Interface TenantAwarePepperReferenceResolver

All Known Implementing Classes:
DefaultTenantAwarePepperReferenceResolver
Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@FunctionalInterface public interface TenantAwarePepperReferenceResolver
SPI that resolves the active PepperReference for a tenant context.

Returning Optional.empty() means "no pepper for this tenant" — the credential pipeline proceeds without a pepper application; this is the default for single-tenant deployments that have opted out of pepper.

An implementation backed by a PKCS#11 / HSM resolves the tenant to a key handle internally and returns a PepperReference that wraps only the keyId (with empty key bytes), so the hot pepper key material never leaves the secure element — see docs/security/credentials/standards/pkcs11-hsm-pepper-key.md.

The resolver must not throw on unknown tenants; an unknown tenant simply has no pepper binding (single-tenant fallback).