Class AccessTokenProvider

java.lang.Object
com.codename1.backend.security.oauth2.client.credentials.AccessTokenProvider
public final class AccessTokenProvider extends Object

An access token for calling another service, kept fresh.

Wraps an AccessTokenGrant and holds the one token it last issued. That token is handed out until refreshSkewSeconds before it expires (60 by default), so a request that leaves with it still has that margin for clock differences and time in flight; then the next caller refreshes it.

Concurrent callers share the refresh work. Exactly one runs the exchange; the others keep using the current token while it has not expired, and wait for the exchange only when there is no unexpired token to give them. A failed refresh is shared the same way: the waiters get the failure, not an expired token.

A failure is not retried on the spot. Retrying in a loop would hold the request that hit it, and on a virtual thread hold its host, for the whole backoff. Instead the provider backs off: after n consecutive failures no exchange is attempted for min(maxBackoff, 2^(n-1)) seconds, jittered downwards by up to half, and callers in that window get the token still in hand if it has not expired, or the last failure if it has. The first success resets the count. A refused credential (invalid_client, invalid_grant) backs off the same way, so a revoked key cannot turn every request into an exchange.

One provider holds one token, so its memory is bounded by construction; a server that calls several services, or one service with several scope sets, keeps one provider for each.

  • Constructor Details

  • Method Details

    • setClock

      public void setClock(Clock clock)

    • setRefreshSkewSeconds

      public void setRefreshSkewSeconds(long seconds)
      How long before expiry a token stops being handed out. Default 60.

    • setMaxBackoffSeconds

      public void setMaxBackoffSeconds(long seconds)
      The longest pause between failed exchanges. Default 60.

    • getToken

      public AccessToken getToken()
      A token that has not expired.
      Throws:
      TokenAcquisitionException - when none can be had: the exchange failed, or failed recently and the provider is backing off

    • getTokenValue

      public String getTokenValue()
      The value of the current token, for an Authorization: Bearer header.

    • invalidate

      public void invalidate()
      Forgets the current token, so the next call exchanges again. For a token the other service refused (401) before it expired, such as after a key rotation there. Does not reset a backoff in progress.

    • getConsecutiveFailures

      public int getConsecutiveFailures()
      Consecutive failed exchanges since the last success.

    • toString

      public String toString()
      Description copied from class: Object
      Returns a string representation of the object. In general, the toString method returns a string that "textually represents" this object. The result should be a concise but informative representation that is easy for a person to read. It is recommended that all subclasses override this method. The toString method for class Object returns a string consisting of the name of the class of which the object is an instance, the at-sign character `@', and the unsigned hexadecimal representation of the hash code of the object. In other words, this method returns a string equal to the value of: getClass().getName() + '@' + Integer.toHexString(hashCode())
      Overrides:
      toString in class Object