Interface RefreshSessionStore

public interface RefreshSessionStore

Refresh Session persistence SPI。

框架只定義 session family 的資料與 credential-use／compare-and-rotate／revoke 契約，不綁定 JPA、Redis 或特定租戶模型。實作的 use(RefreshSessionStore.CredentialUse)、rotate(RefreshSessionStore.Rotation) 與 revoke(UUID, Instant, String) 必須各自在單一原子操作中鎖定或比較版本； 不得以「先讀、無條件寫」讓同一 generation 成功兩次。

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final record	RefreshSessionStore.CredentialUse	供 identity switch 等會立即替換或撤銷 family 的流程，原子驗證 credential 並滑動 idle window。 同一 credential 的並行使用可依序成功；logout／expiry／rotation 與本操作以相同 row lock 排序。
static final record	RefreshSessionStore.CredentialUsed
static final record	RefreshSessionStore.CredentialUseRejected
static enum	RefreshSessionStore.CredentialUseRejection
static interface	RefreshSessionStore.CredentialUseResult
static final record	RefreshSessionStore.NewSession
static enum	RefreshSessionStore.RevocationResult
static final record	RefreshSessionStore.Rotated
static final record	RefreshSessionStore.Rotation	compare-and-rotate command。expectedGeneration 與 currentCredentialHash 必須同時吻合。
static final record	RefreshSessionStore.RotationRejected
static enum	RefreshSessionStore.RotationRejection
static interface	RefreshSessionStore.RotationResult
static final record	RefreshSessionStore.Session

Method Summary

Modifier and Type	Method	Description
void	create(RefreshSessionStore.NewSession session)
int	deleteExpired(Instant now)
Optional<RefreshSessionStore.Session>	findByCredentialHash(String credentialHash)
Optional<RefreshSessionStore.Session>	findByCredentialSelectorHash(String credentialSelectorHash)	以秘密 selector 找 family，讓已輪替 verifier 仍可被辨識為 replay。
RefreshSessionStore.RevocationResult	revoke(UUID sessionId, Instant revokedAt, String reason)
default Set<UUID>	revokeByPolicy(String policy, String reference, Instant revokedAt, String reason)	依應用政策綁定撤銷 family，供 consent 等外部授權被撤回時主動失效既有 Session。
RefreshSessionStore.RotationResult	rotate(RefreshSessionStore.Rotation rotation)
RefreshSessionStore.CredentialUseResult	use(RefreshSessionStore.CredentialUse credentialUse)

Method Details

create

void create(RefreshSessionStore.NewSession session)

findByCredentialHash

Optional<RefreshSessionStore.Session> findByCredentialHash(String credentialHash)

findByCredentialSelectorHash

Optional<RefreshSessionStore.Session> findByCredentialSelectorHash(String credentialSelectorHash)

以秘密 selector 找 family，讓已輪替 verifier 仍可被辨識為 replay。

use

RefreshSessionStore.CredentialUseResult use(RefreshSessionStore.CredentialUse credentialUse)

rotate

RefreshSessionStore.RotationResult rotate(RefreshSessionStore.Rotation rotation)

revoke

RefreshSessionStore.RevocationResult revoke(UUID sessionId,
 Instant revokedAt,
 String reason)

revokeByPolicy

default Set<UUID> revokeByPolicy(String policy,
 String reference,
 Instant revokedAt,
 String reason)

依應用政策綁定撤銷 family，供 consent 等外部授權被撤回時主動失效既有 Session。

舊 adapter 可暫時沿用預設空集合；此時 refresh-time SessionEligibilityPolicy 仍會 fail-closed，但無法在授權撤回當下立即 blacklist 尚未到期的 access family。

deleteExpired

int deleteExpired(Instant now)