Interface McpSessionOwnerKeyResolver

Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@ThreadSafe @FunctionalInterface public interface McpSessionOwnerKeyResolver
Resolves the stable application owner of a freshly admitted MCP session use. Applies only to endpoints explicitly enabling sessions for MCP 2025-06-18 or 2025-11-25; Soklet's 2026-07-28 implementation does not use this callback.

Implementations must be fast, local, nonblocking, and safe for concurrent invocation. Soklet invokes the resolver inside the operation's bounded application execution after fresh admission. Remote authorization belongs in the admission controller, not this mapping.

The key must distinguish subjects, including issuer and tenant where relevant. A principal's equality, an authorization partition, or a rate-limit partition need not identify one subject. Keys are never emitted in Soklet's responses, logs, or metric labels. Anonymous owners are resolved only when explicitly enabled in McpSessionConfig, under a separate internal namespace. A constant anonymous key deliberately shares one owner quota; generating a new key per initialization must not bypass that quota.

Author:
Mark Allen

  • Method Summary

    Modifier and Type
    Method
    Description
    @NonNull String
    resolve(@NonNull McpAdmissionIdentity admissionIdentity)
    Resolves one opaque, stable owner key from the current admitted identity.

  • Method Details

    • resolve

      @NonNull String resolve(@NonNull McpAdmissionIdentity admissionIdentity) throws Exception
      Resolves one opaque, stable owner key from the current admitted identity. The key must be nonblank and at most 256 UTF-8 bytes. Null, invalid values, failure, or timeout fail closed.
      Parameters:
      admissionIdentity - freshly admitted identity
      Returns:
      stable, nonblank opaque owner key
      Throws:
      Exception - if an owner cannot be established