PushDeliveryHandler Class
The host-agnostic core of a push delivery endpoint (RFC 8935): one method from the raw transmission - content type and body - to the PushDeliveryResult the transport renders. A host adapter owns routing and transmitter authentication; this type owns everything the specifications say about the SET itself.
public sealed class PushDeliveryHandlerInheritance System.Object → PushDeliveryHandler
Remarks
The order inside is the security order. Validation decides first, so an attacker cannot burn
replay identifiers with forgeries; the sink then consumes what validation let through; and only
a token the sink accepted is written to the replay cache. Nothing on this path READS that cache,
so a redelivery reaches the sink again - RFC 8935 Section 2 lets a transmitter redeliver
regardless of earlier responses, and ISecurityEventSink answers for it by
requiring idempotent processing. Why the write cannot come earlier, and why that is the only
correct order available here, is on RecordAsync.
Nothing here knows which profile of SET it carries. RFC 8935 is a delivery specification and the kinds it delivers are somebody else's business, so the three things that differ between consumers - the validation profile, what that profile expects, and where events land - arrive as parameters. The consumer's own registration binds them, which is also why the profile cannot be named by a keyed-service attribute here: an attribute takes a compile-time constant, and the key belongs to whoever registers this.
Constructors
PushDeliveryHandler(ISecurityEventTokenValidator, SecurityEventTokenValidationOptions, ISecurityEventSink, IReplayCache) Constructor
The host-agnostic core of a push delivery endpoint (RFC 8935): one method from the raw transmission - content type and body - to the PushDeliveryResult the transport renders. A host adapter owns routing and transmitter authentication; this type owns everything the specifications say about the SET itself.
public PushDeliveryHandler(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator validator, Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions options, Abblix.SecurityEvents.Delivery.ISecurityEventSink sink, Abblix.Jwt.ReplayPrevention.IReplayCache? replayCache=null);Parameters
validator ISecurityEventTokenValidator
The validation pipeline, which the registering consumer resolves from its OWN named profile - never the host's plain family, which another consumer of security event tokens may have shaped to refuse every SET of this kind.
options SecurityEventTokenValidationOptions
What that consumer expects of every token it accepts.
sink ISecurityEventSink
Where validated events land.
replayCache IReplayCache
Tells first deliveries from repeats; null runs without replay tracking, leaving idempotency entirely to the sink's contract.
Remarks
The order inside is the security order. Validation decides first, so an attacker cannot burn
replay identifiers with forgeries; the sink then consumes what validation let through; and only
a token the sink accepted is written to the replay cache. Nothing on this path READS that cache,
so a redelivery reaches the sink again - RFC 8935 Section 2 lets a transmitter redeliver
regardless of earlier responses, and ISecurityEventSink answers for it by
requiring idempotent processing. Why the write cannot come earlier, and why that is the only
correct order available here, is on RecordAsync.
Nothing here knows which profile of SET it carries. RFC 8935 is a delivery specification and the kinds it delivers are somebody else's business, so the three things that differ between consumers - the validation profile, what that profile expects, and where events land - arrive as parameters. The consumer's own registration binds them, which is also why the profile cannot be named by a keyed-service attribute here: an attribute takes a compile-time constant, and the key belongs to whoever registers this.
Methods
PushDeliveryHandler.HandleAsync(string, string, CancellationToken) Method
Handles one push transmission.
public System.Threading.Tasks.Task<Abblix.SecurityEvents.Delivery.PushDeliveryResult> HandleAsync(string? contentType, string? body, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
contentType System.String
The request's Content-Type header, as received.
body System.String
The request body: one SET in compact serialization.
cancellationToken System.Threading.CancellationToken
Cancels validation I/O and processing.