Package com.broadleafcommerce.oauth2.resource.security.token.converter

Class RestrictedAuthorityCompression

java.lang.Object
com.broadleafcommerce.oauth2.resource.security.token.converter.RestrictedAuthorityCompression
public final class RestrictedAuthorityCompression extends Object
A utility class for compressing and decompressing fine-grained authority data, typically found within a JWT claim. This utility employs an "extreme" compression strategy that significantly reduces the size of the authority payload by replacing repetitive strings with indexed lookups.

Compression Strategy

The core idea is to create dictionaries for all unique strings (actions, resources, restriction types) and then reference them by their index. This is particularly effective when the same restriction sets are applied across many different permissions.
  • Dictionaries: Actions (a), Resources (r), and Restriction Types (t) are stored in arrays, where their index becomes their ID.
  • Sets (s): Unique restriction details (e.g., {"ITEMS": ["item1", "item2"]}) are defined once and given an index.
  • Permissions (p): The main structure links resources to actions and the sets that apply to them, using only integer indices.

Expected Compression

The effectiveness of the compression is directly proportional to the repetition of restriction data. In typical scenarios with multiple resources sharing common restriction sets, users can expect a compression ratio between 80% and 95%. The highest compression is achieved when many permissions share the exact same set of restrictions.

Example

Before (Original): 


 {
   "READ_PRODUCT": {"ITEMS": ["item1", "item2"]},
   "UPDATE_PRODUCT": {"ITEMS": ["item1", "item2"]}
 }

After (Compressed): 


 {
   "a": ["READ", "UPDATE"],
   "r": ["PRODUCT"],
   "t": ["ITEMS"],
   "s": [
     [{"t": 0, "v": ["item1", "item2"]}]
   ],
   "p": [
     [{"s": 0, "a": [0, 1]}]
   ]
 }
See Also:

  • Method Details

    • compress

      public static RestrictedAuthorityCompression.CompressedAuthorities compress(Map<String,Map<String,Set<String>>> original)
      Compresses a standard, verbose authority map into a compact, indexed structure.
      Parameters:
      original - A map where keys are full authority names (e.g., "READ_PRODUCT") and values are their corresponding restriction details.
      Returns:
      A RestrictedAuthorityCompression.CompressedAuthorities object ready for serialization.

    • decompress

      public static Map<String,Map<String,Set<String>>> decompress(Object compressedVal)
      Decompresses an indexed structure back into the original, verbose authority map.
      Parameters:
      compressedVal - The compressed claim value, typically a Map from a decoded JWT. This method handles both raw Map objects and instances of RestrictedAuthorityCompression.CompressedAuthorities.
      Returns:
      A map representing the original, fully expanded authorities.

    • isCompressed

      public static boolean isCompressed(Object claimValue)
      Detects if the given claim object represents a compressed authority structure.

      This method is highly efficient as it avoids full deserialization. It performs a quick check for the presence of a specific key ("p") that acts as a unique marker for the compressed format.

      Parameters:
      claimValue - The claim object retrieved from the JWT, which is typically a Map<String, Object> after initial JWT parsing.
      Returns:
      true if the claim is in the compressed format, false otherwise.