Package com.google.auth.credentialaccessboundary

Class ClientSideCredentialAccessBoundaryFactory.Builder

java.lang.Object
com.google.auth.credentialaccessboundary.ClientSideCredentialAccessBoundaryFactory.Builder
Enclosing class:
ClientSideCredentialAccessBoundaryFactory
public static class ClientSideCredentialAccessBoundaryFactory.Builder extends Object
Builder for ClientSideCredentialAccessBoundaryFactory.

Use this builder to create instances of ClientSideCredentialAccessBoundaryFactory with the desired configuration options.

  • Method Details

    • setSourceCredential

      @CanIgnoreReturnValue public ClientSideCredentialAccessBoundaryFactory.Builder setSourceCredential(GoogleCredentials sourceCredential)
      Sets the required source credential.
      Parameters:
      sourceCredential - the GoogleCredentials to set. This is a required parameter.
      Returns:
      this Builder object for chaining.
      Throws:
      NullPointerException - if sourceCredential is null.

    • setMinimumTokenLifetime

      @CanIgnoreReturnValue public ClientSideCredentialAccessBoundaryFactory.Builder setMinimumTokenLifetime(Duration minimumTokenLifetime)
      Sets the minimum acceptable lifetime for a generated downscoped access token.

      This parameter ensures that any generated downscoped access token has a minimum validity period. If the time remaining before the underlying credentials expire is less than this value, the factory will perform a blocking refresh, meaning that it will wait until the credentials are refreshed before generating a new downscoped token. This guarantees that the generated token will be valid for at least minimumTokenLifetime. A reasonable value should be chosen based on the expected duration of operations using the downscoped token. If not set, the default value is defined by ClientSideCredentialAccessBoundaryFactory.DEFAULT_MINIMUM_TOKEN_LIFETIME.

      Parameters:
      minimumTokenLifetime - The minimum acceptable lifetime for a generated downscoped access token. Must be greater than zero.
      Returns:
      This Builder object.
      Throws:
      IllegalArgumentException - if minimumTokenLifetime is negative or zero.

    • setRefreshMargin

      @CanIgnoreReturnValue public ClientSideCredentialAccessBoundaryFactory.Builder setRefreshMargin(Duration refreshMargin)
      Sets the refresh margin for the underlying credentials.

      This duration specifies how far in advance of the credentials' expiration time an asynchronous refresh should be initiated. This refresh happens in the background, without blocking the main thread. If not provided, it will default to the value defined by ClientSideCredentialAccessBoundaryFactory.DEFAULT_REFRESH_MARGIN.

      Note: The refreshMargin must be at least one minute longer than the minimumTokenLifetime.

      Parameters:
      refreshMargin - The refresh margin. Must be greater than zero.
      Returns:
      This Builder object.
      Throws:
      IllegalArgumentException - if refreshMargin is negative or zero.

    • setHttpTransportFactory

      @CanIgnoreReturnValue public ClientSideCredentialAccessBoundaryFactory.Builder setHttpTransportFactory(HttpTransportFactory transportFactory)
      Sets the HTTP transport factory.
      Parameters:
      transportFactory - the HttpTransportFactory to set
      Returns:
      this Builder object

    • setUniverseDomain

      @CanIgnoreReturnValue public ClientSideCredentialAccessBoundaryFactory.Builder setUniverseDomain(String universeDomain)
      Sets the optional universe domain.
      Parameters:
      universeDomain - the universe domain to set
      Returns:
      this Builder object

    • setClock

      public ClientSideCredentialAccessBoundaryFactory.Builder setClock(com.google.api.client.util.Clock clock)
      Set the clock for checking token expiry. Used for testing.
      Parameters:
      clock - the clock to use. Defaults to the system clock
      Returns:
      the builder

    • build

      public ClientSideCredentialAccessBoundaryFactory build()
      Creates a new ClientSideCredentialAccessBoundaryFactory instance based on the current builder configuration.
      Returns:
      A new ClientSideCredentialAccessBoundaryFactory instance.
      Throws:
      IllegalStateException - if the builder is not properly configured (e.g., if the source credential is not set).
      IllegalArgumentException - if the refresh margin is not at least one minute longer than the minimum token lifetime.