Documentation

Build the library and run the four reference demos.

Secure Vaadin views with annotations, SPI services, and access evaluators.

Ten skills (Vaadin · REST · Standalone, + persistence & hardening layers) that integrate jSentinel into your app from a single prompt.

Secure REST handlers with subject resolution, permission annotations, and the authorization filter.

Secure plain Java services with SecuredProxy.wrap(…) — same annotations, no framework. CLI / desktop / batch apps.

@Secured compile-time processor + runtime SecuredProxy.wrap(…) — enforce annotations on plain Java methods.

Typesafe policy builder, @RequiresPolicy, sealed PolicyDecision, resource-aware authorization.

TenantId, tenant-scoped keys, JSentinelVersion drift detection — role refresh for active sessions.

11 store SPIs, in-memory defaults, Eclipse Store reference, contract testkit, store-backed services.

Argon2id / bcrypt / scrypt, post-KDF pepper, compare-and-swap CredentialStore, atomic password change, breached-password checks, abuse detection.

OWASP ASVS V2, NIST SP 800-63B and a full 40-CWE traceability matrix with threat-vector coverage.

Modules, package layout, decision model, JSentinelServiceResolver, reusable building blocks, mutation coverage.

Browsable, theme-skinned Javadoc for the published library modules — jSentinel-core + the three adapters.

First-run mechanism for creating the very first administrator account.

LogoutService.logout(SubjectId, LogoutScope) — current session or every session of the subject.

JSentinelAuditService + 27 sealed AuditEvent types, ring-buffer sink, Vaadin /audit route, REST /api/audit.

LoginAttemptPolicy with lockout UI in Vaadin and 429 + Retry-After in REST.

Idle / absolute lifetime + session-id rotation after login.

What’s delivered and what’s still open.

Per-version notes — latest 00.79.41: security-hardening tick closing 21 audit findings (0 Critical, 0 High).