Class DefaultPasswordHashPolicy

java.lang.Object

com.svenruppert.jsentinel.credential.password.policy.DefaultPasswordHashPolicy

All Implemented Interfaces:

PasswordHashPolicy

public final class DefaultPasswordHashPolicy
extends Object
implements PasswordHashPolicy

Reference PasswordHashPolicy backed by explicit, immutable maps. Use builder() to assemble a policy programmatically.

The class deliberately does not provide a "load from properties" facility in Phase 1a: policies live in code so they participate in type checking and tests.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	DefaultPasswordHashPolicy.Builder	Mutable assembler.

Method Summary

Modifier and Type	Method	Description
Set<String>	acceptableAlgorithms()	Algorithm identifiers that are still accepted by this policy.
Set<String>	acceptableProviderIds()	Provider identifiers that are still accepted by this policy.
static DefaultPasswordHashPolicy.Builder	builder()
Map<String,String>	defaultParameters(String algorithm)	Default parameters the policy emits when producing a fresh hash with the given algorithm.
boolean	isAlgorithmAcceptable(String algorithm)	Returns whether the given algorithm is acceptable for verification under this policy.
boolean	isProviderAcceptable(String providerId)	Returns whether the given provider identifier is acceptable for verification under this policy.
Map<String,String>	maximumParameters(String algorithm)	Upper bound for each parameter value.
Map<String,String>	minimumParameters(String algorithm)	Lower bound for each parameter value.
int	policyVersion()	Monotonically increasing version of this policy.
String	preferredAlgorithm()	Algorithm identifier the policy emits for new hashes.
PasswordHashFormatVersion	preferredFormatVersion()	Envelope wire format the policy emits for new hashes.
String	preferredProviderId()	Provider identifier the policy emits for new hashes.
Set<Integer>	rejectedFormatVersions()	Envelope format versions the operator has explicitly rejected.
Set<Integer>	rejectedPolicyVersions()	Policy versions the operator has explicitly rejected.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

policyVersion

public int policyVersion()

Description copied from interface: PasswordHashPolicy

Monotonically increasing version of this policy. Stored in every envelope. A mismatch between the active policy version and the version embedded in an envelope is one of the triggers for a POLICY_VERSION_OUTDATED rehash.

Specified by:

policyVersion in interface PasswordHashPolicy

preferredFormatVersion

public PasswordHashFormatVersion preferredFormatVersion()

Description copied from interface: PasswordHashPolicy

Envelope wire format the policy emits for new hashes. Older known format versions remain readable but may be flagged for rehash.

Specified by:

preferredFormatVersion in interface PasswordHashPolicy

preferredAlgorithm

public String preferredAlgorithm()

Description copied from interface: PasswordHashPolicy

Algorithm identifier the policy emits for new hashes.

Specified by:

preferredAlgorithm in interface PasswordHashPolicy

preferredProviderId

public String preferredProviderId()

Description copied from interface: PasswordHashPolicy

Provider identifier the policy emits for new hashes.

Specified by:

preferredProviderId in interface PasswordHashPolicy

acceptableAlgorithms

public Set<String> acceptableAlgorithms()

Description copied from interface: PasswordHashPolicy

Algorithm identifiers that are still accepted by this policy. The preferred algorithm is always part of this set.

Specified by:

acceptableAlgorithms in interface PasswordHashPolicy

acceptableProviderIds

public Set<String> acceptableProviderIds()

Description copied from interface: PasswordHashPolicy

Provider identifiers that are still accepted by this policy. The preferred provider is always part of this set.

Specified by:

acceptableProviderIds in interface PasswordHashPolicy

isAlgorithmAcceptable

public boolean isAlgorithmAcceptable(String algorithm)

Description copied from interface: PasswordHashPolicy

Returns whether the given algorithm is acceptable for verification under this policy.

Specified by:

isAlgorithmAcceptable in interface PasswordHashPolicy

isProviderAcceptable

public boolean isProviderAcceptable(String providerId)

Description copied from interface: PasswordHashPolicy

Returns whether the given provider identifier is acceptable for verification under this policy.

Specified by:

isProviderAcceptable in interface PasswordHashPolicy

defaultParameters

public Map<String,String> defaultParameters(String algorithm)

Description copied from interface: PasswordHashPolicy

Default parameters the policy emits when producing a fresh hash with the given algorithm.

Specified by:

defaultParameters in interface PasswordHashPolicy

minimumParameters

public Map<String,String> minimumParameters(String algorithm)

Description copied from interface: PasswordHashPolicy

Lower bound for each parameter value. Validation rejects envelopes whose parameters fall below these values.

Specified by:

minimumParameters in interface PasswordHashPolicy

rejectedFormatVersions

public Set<Integer> rejectedFormatVersions()

Description copied from interface: PasswordHashPolicy

Envelope format versions the operator has explicitly rejected. Envelopes whose formatVersion appears here fail validation outright; older versions that are not in this set remain verifiable and are flagged for rehash by the rehash engine.

Default: empty (no formats explicitly rejected).

Specified by:

rejectedFormatVersions in interface PasswordHashPolicy

rejectedPolicyVersions

public Set<Integer> rejectedPolicyVersions()

Description copied from interface: PasswordHashPolicy

Policy versions the operator has explicitly rejected. Envelopes whose policyVersion appears here fail validation outright; older versions that are not in this set remain verifiable (and are flagged for rehash if they are below the active policy version).

Default: empty (no policy versions explicitly rejected).

Specified by:

rejectedPolicyVersions in interface PasswordHashPolicy

maximumParameters

public Map<String,String> maximumParameters(String algorithm)

Description copied from interface: PasswordHashPolicy

Upper bound for each parameter value. Validation rejects envelopes whose parameters exceed these values; this is the primary defence against parameter-driven resource exhaustion (CWE-400).

Specified by:

maximumParameters in interface PasswordHashPolicy

builder

public static DefaultPasswordHashPolicy.Builder builder()