Package ai.vectros.resources.auth.requests

Class TokenExchangeRequest

java.lang.Object
ai.vectros.resources.auth.requests.TokenExchangeRequest
public final class TokenExchangeRequest extends Object

  • Method Details

    • getGrantType

      public String getGrantType()
      Returns:
      Must be exactly urn:ietf:params:oauth:grant-type:token-exchange.

    • getSubjectToken

      public String getSubjectToken()
      Returns:
      The IdP-issued JWT to exchange for a Vectros-scoped token.

    • getSubjectTokenType

      public String getSubjectTokenType()
      Returns:
      The type of subject_token. Accepted: urn:ietf:params:oauth:token-type:jwt and urn:ietf:params:oauth:token-type:id_token.

    • getRequestedTokenType

      public Optional<String> getRequestedTokenType()
      Returns:
      Accepted-and-ignored if present (this contract mints exactly one token shape). Optional.

    • getInviteToken

      public Optional<String> getInviteToken()
      Returns:
      The inv_* invitation token from a sub-user invite email, when this exchange is a first-time login for a subject with no existing Vectros identity yet (TOKEN-EXCHANGE-CONTRACT.md §6). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit for a subject that already has an active Vectros identity; required to complete first login for one that doesn't. Delivered to the end user out-of-band (the same invite-email link flow as today), never generated by this endpoint.

    • getSignupType

      public Optional<String> getSignupType()
      Returns:
      Selects which self-service signup policy to apply for a first-time login with NO invite token, when the registered issuer declares one or more selfSignupPolicies (POST /v1/auth/issuers). A plain client-supplied selector, not a value your identity provider needs to assert. Omit when the issuer has exactly one policy entry (the unambiguous default); required to pick among multiple. Ignored entirely if the caller already has an existing Vectros identity, presented an invite_token, or the issuer offers no self-signup policies at all.

      This does NOT reopen the caller-supplied-scope concern named above: signup_type never selects a privilege level, only WHICH pre-authored, already-open policy entry to bind to. Every selfSignupPolicies entry is, by construction, something you already decided ANY caller who can present a token from this issuer may have — self-service, no invite, is exactly that decision, so there is no privilege differential between entries for a caller to escalate into by naming a different one than your frontend intended. The platform independently enforces that this is actually true (no entry may ever resolve to an elevated role) regardless of what this field's value is. Because "any caller who can present a token from this issuer" is the real trust boundary, self-signup is only as narrow as your issuer's own audience — it is not a substitute for restricting who can obtain a token from your identity provider in the first place.

    • getContextId

      public Optional<String> getContextId()
      Returns:
      Selects which app context to target, for an issuer registered against more than one (each via its own POST /v1/auth/issuers row and a distinct audience). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit when your subject_token's aud claim matches only one registered context (the common case, and unaffected by this field's addition — behavior is unchanged from before this field existed). When your token's aud claims could match MORE than one of your registered contexts, name the one you want; a mismatch (naming a context this issuer is not registered against) is refused identically to an unrecognized issuer — the response does not distinguish the two.

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • getAdditionalProperties

      public Map<String,Object> getAdditionalProperties()

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • builder

      public static TokenExchangeRequest.GrantTypeStage builder()