Package com.privatechain.access.invite

Class InvitationToken

java.lang.Object
com.privatechain.access.invite.InvitationToken
public final class InvitationToken extends Object
Immutable representation of a signed, time-limited invitation token.

An invitation token is generated by an admin node via InvitationService and presented by a new node during onboarding. The token contains:

  • The requested node ID
  • An expiry timestamp (epoch seconds)
  • An ECDSA signature over the nodeId || expiry payload, signed by the admin's private key

Once the token is accepted and the signature verified, the node ID is added to the allowlist and assigned a default role by the InvitationService.

Immutability

All fields are immutable and final. Once created, a token cannot be modified.

Usage


 InvitationToken token = InvitationToken.create(nodeId, expiryEpoch, signature);
 String encoded = token.getEncodedToken();  // Base64 for transmission
 // ...
 InvitationToken parsed = InvitationToken.parseEncodedToken(encoded);
 if (parsed.isExpired()) {
     reject();
 }
Since:
1.0.0
See Also:

  • Method Details

    • create

      public static InvitationToken create(String nodeId, long expiryEpochSeconds, byte[] signature)
      Creates a new invitation token with the given parameters.

      This factory is normally called by InvitationService after signing the payload.

      Parameters:
      nodeId - the node ID being invited (non-null, non-blank)
      expiryEpochSeconds - the expiry time in Unix epoch seconds (must be positive)
      signature - the ECDSA signature bytes (non-null, non-empty)
      Returns:
      a new InvitationToken
      Throws:
      NullPointerException - if any parameter is null
      IllegalArgumentException - if nodeId is blank, expiryEpochSeconds is non-positive, or signature is empty

    • parseEncodedToken

      public static InvitationToken parseEncodedToken(String encodedToken)
      Parses an encoded invitation token (Base64-formatted) back into its components.

      The token is expected to be in the format produced by getEncodedToken(). This is a convenience method for deserialization; the actual signature verification is performed by InvitationService.verifyToken(InvitationToken).

      Parameters:
      encodedToken - the Base64-encoded token string (non-null, non-blank)
      Returns:
      a parsed InvitationToken
      Throws:
      NullPointerException - if encodedToken is null
      IllegalArgumentException - if encodedToken is blank or malformed

    • getNodeId

      public String getNodeId()
      Returns the invited node ID.
      Returns:
      the node ID that will be added to the allowlist upon token acceptance

    • getExpiryEpochSeconds

      public long getExpiryEpochSeconds()
      Returns the token expiry time as Unix epoch seconds.
      Returns:
      epoch seconds timestamp

    • getExpiryInstant

      public Instant getExpiryInstant()
      Returns the expiry time as an Instant.
      Returns:
      expiry as an instant

    • getSignature

      public byte[] getSignature()
      Returns the ECDSA signature bytes (DER-encoded).

      The returned array is a copy; modifications do not affect the token.

      Returns:
      the signature bytes

    • getEncodedToken

      public String getEncodedToken()
      Encodes this token as a Base64 string suitable for transmission or storage.

      The encoded format is: [nodeId length (4 bytes)] + [nodeId (UTF-8)] + [expiryEpochSeconds (8 bytes)] + [signature bytes], then Base64-encoded.

      Returns:
      Base64-encoded token string

    • isExpired

      public boolean isExpired()
      Checks whether this token has expired.
      Returns:
      true if the current time is past the token's expiry time

    • equals

      public boolean equals(Object obj)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object