Package ai.vectros.resources.auth.requests

Class IssuerRequest.Builder

java.lang.Object
ai.vectros.resources.auth.requests.IssuerRequest.Builder
All Implemented Interfaces:
IssuerRequest._FinalStage, IssuerRequest.AudienceStage, IssuerRequest.ContextIdStage, IssuerRequest.IssuerIdStage, IssuerRequest.IssuerStage, IssuerRequest.JwksUriStage
Enclosing class:
IssuerRequest
public static final class IssuerRequest.Builder extends Object implements IssuerRequest.IssuerIdStage, IssuerRequest.IssuerStage, IssuerRequest.JwksUriStage, IssuerRequest.AudienceStage, IssuerRequest.ContextIdStage, IssuerRequest._FinalStage

  • Method Details

    • from

      public IssuerRequest.Builder from(IssuerRequest other)
      Specified by:
      from in interface IssuerRequest.IssuerIdStage

    • issuerId

      public IssuerRequest.IssuerStage issuerId(@NotNull @NotNull String issuerId)

      Short slug identifying this issuer within your tenant: 3-31 characters, a lowercase letter first, then lowercase letters, digits, or hyphens. Immutable once registered.

      Short slug identifying this issuer within your tenant: 3-31 characters, a lowercase letter first, then lowercase letters, digits, or hyphens. Immutable once registered.

      Specified by:
      issuerId in interface IssuerRequest.IssuerIdStage
      Returns:
      Reference to this so that method calls can be chained together.

    • issuer

      public IssuerRequest.JwksUriStage issuer(@NotNull @NotNull String issuer)

      The IdP's iss claim value, exactly as it appears in tokens it issues.

      The IdP's iss claim value, exactly as it appears in tokens it issues.

      Specified by:
      issuer in interface IssuerRequest.IssuerStage
      Returns:
      Reference to this so that method calls can be chained together.

    • jwksUri

      public IssuerRequest.AudienceStage jwksUri(@NotNull @NotNull String jwksUri)

      The IdP's remote JWKS endpoint, used to verify presented tokens' signatures.

      The IdP's remote JWKS endpoint, used to verify presented tokens' signatures.

      Specified by:
      jwksUri in interface IssuerRequest.JwksUriStage
      Returns:
      Reference to this so that method calls can be chained together.

    • audience

      public IssuerRequest.ContextIdStage audience(@NotNull @NotNull String audience)

      The aud claim value this contract requires a presented subject_token to carry. Must be globally unique in combination with issuer — use a distinct audience per environment/context sharing one IdP account (most OIDC providers support this as an ordinary per-API/application default).

      The aud claim value this contract requires a presented subject_token to carry. Must be globally unique in combination with issuer — use a distinct audience per environment/context sharing one IdP account (most OIDC providers support this as an ordinary per-API/application default).

      Specified by:
      audience in interface IssuerRequest.AudienceStage
      Returns:
      Reference to this so that method calls can be chained together.

    • contextId

      public IssuerRequest._FinalStage contextId(@NotNull @NotNull String contextId)

      Which of your app contexts an exchanged token targets. Must be an existing app context (create it first via POST /v1/app-contexts). A credential authorized via the CLI bootstrap's provisioning capability may only name the app context it is itself bound to; naming another one is refused. A root API key may name any of its contexts.

      Which of your app contexts an exchanged token targets. Must be an existing app context (create it first via POST /v1/app-contexts). A credential authorized via the CLI bootstrap's provisioning capability may only name the app context it is itself bound to; naming another one is refused. A root API key may name any of its contexts.

      Specified by:
      contextId in interface IssuerRequest.ContextIdStage
      Returns:
      Reference to this so that method calls can be chained together.

    • selfSignupPolicies

      public IssuerRequest._FinalStage selfSignupPolicies(List<SelfSignupPolicy> selfSignupPolicies)

      Opt-in self-service signup: a list of {signup_type, role_id} pairs. When a first-time exchange caller presents no invite token but names a signup_type matching one of these (or omits signup_type and exactly one entry exists), a brand-new user is created and bound to that entry's role — no invite required. Every entry must, by construction, be something you're willing to grant to ANY caller who can present a token from this issuer: no entry may target a role carrying elevated (provisioning or wildcard) scope — rejected. Omit entirely to leave self-signup disabled (the default).

      Specified by:
      selfSignupPolicies in interface IssuerRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • selfSignupPolicies

      public IssuerRequest._FinalStage selfSignupPolicies(Optional<List<SelfSignupPolicy>> selfSignupPolicies)

      Opt-in self-service signup: a list of {signup_type, role_id} pairs. When a first-time exchange caller presents no invite token but names a signup_type matching one of these (or omits signup_type and exactly one entry exists), a brand-new user is created and bound to that entry's role — no invite required. Every entry must, by construction, be something you're willing to grant to ANY caller who can present a token from this issuer: no entry may target a role carrying elevated (provisioning or wildcard) scope — rejected. Omit entirely to leave self-signup disabled (the default).

      Specified by:
      selfSignupPolicies in interface IssuerRequest._FinalStage

    • userinfoUri

      public IssuerRequest._FinalStage userinfoUri(String userinfoUri)

      The IdP's OIDC userinfo endpoint. Optional. Presented tokens are access tokens, which under OIDC don't carry email unless the IdP was specifically configured to add it — if emailClaim misses on the presented token, and userinfoUri is configured, Vectros falls back to calling this endpoint (with the presented token as the bearer credential) and reads emailClaim from its JSON response instead. Omit to leave the fallback disabled — a token that doesn't carry the configured email claim then fails first-login exactly as it does today.

      Specified by:
      userinfoUri in interface IssuerRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • userinfoUri

      public IssuerRequest._FinalStage userinfoUri(Optional<String> userinfoUri)

      The IdP's OIDC userinfo endpoint. Optional. Presented tokens are access tokens, which under OIDC don't carry email unless the IdP was specifically configured to add it — if emailClaim misses on the presented token, and userinfoUri is configured, Vectros falls back to calling this endpoint (with the presented token as the bearer credential) and reads emailClaim from its JSON response instead. Omit to leave the fallback disabled — a token that doesn't carry the configured email claim then fails first-login exactly as it does today.

      Specified by:
      userinfoUri in interface IssuerRequest._FinalStage

    • emailClaim

      public IssuerRequest._FinalStage emailClaim(String emailClaim)

      The claim in the IdP's token that carries the subject's email, used for first-login invite matching. Defaults to email if omitted.

      Specified by:
      emailClaim in interface IssuerRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • emailClaim

      public IssuerRequest._FinalStage emailClaim(Optional<String> emailClaim)

      The claim in the IdP's token that carries the subject's email, used for first-login invite matching. Defaults to email if omitted.

      Specified by:
      emailClaim in interface IssuerRequest._FinalStage

    • subClaim

      public IssuerRequest._FinalStage subClaim(String subClaim)

      The claim in the IdP's token that carries the subject identifier. Defaults to sub if omitted.

      Specified by:
      subClaim in interface IssuerRequest._FinalStage
      Returns:
      Reference to this so that method calls can be chained together.

    • subClaim

      public IssuerRequest._FinalStage subClaim(Optional<String> subClaim)

      The claim in the IdP's token that carries the subject identifier. Defaults to sub if omitted.

      Specified by:
      subClaim in interface IssuerRequest._FinalStage

    • build

      public IssuerRequest build()
      Specified by:
      build in interface IssuerRequest._FinalStage

    • additionalProperty

      public IssuerRequest.Builder additionalProperty(String key, Object value)
      Specified by:
      additionalProperty in interface IssuerRequest._FinalStage

    • additionalProperties

      public IssuerRequest.Builder additionalProperties(Map<String,Object> additionalProperties)
      Specified by:
      additionalProperties in interface IssuerRequest._FinalStage