Package com.tnsai.server.security

Class SessionCapabilityGate

java.lang.Object

com.tnsai.server.security.SessionCapabilityGate

public final class SessionCapabilityGate
extends Object

HTTP gate that enforces per-session capability ownership (TNS-302).

Usage from a route handler:

 if (!gate.check(ctx, sessionId)) return;
 // ... rest of handler — capability has been minted (new) or verified (existing)
 

Behaviour:

• Session does not yet exist: mint a token, attach it to the response as X-Session-Capability, return true.
• Session exists, request presents a matching token: return true.
• Session exists, no token / wrong token: respond 403, return false.

Constructor Summary

Constructors

Constructor	Description
SessionCapabilityGate(SessionManager sessionManager, SessionCapabilityStore store)

Method Summary

Modifier and Type	Method	Description
boolean	check(io.javalin.http.Context ctx, String sessionId)	Verify or mint a capability for sessionId.
SessionCapabilityStore	store()

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SessionCapabilityGate

public SessionCapabilityGate(SessionManager sessionManager,
 SessionCapabilityStore store)

Method Details

store

public SessionCapabilityStore store()

check

public boolean check(io.javalin.http.Context ctx,
 String sessionId)

Verify or mint a capability for sessionId. Writes 403 + skips remaining handlers when verification fails.

Returns:

true when the request may proceed.