Interface CredentialStore

All Known Implementing Classes:
InMemoryCredentialStore
public interface CredentialStore
Persistence-neutral credential store.

The store is the only place that knows how credentials are persisted — file, RDBMS, key-value store. The security-core uses it exclusively through this interface so the core never gains a production database dependency.

Updates are compare-and-swap: the caller supplies a witness (the encoded hash or status it just read) and the store only applies the change if the witness still matches the persisted value (CWE-362 / CWE-367 / CWE-667). Blind overwrites are not supported — callers must re-read, decide and retry.

  • Method Details

    • findByUsername

      Optional<CredentialRecord> findByUsername(String username)
      Looks up the credential row for username. Returns Optional.empty() when the username is unknown.

    • updateHashIfCurrent

      CredentialUpdateResult updateHashIfCurrent(String username, String expectedEncodedHash, String newEncodedHash, Instant when)
      Atomically replaces the stored hash if it still matches expectedEncodedHash.
      Parameters:
      username - credential identifier
      expectedEncodedHash - witness; usually the encodedHash that findByUsername just returned
      newEncodedHash - new envelope to persist
      when - timestamp for updatedAt; the store does not call Instant.now() itself so callers can inject a clock

    • updateStatusIfCurrent

      CredentialUpdateResult updateStatusIfCurrent(String username, CredentialStatus expectedStatus, CredentialStatus newStatus, Instant when)
      Atomically replaces the stored status if it still matches expectedStatus.