00.74.00

Available on Maven Central. Additive over 00.73.00 — existing STRICT apps without .propagation(...) keep their exact behaviour. The current published release is 00.79.41.

Release date: 2026-06-11 Previous release: 00.73.00 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.74.00 Full changelog: GitHub release v00.74.00

Declarative token propagation

00.74 brings the operations experience Quarkus offers with oidc-token-propagation: an inbound bearer token (JWT, opaque access token, API key) is attached to downstream HTTP calls automatically — no manual header code. The strategy is declared per client interface or method.

@PropagateToken
public interface DocumentClient {
  Document load(String id);

  @PropagateToken(strategy = "exchange", audience = "https://api.archive.internal")
  void archive(String id);
}

// bootstrap:
VaadinSecurity.bootstrap()
    // .authentication / .authorization / .policies as usual …
    .propagation(p -> p.passThrough())
    .install();

client.archive(id);   // Authorization header bound + cleared around the call

The building blocks

TokenCredential sealed hierarchy (BearerToken, OidcAccessToken, RefreshToken, ApiKey) — toString() masks the raw value.
TokenCredentialStore SPI with adapter defaults (VaadinSessionTokenCredentialStore; ThreadLocalTokenCredentialStore for REST + Standalone) and a RestTokenCredentialFilter.
OutboundTokenStrategy SPI with a PassThroughStrategy default (RFC 7230 header validation).
@PropagateToken annotation + advisor — method-level overrides class-level, via the existing JSentinelAnnotationScanner.
Wrapper generation — runtime PropagatingProxy.wrap(...) and a compile-time <Type>Propagating generator, mirroring @Secured.
.propagation(...) sub-builder + PropagationDiagnosticContributor — symmetric with .audit / .sessions / .policies.

New modules

Module	Purpose
`jSentinel-propagation`	Runtime `PropagatingProxy.wrap(...)` + diagnostics
`jSentinel-propagation-processor`	Compile-time `<Type>Propagating` generator
`jSentinel-propagation-oidc`	Opt-in: `TokenExchangeStrategy` (RFC 8693), `ClientCredentialsStrategy` (RFC 6749 §4.4), `InMemoryTokenExchangeCache`

The optional OIDC module bans JOSE libraries (Nimbus / jjwt / jose4j) via Maven Enforcer — the response token is treated as opaque; no silent downgrade on exchange failure.

Notes

Every 00.74 public type ships @ExperimentalJSentinelApi; stable-API promotion is staged for 00.76.
The wrapper index (META-INF/jsentinel/generated-wrappers.idx) gains a kind column (secured / propagating); V00.73 readers stay compatible.
No migration required — consumers that don’t propagate pull no new dependency.

00.73.00 00.74.10