Class PasswordHistoryService

java.lang.Object

com.svenruppert.jsentinel.credential.history.PasswordHistoryService

public final class PasswordHistoryService
extends Object

Coordinates the optional password-history check.

Adapters call evaluate(String, SecretValue, PasswordHistoryPolicy) with the candidate password before persisting the new hash. If the policy is disabled the service returns PasswordHistoryDecision.Allowed without touching the store. If enabled it verifies the candidate against each retained verifier through the same PasswordHashingService used for the normal login path — old envelopes therefore remain readable as long as their algorithm is still registered (CWE-693).

After a successful change adapters call recordNew(String, String, Instant, PasswordHistoryPolicy) with the freshly produced envelope and the active retention setting. The store enforces the cap via PasswordHistoryStore.appendAndTrim(String, PasswordHistoryEntry, int) (CWE-400).

Constructor Summary

Constructors

Constructor	Description
PasswordHistoryService(PasswordHistoryStore store, PasswordHashingService hashingService)

Method Summary

Modifier and Type	Method	Description
PasswordHistoryDecision	evaluate(String username, SecretValue candidate, PasswordHistoryPolicy policy)	Returns PasswordHistoryDecision.Reused when the supplied candidate verifies against any retained envelope under policy.
void	recordNew(String username, String encodedHash, Instant when, PasswordHistoryPolicy policy)	Records the new envelope in the per-user history and trims to the retention size.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

PasswordHistoryService

public PasswordHistoryService(PasswordHistoryStore store,
 PasswordHashingService hashingService)

Method Details

evaluate

public PasswordHistoryDecision evaluate(String username,
 SecretValue candidate,
 PasswordHistoryPolicy policy)

Returns PasswordHistoryDecision.Reused when the supplied candidate verifies against any retained envelope under policy. History disabled or retention size 0 → always PasswordHistoryDecision.Allowed.

recordNew

public void recordNew(String username,
 String encodedHash,
 Instant when,
 PasswordHistoryPolicy policy)

Records the new envelope in the per-user history and trims to the retention size. No-op when policy.enabled() is false.