Class AlternateScopeResolverHolder

java.lang.Object

io.confluent.security.authorizer.AlternateScopeResolverHolder

All Implemented Interfaces:

AlternateScopeResolver

public class AlternateScopeResolverHolder
extends Object
implements AlternateScopeResolver

Mutable, thread-safe AlternateScopeResolver container that is a no-op until reconfigured (Null Object pattern). Created and bound by the authorizer-owning layer (ConfluentProvider) into the metadata-server DI binder, so the downstream metadata service can @Inject this single stable reference and install its policy (e.g. lkc -> pkc) later, once it knows it is running in multi-tenant mode -- the policy is not available when the binder is populated at startup, and DI bindings cannot be rebound. Until a delegate is installed, resolve(RequestContext, Action) returns Optional.empty(), which the authorizer treats as "no fallback".

Constructor Summary

Constructors

Constructor	Description
AlternateScopeResolverHolder()

Method Summary

Modifier and Type	Method	Description
Optional<io.confluent.security.authorizer.Scope>	resolve(RequestContext ctx, Action deniedAction)
void	set(AlternateScopeResolver delegate)	Installs the fallback policy.

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AlternateScopeResolverHolder

public AlternateScopeResolverHolder()

Method Details

set

public void set(AlternateScopeResolver delegate)

Installs the fallback policy. Install-once: the metadata service sets this at startup; it is not meant to be cleared or re-installed. resolve(RequestContext, Action) reads delegate directly (no snapshot), which is safe under that contract -- there is no concurrent re-install to race with.

resolve

public Optional<io.confluent.security.authorizer.Scope> resolve(RequestContext ctx,
 Action deniedAction)

Specified by:

resolve in interface AlternateScopeResolver