Package io.jans.fido2.service.readiness

Class NativeReadinessService

java.lang.Object

io.jans.fido2.service.readiness.NativeReadinessService

@ApplicationScoped
public class NativeReadinessService
extends Object

Runs the native app readiness checks for one configured relying party: feature gate, lookup, RP ID validation, per-RP result cache, rate limits, then the reachability and content checks.

The only input that reaches the network layer is the RP ID stored in the configuration, validated by RpIdValidator. The caller supplies an id to select a configured entry, never a host, URL, port or path, so an id that is not configured is answered with NativeReadinessService.NotFound and no outbound work.

Limits. The configured response size and timeout are clamped to MAX_RESPONSE_BYTES_LIMIT and TIMEOUT_MS_LIMIT; a value that is not positive falls back to its default. A mis-set property therefore cannot remove the cap.

Cache. In memory, per node, one entry per configured RP, so its size is bounded by the configuration. Entries live for nativeReadinessCacheTtlSeconds, but never less than ReadinessRateLimiter.MIN_RECHECK_INTERVAL_MS. In a cluster that means up to one fetch per node per TTL, which ReadinessRateLimiter keeps bounded.

Audit. One log line per executed check with rpId, check, requestedBy, timestamp, result and resolvedIpClass; a cache hit is one line and no fetch. The IP class is a coarse label (never the address). requestedBy is whatever the caller forwarded: the FIDO2 server does not authenticate callers, so the value can be forged by anything that reaches it directly, and is informational until the Config API hop that sets it is trusted.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	NativeReadinessService.NotFound	The requested relying party is not configured.
static final class	NativeReadinessService.RateLimited	A rate limit refused the request; NativeReadinessService.RateLimited.retryAfterSeconds() says when to ask again.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	MAX_RESPONSE_BYTES_LIMIT	The fixed upper bound for nativeReadinessMaxResponseBytes.
static final int	TIMEOUT_MS_LIMIT	The fixed upper bound for nativeReadinessTimeoutMs.

Constructor Summary

Constructors

Constructor	Description
NativeReadinessService()

Method Summary

Modifier and Type	Method	Description
NativeReadinessResult	check(String rpConfigId, boolean recheck, String requestedBy)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

MAX_RESPONSE_BYTES_LIMIT

public static final int MAX_RESPONSE_BYTES_LIMIT

The fixed upper bound for nativeReadinessMaxResponseBytes.

See Also:

• Constant Field Values

TIMEOUT_MS_LIMIT

public static final int TIMEOUT_MS_LIMIT

The fixed upper bound for nativeReadinessTimeoutMs.

See Also:

• Constant Field Values

Constructor Details

NativeReadinessService

public NativeReadinessService()

Method Details

check

public NativeReadinessResult check(String rpConfigId,
 boolean recheck,
 String requestedBy)

Parameters:

rpConfigId - the RP id exactly as configured in requestedParties

recheck - skip the cache (still rate limited)

requestedBy - who asked, as forwarded by the caller; null when not known

Throws:

NativeReadinessService.NotFound - when no configured RP has that id

NativeReadinessService.RateLimited - when a rate limit refuses a check that would fetch