Package com.tnsai.server.security

Class SessionCapabilityStore

java.lang.Object

com.tnsai.server.security.SessionCapabilityStore

public final class SessionCapabilityStore
extends Object

Per-session capability tokens (TNS-302).

The first request to touch a sessionId mints a random 32-byte token; the server returns it via the X-Session-Capability response header (HTTP) or via a WS upgrade response. Every subsequent request that targets the same sessionId must present the same token, otherwise the request is rejected with 403. This prevents a second client on the same listener from attaching to an already-active session and reading another user's tool outputs or driving their agent.

Tokens are in-memory only — a server restart invalidates every session capability, which matches the in-memory nature of SessionManager sessions.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	HEADER

Constructor Summary

Constructors

Constructor	Description
SessionCapabilityStore()

Method Summary

Modifier and Type	Method	Description
boolean	has(String sessionId)	Whether a token has been minted for this session.
String	mintIfAbsent(String sessionId)	Returns the token for sessionId, minting one on first call.
void	remove(String sessionId)	Drop the token when the session is removed.
int	size()
boolean	verify(String sessionId, String presented)	Constant-time comparison of presented against the stored token for sessionId.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

HEADER

public static final String HEADER

See Also:

• Constant Field Values

Constructor Details

SessionCapabilityStore

public SessionCapabilityStore()

Method Details

mintIfAbsent

public String mintIfAbsent(String sessionId)

Returns the token for sessionId, minting one on first call. Same sessionId → same token across the server's lifetime.

has

public boolean has(String sessionId)

Whether a token has been minted for this session.

verify

public boolean verify(String sessionId,
 String presented)

Constant-time comparison of presented against the stored token for sessionId. Returns false if the session has never been minted.

remove

public void remove(String sessionId)

Drop the token when the session is removed.

size

public int size()