Package dev.relism.flash.ext.security.oauthserver

Class OAuthServerExtension

java.lang.Object
dev.relism.flash.ext.security.oauthserver.OAuthServerExtension
All Implemented Interfaces:
dev.relism.flash.ext.security.AuthenticationMechanism, dev.relism.flash.extension.FlashExtension
public final class OAuthServerExtension extends Object implements dev.relism.flash.extension.FlashExtension, dev.relism.flash.ext.security.AuthenticationMechanism
An OAuth 2.1 authorization server for the application's own users and resources. A user signs in the way the application's security chain signs anyone in, consents on the application's page, and the client receives an RFC 9068 access token for one of the application's resources — which this extension, as an AuthenticationMechanism, then authenticates. 

 app.install(new SecurityExtension().origin("https://app.example").loginPage("/login"))
    .install(new OAuthServerExtension("/mcp").store(store).signingKeys(keys));

Authorization code with PKCE S256 (the only grant a user takes part in), refresh tokens that rotate and revoke their family on reuse, client_credentials for clients the application registers itself; RFC 8414 metadata, RFC 7591 registration, client ID metadata documents, RFC 8707 resource indicators, RFC 7009 revocation, RFC 9207 iss in the authorization response. The issuer is the application's SecurityExtension.origin(Request).

  • Field Details

  • Constructor Details

    • OAuthServerExtension

      public OAuthServerExtension(String... resources)
      Parameters:
      resources - the paths tokens may be issued for, as RFC 8707 resources on the application's origin; the first is the audience of a request that names none

  • Method Details

    • store

      public OAuthServerExtension store(OAuthStore store)

    • signingKeys

      public OAuthServerExtension signingKeys(String jwkSet)
      The signing keys, as a JWK set whose first key is a private P-256 key — see generateSigningKeys(). Unset, a key is generated at boot, and every token dies with the process.

    • subjects

      public OAuthServerExtension subjects(Function<dev.relism.flash.ext.security.SecurityIdentity,OAuthSubject> subjects)
      Whom an authorization names, and what its tokens carry — and who may authorize at all: throw to refuse a caller. A credential narrower than its user, like an API key, must not become a token with all the user's rights. Default: the principal's name, no claims, anyone signed in.

    • scopes

      public OAuthServerExtension scopes(String... scopes)
      The scopes a client may be granted; any other it asks for is left out of the grant. Default: none.

    • accessTokenLifetime

      public OAuthServerExtension accessTokenLifetime(Duration lifetime)

    • refreshTokenLifetime

      public OAuthServerExtension refreshTokenLifetime(Duration lifetime)

    • consentPage

      public OAuthServerExtension consentPage(String consentPage)
      The application's page asking a signed-in user to allow a client, sent the authorization request as its query string. It reads GET /oauth/authorize/request with that same query, and posts it back to /oauth/authorize with consent=allow or consent=deny. Default /consent.

    • registration

      public OAuthServerExtension registration(boolean open)
      Whether any client may register itself at REGISTER (RFC 7591). Default true.

    • allowLocalClients

      public OAuthServerExtension allowLocalClients()
      Lets client metadata documents live on http and private addresses — for development, never production.

    • generateSigningKeys

      public static String generateSigningKeys()
      A new JWK set for signingKeys(String), private key included: generate once, keep it secret.

    • register

      public OAuthServerExtension.Registration register(Map<String,Object> metadata)
      Registers a client from its RFC 7591 metadata — what REGISTER does for a client registering itself, and the only way to a client_credentials client.

    • configure

      public void configure(dev.relism.flash.extension.FlashRegistrar<?> app, dev.relism.flash.extension.FlashContext ctx)
      Specified by:
      configure in interface dev.relism.flash.extension.FlashExtension

    • authenticate

      public dev.relism.flash.ext.security.Principal authenticate(dev.relism.flash.models.Request req)
      Only tokens this server issued are this mechanism's: any other bearer is left to the rest of the chain. A token is good only under the resource it was issued for (RFC 8707, RFC 9068 §4): one for /mcp authenticates nothing outside it.
      Specified by:
      authenticate in interface dev.relism.flash.ext.security.AuthenticationMechanism

    • schemes

      public List<dev.relism.flash.ext.security.SecurityScheme> schemes()
      Its issuer is "/": this application, at whatever origin it is reached by.
      Specified by:
      schemes in interface dev.relism.flash.ext.security.AuthenticationMechanism