001/*
002 * Copyright 2022-2026 Revetware LLC.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 * http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 */
016
017package com.soklet;
018
019import org.jspecify.annotations.NonNull;
020
021import javax.annotation.concurrent.ThreadSafe;
022import java.security.MessageDigest;
023
024import static java.util.Objects.requireNonNull;
025
026/**
027 * Immutable secret key used only for pseudonymous MCP trace correlation.
028 * <p>
029 * Supplied bytes are defensively copied and are never exposed through the
030 * public API, diagnostic rendering, logs, metrics, fingerprints, or exception
031 * messages. Applications remain responsible for generating key material with
032 * a cryptographically secure random source and at least 256 bits of entropy.
033 *
034 * @author <a href="https://www.revetkn.com">Mark Allen</a>
035 */
036@ThreadSafe
037public final class McpTraceCorrelationKey {
038        private static final int MINIMUM_KEY_BYTES = 32;
039        @NonNull
040        private final String keyId;
041        private final byte @NonNull [] keyMaterial;
042
043        /**
044         * Creates a trace-correlation key from exact bytes.
045         *
046         * @param keyId 1-64-byte ASCII HTTP token
047         * @param keyMaterial at least 32 bytes of operator-generated key material
048         * @return immutable key value
049         * @throws IllegalArgumentException if the ID or material is invalid
050         */
051        @NonNull
052        public static McpTraceCorrelationKey fromIdAndBytes(@NonNull String keyId,
053                        byte @NonNull [] keyMaterial) {
054                return new McpTraceCorrelationKey(keyId, keyMaterial);
055        }
056
057        private McpTraceCorrelationKey(@NonNull String keyId,
058                        byte @NonNull [] keyMaterial) {
059                this.keyId = McpKeyIdValidator.validate(keyId,
060                                "MCP trace-correlation key ID");
061                requireNonNull(keyMaterial);
062                if (keyMaterial.length < MINIMUM_KEY_BYTES)
063                        throw new IllegalArgumentException(
064                                        "MCP trace-correlation keys must contain at least 32 bytes.");
065                this.keyMaterial = keyMaterial.clone();
066        }
067
068        /** @return non-secret key ID */
069        @NonNull
070        public String getKeyId() {
071                return this.keyId;
072        }
073
074        byte @NonNull [] copyKeyMaterial() {
075                return this.keyMaterial.clone();
076        }
077
078        boolean hasSameMaterial(@NonNull McpTraceCorrelationKey other) {
079                return MessageDigest.isEqual(this.keyMaterial,
080                                requireNonNull(other).keyMaterial);
081        }
082
083        /** @return redacted rendering containing only the non-secret key ID */
084        @Override
085        @NonNull
086        public String toString() {
087                return "%s{keyId='%s', keyMaterial=<redacted>}"
088                                .formatted(getClass().getSimpleName(), this.keyId);
089        }
090}