inputValidator, PasswordInputPolicy inputPolicy, CredentialLifecycleService lifecycleService, Clock clock)

Method Summary

Modifier and Type	Method	Description
PasswordResetConsumeResult	consume(String wireToken, SecretValue newPassword)	Consumes the supplied wire token, atomically replacing the credential's hash with the supplied new password and marking the token CONSUMED.
ResetTokenCreationResult	issue(String username, Duration ttl)	Issues a fresh reset token.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

PasswordResetService

public PasswordResetService(CredentialStore credentialStore,
 ResetTokenStore resetStore,
 TokenDigestService tokens,
 PasswordHashingService hashingService,
 PasswordInputValidator inputValidator,
 PasswordInputPolicy inputPolicy,
 CredentialLifecycleService lifecycleService,
 Clock clock)

Method Details

issue

public ResetTokenCreationResult issue(String username,
 Duration ttl)

Issues a fresh reset token. Returns either a Created with the wire token, or an opaque failure — callers must surface the same generic message in both cases (CWE-203).

consume

public PasswordResetConsumeResult consume(String wireToken,
 SecretValue newPassword)

Consumes the supplied wire token, atomically replacing the credential's hash with the supplied new password and marking the token CONSUMED.

Returns Succeeded only when every step succeeded; any failure path returns Failed so the public response stays generic (CWE-203 / CWE-209).