Record Class SignInPolicy

java.lang.Object
java.lang.Record
com.iizix.user.SignInPolicy
Record Components:
secondFactor - The second factor: off, optional (asked of a user who enrolled one) or required (of every user).
secondFactorAdministrators - Whether the members of the administrators group need a second factor whatever secondFactor says.
methods - The methods that may be enrolled and used, in the order of ALL_METHODS, strongest first; unmodifiable.
trustDeviceDays - The days a device may be trusted not to be asked for the second factor again, 0 for never.
selfSignUp - Whether a user may create an account.
emailVerificationDays - The days after which an account whose e-mail address is not verified must verify it to sign in; 0 is at once, NEVER is never.
privacyURL - The link to the privacy statement, empty for none.
termsURL - The link to the terms, empty for none.
support - The support contact shown to a user who cannot sign in, empty for none.
public record SignInPolicy(SignInPolicy.SecondFactor secondFactor, boolean secondFactorAdministrators, Set<String> methods, int trustDeviceDays, boolean selfSignUp, int emailVerificationDays, String privacyURL, String termsURL, String support) extends Record
The sign-in policy of an application: what the server environment sets, with what the application overrides (SignIn L-6; section 5 of the SignIn flow design, its decisions D-11, D-20 and D-31). The rules the owner asked for - require a second factor, "at least one more method", for every user or for the administrators - are secondFactor and secondFactorAdministrators.

Where the settings are. The server's are properties of the server settings named SERVER_PREFIX and the setting's name, e.g. $signIn.secondFactor, beside $signIn.module and $signIn.selfSignUp. The application's are properties of its moduleApp settings named APP_PREFIX and the setting's name, e.g. signIn.secondFactor; each one inherits the server's unless it is set. A setting that is absent has its default, so a server and an application that know nothing of this policy behave as they did: a second factor is asked of the users who enrolled one.

The settings
NameServerApplicationDefault
secondFactorinteger: 0 off, 1 optional, 2 requiredinteger: -1 inherit, 0, 1, 21, optional
secondFactorAdministratorsinteger: 0 as every user, 1 requiredinteger: -1 inherit, 0, 11, required
methodstext: names separated by commastext: empty inheritsempty: every method but email
trustDeviceDaysinteger: 0 to 90, 0 neverinteger: -1 inherit, 0 to 9030
selfSignUpbooleaninteger: -1 inherit, 0 off, 1 onoff
emailVerificationDaysinteger: -1 never required, 0 or moreinteger: -2 inherit, -1 never required, 0 or more-1, never required
privacyURL, termsURL, supporttexttext: empty inherits, a single dash is noneempty: none

Author:
Christopher Mindus

  • Field Details

    • SERVER_PREFIX

      public static final String SERVER_PREFIX
      The prefix of the settings in the server settings: "$signIn.".
      See Also:

    • APP_PREFIX

      public static final String APP_PREFIX
      The prefix of the settings in the application's moduleApp settings: "signIn.".
      See Also:

    • PN_SECOND_FACTOR

      public static final String PN_SECOND_FACTOR
      The names of the settings, without their prefix.
      See Also:

    • PN_SECOND_FACTOR_ADMINISTRATORS

      public static final String PN_SECOND_FACTOR_ADMINISTRATORS
      The names of the settings, without their prefix.
      See Also:

    • PN_METHODS

      public static final String PN_METHODS
      The names of the settings, without their prefix.
      See Also:

    • PN_TRUST_DEVICE_DAYS

      public static final String PN_TRUST_DEVICE_DAYS
      The names of the settings, without their prefix.
      See Also:

    • PN_SELF_SIGN_UP

      public static final String PN_SELF_SIGN_UP
      The names of the settings, without their prefix.
      See Also:

    • PN_EMAIL_VERIFICATION_DAYS

      public static final String PN_EMAIL_VERIFICATION_DAYS
      The names of the settings, without their prefix.
      See Also:

    • PN_PRIVACY_URL

      public static final String PN_PRIVACY_URL
      The names of the settings, without their prefix.
      See Also:

    • PN_TERMS_URL

      public static final String PN_TERMS_URL
      The names of the settings, without their prefix.
      See Also:

    • PN_SUPPORT

      public static final String PN_SUPPORT
      The names of the settings, without their prefix.
      See Also:

    • METHOD_PASSKEY

      public static final String METHOD_PASSKEY
      The methods of a second factor.
      See Also:

    • METHOD_TOTP

      public static final String METHOD_TOTP
      The methods of a second factor.
      See Also:

    • METHOD_SMS

      public static final String METHOD_SMS
      The methods of a second factor.
      See Also:

    • METHOD_EMAIL

      public static final String METHOD_EMAIL
      The methods of a second factor.
      See Also:

    • METHOD_RECOVERY

      public static final String METHOD_RECOVERY
      The methods of a second factor.
      See Also:

    • ALL_METHODS

      public static final Set<String> ALL_METHODS
      Every method a policy can name, strongest first.

    • DEFAULT_METHODS

      public static final Set<String> DEFAULT_METHODS
      The methods of a policy that names none: every method but e-mail codes, the weakest, because the mailbox is also where a password reset goes.

    • INHERIT

      public static final int INHERIT
      The value of an application's integer setting that inherits the server's: -1.
      See Also:

    • NEVER

      public static final int NEVER
      The value of emailVerificationDays for "never required": -1.
      See Also:

    • INHERIT_DAYS

      public static final int INHERIT_DAYS
      The value of an application's emailVerificationDays that inherits the server's: -2. It is not INHERIT, which is this setting's "never required".
      See Also:

    • NONE

      public static final String NONE
      The text of an application's link or contact that is none although the server has one.
      See Also:

    • MAX_TRUST_DEVICE_DAYS

      public static final int MAX_TRUST_DEVICE_DAYS
      The most days a device may be trusted: 90.
      See Also:

    • DEFAULT_TRUST_DEVICE_DAYS

      public static final int DEFAULT_TRUST_DEVICE_DAYS
      The default days a device may be trusted: 30.
      See Also:

    • DEFAULT

      public static final SignInPolicy DEFAULT
      The policy of a server and an application that set nothing.

  • Constructor Details

    • SignInPolicy

      public SignInPolicy(SignInPolicy.SecondFactor secondFactor, boolean secondFactorAdministrators, Set<String> methods, int trustDeviceDays, boolean selfSignUp, int emailVerificationDays, String privacyURL, String termsURL, String support)
      Creates an instance of a SignInPolicy record class.
      Parameters:
      secondFactor - the value for the secondFactor record component
      secondFactorAdministrators - the value for the secondFactorAdministrators record component
      methods - the value for the methods record component
      trustDeviceDays - the value for the trustDeviceDays record component
      selfSignUp - the value for the selfSignUp record component
      emailVerificationDays - the value for the emailVerificationDays record component
      privacyURL - the value for the privacyURL record component
      termsURL - the value for the termsURL record component
      support - the value for the support record component

  • Method Details

    • resolve

      public static SignInPolicy resolve(PropCnr server, PropCnr app)
      Resolves the policy of an application: every setting is the application's when it is set there, the server's otherwise, and its default when neither sets it. A value out of its range is brought into it.
      Parameters:
      server - The server settings, null for none.
      app - The moduleApp settings of the application, null for none.
      Returns:
      The policy.

    • methodsOf

      public static Set<String> methodsOf(String names)
      Gets the methods a text names.
      Parameters:
      names - The names, separated by commas; the letter case and blanks do not matter, and what is no method is left out.
      Returns:
      The methods named, in the order of ALL_METHODS; unmodifiable, and empty when the text names no method at all.

    • secondFactorOf

      public SignInPolicy.SecondFactor secondFactorOf(boolean administrator)
      Gets what the policy says of the second factor of a user.
      Parameters:
      administrator - Whether the user is a member of the administrators group.
      Returns:
      REQUIRED for an administrator when the administrators need one, otherwise what the policy says for every user.

    • allows

      public boolean allows(String method)
      Checks if a method may be enrolled and used.
      Parameters:
      method - The method.
      Returns:
      true when the policy has it.

    • enrolmentChoices

      public List<String> enrolmentChoices(boolean webAuthn)
      Gets the methods a user without a second factor chooses among to enrol one: the choice of the SignIn module, one button each (CC-FIX-SIGNIN-2FA-CHOICE). They are the methods of the policy a person sets up - a passkey, an authenticator app - in the order of the policy, strongest first. The recovery codes are never a choice: they come with the first second factor. A text message and e-mail codes are none either while nothing sets them up.
      Parameters:
      webAuthn - Whether the device can create a passkey: the client reported WebAuthn and the application offers passkeys to it.
      Returns:
      The methods, unmodifiable; empty when there is none to choose.

    • withMethods

      public SignInPolicy withMethods(Set<String> existing)
      Gets the policy with its methods narrowed to the ones that exist: a policy may name a method the server cannot do yet.
      Parameters:
      existing - The methods the server can do.
      Returns:
      The policy with the methods that are in both, in their order.

    • trustDays

      public int trustDays(int asked)
      Gets the days a device is trusted when a user asks for some.
      Parameters:
      asked - The days the user asked for, zero or less for none.
      Returns:
      The days: what was asked for, at most what the policy allows; zero for none.

    • isEmailVerificationRequired

      public boolean isEmailVerificationRequired(boolean verified, long created, long now)
      Checks if an account must verify its e-mail address to sign in.
      Parameters:
      verified - Whether the address of the account is verified.
      created - The time the account was created, milliseconds since the epoch.
      now - The time now, milliseconds since the epoch.
      Returns:
      true when the address is not verified and the days of the policy have passed since the account was created; never when the policy is NEVER.

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. Reference components are compared with Objects::equals(Object,Object); primitive components are compared with the compare method from their corresponding wrapper classes.
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • secondFactor

      public SignInPolicy.SecondFactor secondFactor()
      Returns the value of the secondFactor record component.
      Returns:
      the value of the secondFactor record component

    • secondFactorAdministrators

      public boolean secondFactorAdministrators()
      Returns the value of the secondFactorAdministrators record component.
      Returns:
      the value of the secondFactorAdministrators record component

    • methods

      public Set<String> methods()
      Returns the value of the methods record component.
      Returns:
      the value of the methods record component

    • trustDeviceDays

      public int trustDeviceDays()
      Returns the value of the trustDeviceDays record component.
      Returns:
      the value of the trustDeviceDays record component

    • selfSignUp

      public boolean selfSignUp()
      Returns the value of the selfSignUp record component.
      Returns:
      the value of the selfSignUp record component

    • emailVerificationDays

      public int emailVerificationDays()
      Returns the value of the emailVerificationDays record component.
      Returns:
      the value of the emailVerificationDays record component

    • privacyURL

      public String privacyURL()
      Returns the value of the privacyURL record component.
      Returns:
      the value of the privacyURL record component

    • termsURL

      public String termsURL()
      Returns the value of the termsURL record component.
      Returns:
      the value of the termsURL record component

    • support

      public String support()
      Returns the value of the support record component.
      Returns:
      the value of the support record component