Documentation

Build the library and run the four reference demos.

Secure Vaadin views with annotations, SPI services, and access evaluators.

Secure REST handlers with subject resolution, permission annotations, and the authorization filter.

Secure plain Java services with Secured.wrap(…) — same annotations, no framework. CLI / desktop / batch apps.

Modules, package layout, decision model, SecurityServiceResolver, reusable building blocks, mutation coverage.

First-run mechanism for creating the very first administrator account.

LogoutService.logout(SubjectId, LogoutScope) — current session or every session of the subject.

SecurityAuditService + 16 sealed AuditEvent types, ring-buffer sink, Vaadin /audit route, REST /api/audit.

LoginAttemptPolicy with lockout UI in Vaadin and 429 + Retry-After in REST.

Idle / absolute lifetime + session-id rotation after login.

What’s delivered and what’s still open.

What changed in 00.60.00 — new adapters, SPIs, audit pipeline, mutation push.