All Classes and Interfaces
Class
Description
The handler or MCP tool requires an authenticated caller.
Answers a request that needs a caller and carries no credential at all.
A credential was presented and rejected.
Reads one kind of credential off a request.
One instance's sessions, lost on restart.
A way to sign in, listed at
GET /auth/methods for a client to offer.Anyone may call the handler.
Who an
AuthenticationMechanism proved the caller to be.Whether a caller holds a role — read from a token, a database, anywhere.
The caller must hold at least one of these roles, as decided by the configured
RoleResolver.The caller's credential must grant every one of these scopes.
Flash security: the authentication chain, the policies security annotations declare, sessions,
and the
/auth/logout and /auth/methods routes.The authenticated caller of the current request: the
Principal a mechanism produced, the
application user it resolves to, and the roles and scopes it holds.What a handler's or tool's security annotations require, compiled once at boot.
A credential as OpenAPI names and defines it, the
WWW-Authenticate challenge an anonymous
API call receives for it, and — for OAuth — the issuer that grants it.A signed-in principal, kept server-side under the id its cookie carries.
Renews an expired session — with a refresh token, typically.
Where sessions live.
The resource a role is checked on: the values
RolesAllowed.on() names, read from path
and query parameters on HTTP and from tool arguments on MCP.The application user a verified principal belongs to — typically found, or provisioned, by issuer and subject.