Record Class PkiServerAuthenticationContext

java.lang.Object
java.lang.Record
zeroecho.pki.server.spi.PkiServerAuthenticationContext
Record Components:
peerCertificates - trusted JSSE peer chain, leaf first; 1–64 entries
protocol - negotiated TLS protocol; max 64 chars
cipherSuite - negotiated cipher suite; max 128 chars
requestId - safe request correlation identity matching [A-Za-z0-9_-]{16,128}
realmId - exact server realm
requestHeaders - bounded immutable request headers used only by an explicitly configured proxy mode; max 256 entries
public record PkiServerAuthenticationContext(List<X509Certificate> peerCertificates, String protocol, String cipherSuite, String requestId, RealmId realmId, Map<String, List<String>> requestHeaders) extends Record
Bounded read-only mutual-TLS authentication input, independent of operation arguments.

All fields are immutably snapshotted at construction time. Sensitive material (certificate contents, header values, TLS session details) is never rendered in toString().

Thread safety

Immutable after construction; safe for concurrent access without additional synchronization.

Since:
1.0

  • Constructor Details

    • PkiServerAuthenticationContext

      public PkiServerAuthenticationContext(List<X509Certificate> peerCertificates, String protocol, String cipherSuite, String requestId, RealmId realmId, Map<String, List<String>> requestHeaders)
      Validates and snapshots the finite authentication context.

    • PkiServerAuthenticationContext

      public PkiServerAuthenticationContext(List<X509Certificate> peerCertificates, String protocol, String cipherSuite, String requestId, RealmId realmId)
      Creates a direct-mTLS context without forwarded identity headers.
      Parameters:
      peerCertificates - non-empty authenticated peer chain; defensively copied
      protocol - negotiated TLS protocol name
      cipherSuite - negotiated TLS cipher-suite name
      requestId - validated request correlation identity
      realmId - realm receiving the request

  • Method Details

    • toString

      public String toString()
      Returns safe metadata only; certificate and header values are never rendered.
      Specified by:
      toString in class Record

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • peerCertificates

      public List<X509Certificate> peerCertificates()
      Returns the value of the peerCertificates record component.
      Returns:
      the value of the peerCertificates record component

    • protocol

      public String protocol()
      Returns the value of the protocol record component.
      Returns:
      the value of the protocol record component

    • cipherSuite

      public String cipherSuite()
      Returns the value of the cipherSuite record component.
      Returns:
      the value of the cipherSuite record component

    • requestId

      public String requestId()
      Returns the value of the requestId record component.
      Returns:
      the value of the requestId record component

    • realmId

      public RealmId realmId()
      Returns the value of the realmId record component.
      Returns:
      the value of the realmId record component

    • requestHeaders

      public Map<String, List<String>> requestHeaders()
      Returns the value of the requestHeaders record component.
      Returns:
      the value of the requestHeaders record component