001/*
002 * Copyright 2022-2026 Revetware LLC.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 * http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 */
016
017package com.soklet;
018
019import org.jspecify.annotations.NonNull;
020import org.jspecify.annotations.Nullable;
021
022import javax.annotation.concurrent.ThreadSafe;
023import java.util.Objects;
024
025import static java.util.Objects.requireNonNull;
026
027/**
028 * Secret-free deployment-comparison fingerprint for one complete live MCP
029 * protection keyring configuration.
030 * <p>
031 * This value is operational metadata only, not an authentication input. It
032 * exposes neither raw key material nor per-key fingerprint tags.
033 * <p>
034 * Version {@code v2} includes exact raw key bytes in the configuration
035 * comparison, including bytes that HMAC would otherwise pad or hash when
036 * used directly as a key. Compare version, protection profile, and value
037 * together across servers. The fingerprint version is independent of the
038 * request-state protection profile and does not change sealed state.
039 *
040 * @author <a href="https://www.revetkn.com">Mark Allen</a>
041 */
042@ThreadSafe
043public final class McpProtectionKeyringFingerprint {
044        /** Diagnostic fingerprint encoding version, independent of the protection profile. */
045        @NonNull
046        public static final String VERSION = "v2";
047
048        /** Built-in protection profile included in the fingerprint. */
049        @NonNull
050        public static final String PROFILE = "soklet-mcp-protection-v1";
051
052        @NonNull
053        private final String value;
054
055        McpProtectionKeyringFingerprint(@NonNull String value) {
056                this.value = requireNonNull(value);
057        }
058
059        /** @return fingerprint encoding version */
060        @NonNull
061        public String getVersion() {
062                return VERSION;
063        }
064
065        /** @return protection profile represented by this fingerprint */
066        @NonNull
067        public String getProfile() {
068                return PROFILE;
069        }
070
071        /** @return unpadded Base64URL fingerprint value */
072        @NonNull
073        public String getValue() {
074                return this.value;
075        }
076
077        /** @return the unpadded Base64URL fingerprint value */
078        @Override
079        @NonNull
080        public String toString() {
081                return this.value;
082        }
083
084        /**
085         * Compares fingerprint values.
086         *
087         * @param object value to compare
088         * @return whether the values are equal
089         */
090        @Override
091        public boolean equals(@Nullable Object object) {
092                return object instanceof McpProtectionKeyringFingerprint other
093                                && this.value.equals(other.value);
094        }
095
096        /** @return hash code for the fingerprint value */
097        @Override
098        public int hashCode() {
099                return Objects.hash(this.value);
100        }
101}