diff --git a/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/biz/OAuthMcpRuntimeService.java b/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/biz/OAuthMcpRuntimeService.java index eaf418f4b..98d33d32c 100644 --- a/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/biz/OAuthMcpRuntimeService.java +++ b/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/biz/OAuthMcpRuntimeService.java @@ -90,9 +90,9 @@ public interface OAuthMcpRuntimeService { * then issues a single-use authorization code. Runs before tenant context is * established, so membership is validated explicitly. * - * @param params OAuth authorization request parameters (response_type, - * client_id, redirect_uri, scope, code_challenge, state, etc.) - * @param principalHeader authenticated caller principal and tenant + * @param params OAuth authorization request parameters (response_type, + * client_id, redirect_uri, scope, code_challenge, state, etc.) + * @param principalHeader authenticated caller principal and tenant * @return the redirect URI carrying the authorization code (and echoed state) */ URI authorize(Map params, RequestHeader.PrincipalHeader principalHeader); @@ -103,7 +103,7 @@ public interface OAuthMcpRuntimeService { * authentication; the issued token's tenant claim is the authorization basis and is * validated explicitly. * - * @param form token request form (grant_type and grant-specific fields) + * @param form token request form (grant_type and grant-specific fields) * @param authorizationHeader client credentials for confidential clients * @return the token response as a JSON-serializable map */ @@ -124,7 +124,7 @@ public interface OAuthMcpRuntimeService { * Revoke an access or refresh token (RFC 7009). Resolves the authorization by the * presented token only and marks it revoked, regardless of tenant context. * - * @param form revocation request form carrying the token to revoke + * @param form revocation request form carrying the token to revoke * @param authorizationHeader client credentials * @return a JSON-serializable map with the revoked flag */ @@ -162,8 +162,8 @@ public interface OAuthMcpRuntimeService { * Create a new MCP connection binding a principal to an OAuth client. The connection * is scoped to the authenticated caller's tenant. * - * @param connection connection definition carrying name, client id, principal, etc. - * @param principalHeader authenticated caller principal and tenant + * @param connection connection definition carrying name, client id, principal, etc. + * @param principalHeader authenticated caller principal and tenant * @return the created connection */ McpConnectionVO createConnection(McpConnectionAddBO connection, @@ -173,8 +173,8 @@ public interface OAuthMcpRuntimeService { * Revoke an MCP connection so it can no longer mint tokens. Tenant-scoped: only the * caller's own connection within their tenant can be revoked. * - * @param connectionId the connection to revoke - * @param principalHeader authenticated caller principal and tenant + * @param connectionId the connection to revoke + * @param principalHeader authenticated caller principal and tenant */ void revokeConnection(Long connectionId, RequestHeader.PrincipalHeader principalHeader); @@ -183,9 +183,9 @@ public interface OAuthMcpRuntimeService { * are deleted before the new set is inserted; each tool id must exist and be enabled. * Tenant-scoped: the connection must belong to the caller's tenant and principal. * - * @param connectionId the connection to update - * @param toolIds the complete new set of enabled tool ids - * @param principalHeader authenticated caller principal and tenant + * @param connectionId the connection to update + * @param toolIds the complete new set of enabled tool ids + * @param principalHeader authenticated caller principal and tenant */ void replaceConnectionTools(Long connectionId, List toolIds, RequestHeader.PrincipalHeader principalHeader); @@ -193,8 +193,8 @@ public interface OAuthMcpRuntimeService { /** * List the tool ids enabled for an MCP connection. Tenant-scoped to the caller. * - * @param connectionId the connection to query - * @param principalHeader authenticated caller principal and tenant + * @param connectionId the connection to query + * @param principalHeader authenticated caller principal and tenant * @return the enabled tool ids for the connection */ List listConnectionToolIds(Long connectionId, RequestHeader.PrincipalHeader principalHeader); @@ -203,10 +203,10 @@ public interface OAuthMcpRuntimeService { * List the tools visible to a connection given its granted scopes. Requires the * tools/list or tools/call scope; the tools/call_high scope gates high-risk tools in. * - * @param tenantId the connection's tenant - * @param principalId the connection's principal - * @param connectionId the connection id - * @param scopes the access token's granted scopes + * @param tenantId the connection's tenant + * @param principalId the connection's principal + * @param connectionId the connection id + * @param scopes the access token's granted scopes * @return the visible tool definitions */ List listVisibleTools(Long tenantId, Long principalId, Long connectionId, @@ -217,11 +217,11 @@ public interface OAuthMcpRuntimeService { * last-used timestamp. Requires the tools/call scope; high-risk visibility follows the * tools/call_high scope. * - * @param tenantId the connection's tenant - * @param principalId the connection's principal - * @param connectionId the connection id - * @param toolName the tool name to resolve - * @param scopes the access token's granted scopes + * @param tenantId the connection's tenant + * @param principalId the connection's principal + * @param connectionId the connection id + * @param toolName the tool name to resolve + * @param scopes the access token's granted scopes * @return the resolved tool definition */ McpToolResolveResponseDTO resolveVisibleTool(Long tenantId, Long principalId, Long connectionId, String toolName, @@ -250,12 +250,12 @@ public interface OAuthMcpRuntimeService { * List MCP tool-call audit entries filtered by tenant, principal, tool, status, and * risk level. The result limit is bounded to a safe maximum. * - * @param tenantId tenant scope + * @param tenantId tenant scope * @param principalId optional principal filter - * @param toolId optional tool filter - * @param status optional status filter - * @param riskLevel optional risk-level filter - * @param limit maximum number of results (bounded to 1-500, defaults to 200) + * @param toolId optional tool filter + * @param status optional status filter + * @param riskLevel optional risk-level filter + * @param limit maximum number of results (bounded to 1-500, defaults to 200) * @return the matching audit entries */ List listAudit(Long tenantId, Long principalId, String toolId, String status, diff --git a/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/mapper/OAuthMcpMapper.java b/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/mapper/OAuthMcpMapper.java index b975bd10e..70d9936ab 100644 --- a/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/mapper/OAuthMcpMapper.java +++ b/dc3-common/dc3-common-auth/src/main/java/io/github/pnoker/common/auth/mapper/OAuthMcpMapper.java @@ -121,16 +121,16 @@ public interface OAuthMcpMapper { * Stores the new and previous refresh-token hashes so rotated refresh tokens can be * detected on replay. * - * @param id the authorization record id - * @param codeHash the authorization-code hash (marks the code consumed) - * @param accessTokenJti the issued access-token JTI - * @param accessIssued access-token issuance time - * @param accessExpires access-token expiry time - * @param refreshHash the issued refresh-token hash - * @param previousRefreshHash the prior refresh-token hash (for replay detection) - * @param refreshIssued refresh-token issuance time - * @param refreshExpires refresh-token expiry time - * @param tokenClaims the serialized token claims + * @param id the authorization record id + * @param codeHash the authorization-code hash (marks the code consumed) + * @param accessTokenJti the issued access-token JTI + * @param accessIssued access-token issuance time + * @param accessExpires access-token expiry time + * @param refreshHash the issued refresh-token hash + * @param previousRefreshHash the prior refresh-token hash (for replay detection) + * @param refreshIssued refresh-token issuance time + * @param refreshExpires refresh-token expiry time + * @param tokenClaims the serialized token claims * @return the number of affected rows */ int activateAuthorizationTokens(@Param("id") Long id, @@ -317,10 +317,10 @@ public interface OAuthMcpMapper { * List the tools visible to a connection given the caller's tenant, principal, and * whether high-risk tools are allowed by scope. * - * @param tenantId the connection's tenant - * @param principalId the connection's principal - * @param connectionId the connection id - * @param allowHighRisk whether high-risk tools are included + * @param tenantId the connection's tenant + * @param principalId the connection's principal + * @param connectionId the connection id + * @param allowHighRisk whether high-risk tools are included * @return the visible tool records */ List listVisibleTools(@Param("tenantId") Long tenantId, @@ -413,8 +413,8 @@ public interface OAuthMcpMapper { * Look up a confirmation already consumed for an idempotency key, so a replayed * high-risk call is detected and rejected. * - * @param connectionId the connection id - * @param idempotencyKey the idempotency key + * @param connectionId the connection id + * @param idempotencyKey the idempotency key * @return the consumed confirmation record, or {@code null} if not consumed yet */ McpToolConfirmationRecord selectConsumedByIdempotencyKey(@Param("connectionId") Long connectionId,