Class JobGrants

java.lang.Object

com.kingsrook.qqq.backend.core.jobs.JobGrants

public final class JobGrants
extends Object

Job grants (owner-approved design, spec 2026-10-15-cluster-ha-design item 6): how a worker node runs a user's durable job as that user - with the user's CURRENT permissions, never more than at launch, and never through a tokenless super-session. At launch, the web node binds the job to the launching sign-in: it encrypts that session's id (AES-GCM, key derived from QQQ_JOB_GRANT_KEY, bound to the job and user) and signs job id + user id + encrypted session + launch scope + expiry (HMAC-SHA256, another derived key). The grant is kept in the job's credential scope. At each claim, the worker verifies the signature and expiry (a tampered or expired grant fails the job), decrypts the session id, and asks the authentication module to rebuild that session the normal way - for OAuth2, from the stored (encrypted) access/refresh tokens, so the provider confirms the user is still signed in and their groups are current. JobSessions then intersects the result with the launch scope. A sign-in that has ended (logout, revoked or expired refresh token, max session lifetime) fails the job cleanly; nothing escalates.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	SCOPE_GRANT	the credential scope key holding the grant

Method Summary

Modifier and Type	Method	Description
static boolean	isEnabled(QInstance instance)	Whether the instance issues job grants.
static String	issue(QInstance instance, Integer jobId, String userId, String sessionUUID, Map<String,List<Serializable>> scope)	Issue a grant for a launched job: the value to keep in its credential scope (under SCOPE_GRANT).
static String	verify(QInstance instance, Integer jobId, String userId, String grant, Map<String,List<Serializable>> scope)	Verify a job's grant and return the launching session's id.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SCOPE_GRANT

public static final String SCOPE_GRANT

the credential scope key holding the grant

See Also:

• Constant Field Values

Method Details

isEnabled

public static boolean isEnabled(QInstance instance)

Whether the instance issues job grants.

issue

public static String issue(QInstance instance,
 Integer jobId,
 String userId,
 String sessionUUID,
 Map<String,List<Serializable>> scope)
                    throws QException

Issue a grant for a launched job: the value to keep in its credential scope (under SCOPE_GRANT).

Throws:

QException

verify

public static String verify(QInstance instance,
 Integer jobId,
 String userId,
 String grant,
 Map<String,List<Serializable>> scope)
                     throws QException

Verify a job's grant and return the launching session's id. Throws QPermissionDeniedException when the grant is missing, malformed, tampered with, for another job/user/scope, or expired.

Throws:

QException