Package com.tnsai.server.security

Class IdempotencyFilter

java.lang.Object

com.tnsai.server.security.IdempotencyFilter

public final class IdempotencyFilter
extends Object

Opt-in HTTP Idempotency-Key gate for mutating requests (TAN-3374).

Missing header: no-op. Present header on POST/PUT/PATCH: first 2xx response is stored in the shared IdempotencyStore and replayed on later requests with the same scoped key. Same key + different body is 409. In-flight duplicates wait for the first handler, they do not run it again.

Store key is SHA-256(scope + method + path + header). Scope is the Bearer token when present, otherwise loopback. The request body is not stored — only its SHA-256, plus the handler's status/body/content-type. TTL is 24 hours.

Field Summary

Fields

Modifier and Type	Field	Description
static final Duration	DEFAULT_TTL
static final String	HEADER
static final int	MAX_KEY_LENGTH

Constructor Summary

Constructors

Constructor	Description
IdempotencyFilter(com.tnsai.idempotency.IdempotencyStore store)
IdempotencyFilter(com.tnsai.idempotency.IdempotencyStore store, Duration ttl, Duration inFlightWait)

Method Summary

Modifier and Type	Method	Description
void	after(io.javalin.http.Context ctx)
void	before(io.javalin.http.Context ctx)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

HEADER

public static final String HEADER

See Also:

• Constant Field Values

DEFAULT_TTL

public static final Duration DEFAULT_TTL

MAX_KEY_LENGTH

public static final int MAX_KEY_LENGTH

See Also:

• Constant Field Values

Constructor Details

IdempotencyFilter

public IdempotencyFilter(com.tnsai.idempotency.IdempotencyStore store)

IdempotencyFilter

public IdempotencyFilter(com.tnsai.idempotency.IdempotencyStore store,
 Duration ttl,
 Duration inFlightWait)

Method Details

before

public void before(io.javalin.http.Context ctx)

after

public void after(io.javalin.http.Context ctx)