Package com.tuladb

Class Auth

java.lang.Object

com.tuladb.Auth

public final class Auth
extends Object

A connection credential for MSG_AUTH: a bearer token (JWT/OIDC) or an API key that upgrades the connection's principal and role from the anonymous default. Same frame and rules as the C SDK's ledgerd_client_authenticate:

• sent right after the TCP connect / TLS handshake, before any request, and again on every reconnect (LedgerClient.withAuth(Auth), or the Auth argument of SmartLedgerClient / LedgerClientPool);
• refused on a plaintext connection unless allowInsecure(boolean) (or TULADB_CLIENT_AUTH_ALLOW_INSECURE=1) says the transport is trusted (loopback, a TLS-terminating sidecar);
• a rejected credential fails the connect with LedgerClient.LedgerAuthException (status 35, ERR_PERMISSION);
• toString() never shows it; the client keeps its own copy in a byte[] and zeroes it on LedgerClient.clearAuth(). Prefer the byte[] factories and wipe() your own copy: a String cannot be cleared.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	Auth.Result	The engine's answer to a successful MSG_AUTH.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	MAX_CREDENTIAL_LEN	Longest credential the client sends (the C SDK's cap).
static final byte	MSG_AUTH	The engine's MSG_AUTH (0x70).
static final int	TYPE_API_KEY	API key (WIRE_AUTH_TYPE_API_KEY).
static final int	TYPE_BEARER	JWT / OIDC bearer token (WIRE_AUTH_TYPE_BEARER).

Method Summary

Modifier and Type	Method	Description
Auth	allowInsecure(boolean allow)	A copy that may (or may not) be sent over a non-TLS connection.
static Auth	apiKey(byte[] key)
static Auth	apiKey(String key)
static Auth	bearer(byte[] token)
static Auth	bearer(String token)
boolean	insecureAllowed()
int	length()
static Auth	of(int type, byte[] credential)	credential is copied.
String	toString()
int	type()
void	wipe()	Zero the credential in place.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

MSG_AUTH

public static final byte MSG_AUTH

The engine's MSG_AUTH (0x70).

See Also:

• Constant Field Values

TYPE_BEARER

public static final int TYPE_BEARER

JWT / OIDC bearer token (WIRE_AUTH_TYPE_BEARER).

See Also:

• Constant Field Values

TYPE_API_KEY

public static final int TYPE_API_KEY

API key (WIRE_AUTH_TYPE_API_KEY).

See Also:

• Constant Field Values

MAX_CREDENTIAL_LEN

public static final int MAX_CREDENTIAL_LEN

Longest credential the client sends (the C SDK's cap).

See Also:

• Constant Field Values

Method Details

of

public static Auth of(int type,
 byte[] credential)

credential is copied.

apiKey

public static Auth apiKey(byte[] key)

apiKey

public static Auth apiKey(String key)

bearer

public static Auth bearer(byte[] token)

bearer

public static Auth bearer(String token)

allowInsecure

public Auth allowInsecure(boolean allow)

A copy that may (or may not) be sent over a non-TLS connection.

type

public int type()

insecureAllowed

public boolean insecureAllowed()

length

public int length()

wipe

public void wipe()

Zero the credential in place.

toString

public String toString()

Overrides:

toString in class Object