Interface ResetTokenStore

All Known Implementing Classes:
InMemoryResetTokenStore
public interface ResetTokenStore
Persistence-neutral storage of password-reset tokens.

The store never logs verifier values or digests (CWE-209). It supports CAS transitions on the ResetTokenStatus field so tokens are guaranteed to be single-use even under concurrent consume attempts (CWE-362, CWE-640).

  • Method Details

    • save

      void save(ResetTokenRecord record)
      Inserts a freshly issued token. Implementations may throw when a record with the same selector already exists; in practice the selector entropy makes that impossible to hit by accident.

    • findBySelector

      Optional<ResetTokenRecord> findBySelector(String selector)
      Looks up a token by selector. Verifier digests are never compared here; that is the reset service's job.

    • markConsumedIfCurrent

      ResetTokenUpdateResult markConsumedIfCurrent(String selector, ResetTokenStatus expectedStatus)
      Atomically marks the token CONSUMED if its current status still matches expectedStatus.

    • markExpiredIfCurrent

      ResetTokenUpdateResult markExpiredIfCurrent(String selector, ResetTokenStatus expectedStatus)
      Atomically marks the token EXPIRED if its current status still matches expectedStatus. Called lazily when verification notices the expiry, so audit timelines stay accurate.