Package ai.vectros.resources.auth.requests

Class TokenExchangeRequest.Builder

java.lang.Object
ai.vectros.resources.auth.requests.TokenExchangeRequest.Builder
All Implemented Interfaces:
TokenExchangeRequest._FinalStage, TokenExchangeRequest.GrantTypeStage, TokenExchangeRequest.SubjectTokenStage, TokenExchangeRequest.SubjectTokenTypeStage
Enclosing class:
TokenExchangeRequest
public static final class TokenExchangeRequest.Builder extends Object implements TokenExchangeRequest.GrantTypeStage, TokenExchangeRequest.SubjectTokenStage, TokenExchangeRequest.SubjectTokenTypeStage, TokenExchangeRequest._FinalStage

  • Method Details

    • from

      public TokenExchangeRequest.Builder from(TokenExchangeRequest other)
      Specified by:
      from in interface TokenExchangeRequest.GrantTypeStage

    • grantType

      public TokenExchangeRequest.SubjectTokenStage grantType(@NotNull @NotNull String grantType)

      Must be exactly urn:ietf:params:oauth:grant-type:token-exchange.

      Must be exactly urn:ietf:params:oauth:grant-type:token-exchange.

      Specified by:
      grantType in interface TokenExchangeRequest.GrantTypeStage
      Returns:
      Reference to this so that method calls can be chained together.

    • subjectToken

      public TokenExchangeRequest.SubjectTokenTypeStage subjectToken(@NotNull @NotNull String subjectToken)

      The IdP-issued JWT to exchange for a Vectros-scoped token.

      The IdP-issued JWT to exchange for a Vectros-scoped token.

      Specified by:
      subjectToken in interface TokenExchangeRequest.SubjectTokenStage
      Returns:
      Reference to this so that method calls can be chained together.

    • subjectTokenType

      public TokenExchangeRequest._FinalStage subjectTokenType(@NotNull @NotNull String subjectTokenType)

      The type of subject_token. Accepted: urn:ietf:params:oauth:token-type:jwt and urn:ietf:params:oauth:token-type:id_token.

      The type of subject_token. Accepted: urn:ietf:params:oauth:token-type:jwt and urn:ietf:params:oauth:token-type:id_token.

      Specified by:
      subjectTokenType in interface TokenExchangeRequest.SubjectTokenTypeStage
      Returns:
      Reference to this so that method calls can be chained together.

    • contextId

      public TokenExchangeRequest._FinalStage contextId(String contextId)

      Selects which app context to target, for an issuer registered against more than one (each via its own POST /v1/auth/issuers row and a distinct audience). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit when your subject_token's aud claim matches only one registered context (the common case, and unaffected by this field's addition — behavior is unchanged from before this field existed). When your token's aud claims could match MORE than one of your registered contexts, name the one you want; a mismatch (naming a context this issuer is not registered against) is refused identically to an unrecognized issuer — the response does not distinguish the two.

      Specified by:
      contextId in interface TokenExchangeRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • contextId

      public TokenExchangeRequest._FinalStage contextId(Optional<String> contextId)

      Selects which app context to target, for an issuer registered against more than one (each via its own POST /v1/auth/issuers row and a distinct audience). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit when your subject_token's aud claim matches only one registered context (the common case, and unaffected by this field's addition — behavior is unchanged from before this field existed). When your token's aud claims could match MORE than one of your registered contexts, name the one you want; a mismatch (naming a context this issuer is not registered against) is refused identically to an unrecognized issuer — the response does not distinguish the two.

      Specified by:
      contextId in interface TokenExchangeRequest._FinalStage

    • signupType

      public TokenExchangeRequest._FinalStage signupType(String signupType)

      Selects which self-service signup policy to apply for a first-time login with NO invite token, when the registered issuer declares one or more selfSignupPolicies (POST /v1/auth/issuers). A plain client-supplied selector, not a value your identity provider needs to assert. Omit when the issuer has exactly one policy entry (the unambiguous default); required to pick among multiple. Ignored entirely if the caller already has an existing Vectros identity, presented an invite_token, or the issuer offers no self-signup policies at all.

      This does NOT reopen the caller-supplied-scope concern named above: signup_type never selects a privilege level, only WHICH pre-authored, already-open policy entry to bind to. Every selfSignupPolicies entry is, by construction, something you already decided ANY caller who can present a token from this issuer may have — self-service, no invite, is exactly that decision, so there is no privilege differential between entries for a caller to escalate into by naming a different one than your frontend intended. The platform independently enforces that this is actually true (no entry may ever resolve to an elevated role) regardless of what this field's value is. Because "any caller who can present a token from this issuer" is the real trust boundary, self-signup is only as narrow as your issuer's own audience — it is not a substitute for restricting who can obtain a token from your identity provider in the first place.

      Specified by:
      signupType in interface TokenExchangeRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • signupType

      public TokenExchangeRequest._FinalStage signupType(Optional<String> signupType)

      Selects which self-service signup policy to apply for a first-time login with NO invite token, when the registered issuer declares one or more selfSignupPolicies (POST /v1/auth/issuers). A plain client-supplied selector, not a value your identity provider needs to assert. Omit when the issuer has exactly one policy entry (the unambiguous default); required to pick among multiple. Ignored entirely if the caller already has an existing Vectros identity, presented an invite_token, or the issuer offers no self-signup policies at all.

      This does NOT reopen the caller-supplied-scope concern named above: signup_type never selects a privilege level, only WHICH pre-authored, already-open policy entry to bind to. Every selfSignupPolicies entry is, by construction, something you already decided ANY caller who can present a token from this issuer may have — self-service, no invite, is exactly that decision, so there is no privilege differential between entries for a caller to escalate into by naming a different one than your frontend intended. The platform independently enforces that this is actually true (no entry may ever resolve to an elevated role) regardless of what this field's value is. Because "any caller who can present a token from this issuer" is the real trust boundary, self-signup is only as narrow as your issuer's own audience — it is not a substitute for restricting who can obtain a token from your identity provider in the first place.

      Specified by:
      signupType in interface TokenExchangeRequest._FinalStage

    • inviteToken

      public TokenExchangeRequest._FinalStage inviteToken(String inviteToken)

      The inv_* invitation token from a sub-user invite email, when this exchange is a first-time login for a subject with no existing Vectros identity yet (TOKEN-EXCHANGE-CONTRACT.md §6). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit for a subject that already has an active Vectros identity; required to complete first login for one that doesn't. Delivered to the end user out-of-band (the same invite-email link flow as today), never generated by this endpoint.

      Specified by:
      inviteToken in interface TokenExchangeRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • inviteToken

      public TokenExchangeRequest._FinalStage inviteToken(Optional<String> inviteToken)

      The inv_* invitation token from a sub-user invite email, when this exchange is a first-time login for a subject with no existing Vectros identity yet (TOKEN-EXCHANGE-CONTRACT.md §6). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit for a subject that already has an active Vectros identity; required to complete first login for one that doesn't. Delivered to the end user out-of-band (the same invite-email link flow as today), never generated by this endpoint.

      Specified by:
      inviteToken in interface TokenExchangeRequest._FinalStage

    • requestedTokenType

      public TokenExchangeRequest._FinalStage requestedTokenType(String requestedTokenType)

      Accepted-and-ignored if present (this contract mints exactly one token shape). Optional.

      Specified by:
      requestedTokenType in interface TokenExchangeRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • requestedTokenType

      public TokenExchangeRequest._FinalStage requestedTokenType(Optional<String> requestedTokenType)

      Accepted-and-ignored if present (this contract mints exactly one token shape). Optional.

      Specified by:
      requestedTokenType in interface TokenExchangeRequest._FinalStage

    • build

      public TokenExchangeRequest build()
      Specified by:
      build in interface TokenExchangeRequest._FinalStage

    • additionalProperty

      public TokenExchangeRequest.Builder additionalProperty(String key, Object value)
      Specified by:
      additionalProperty in interface TokenExchangeRequest._FinalStage

    • additionalProperties

      public TokenExchangeRequest.Builder additionalProperties(Map<String,Object> additionalProperties)
      Specified by:
      additionalProperties in interface TokenExchangeRequest._FinalStage