All Classes and Interfaces
Class
Description
Base
FailoverExpiryExtractor that resolves expiry configuration from a @Failover
annotation, preferring SpEL expression attributes over the literal numeric ones.Base class for
FailoverHandler implementations that do not need the intercepted
Method.AbstractPayloadSplitter specialised for the most common scatter/gather shape: a composite
payload that is a List<T> of slices of type T.Base
ObservablePublisher that delegates publishing to AbstractObservablePublisher.doPublish(com.societegenerale.failover.core.observable.Metrics).Template-method base class for
PayloadSplitter implementations that removes the
boilerplate of building StoreContext / RecoverContext slices and of merging
recovered slices back into a composite result.Base for event-driven snapshot publishers.
FailoverHandler decorator that publishes metrics on every store/recover operation
and delegates payload post-processing to a RecoveredPayloadHandler.Production-grade
PayloadCipher using AES-GCM (authenticated encryption) — the
built-in option for real payload-at-rest confidentiality in the JDBC store (audit A4).Per-API health classification derived from
Rates.healthyRate() against configurable
thresholds (design doc §4.4).Health status values.
Absolute counts plus derived
Rates for one failover point (or "__overall__" for the
aggregate).Back-pressure settings for the async store executor (audit R-2), bound to
failover.store.async-executor.*.Non-blocking
ObservablePublisher decorator: it guarantees that publishing failover metrics
can never block or slow the caller's @Failover business call.Default
PayloadCipher: Base64 encode/decode.Basic
FailoverExecution that invokes the supplier, stores the result on success,
and attempts recovery via the FailoverHandler on any exception.AbstractFailoverExpiryExtractor that interprets expression strings as plain literals:
durations are parsed with Long.parseLong(java.lang.String, int) and units with ChronoUnit.valueOf(java.lang.String).Spring
BeanFactory-backed implementation of ExpiryPolicyLookup.AbstractFailoverExpiryExtractor that resolves expiry expressions via
Spring's ConfigurableBeanFactory.resolveEmbeddedValue(java.lang.String), supporting
property placeholders (e.g.Spring
BeanFactory-backed implementation of KeyGeneratorLookup.Spring
BeanFactory-backed implementation of PayloadSplitterLookup.TaskExecutor decorator that bounds the number of concurrently in-flight tasks and applies a
RejectionPolicy when that bound is reached — a back-pressure / overload guard (audit R-2).ManifestInfoExtractor decorator that caches extraction results by artifact title
to avoid repeated classpath scans.Configuration properties for
failover.store.caffeine.*.Utility for unchecked generic casts needed to bridge raw types at framework boundaries.
ResourceLoader that resolves resources via the current thread's class loader.Lightweight heartbeat ingest endpoint for shared-store liveness tracking.
Periodically samples the merged cluster aggregate (a
MetricsSource) into a ClusterSeriesStore,
producing the cluster-wide trend for cluster.mode=shared-store.Bounded, time-ordered ring of cluster-wide trend points for
cluster.mode=shared-store, pruned by a
RetentionPolicy (age + size, oldest first).The payload one instance pushes to the dashboard in
cluster.mode=shared-store: its own identity plus
the local MetricsSummary snapshot and its @Failover configuration.Ingest endpoint for
cluster.mode=shared-store: peers POST their ClusterSnapshot here and it is
recorded in the SnapshotStore for cluster-wide aggregation.Concrete
ThresholdSnapshotPublisher that builds a ClusterSnapshot from the local
FailoverMetricsSnapshotService and delivers it via a SnapshotPushClient.Small shared helpers across the failover core: null/emptiness checks, exception-chain inspection
(
CommonsUtil.finalRootCauseOf(java.lang.Throwable), CommonsUtil.canonicalTypeOf(java.lang.Throwable), CommonsUtil.messageOf(java.lang.Throwable)) and method identity
(CommonsUtil.methodId(java.lang.reflect.Method)).ContextPropagator that chains multiple propagators, applying each in order.ObservablePublisher that stamps the publish timestamp once and fans metrics out
to a list of delegate publishers.One row of the configuration view: a single
@Failover point plus the global framework
settings echoed for convenience.Strategy for propagating thread-bound context (tenant ID, security principal, MDC trace)
across executor boundaries in scatter/gather operations.
Reports
403 denials from the dashboard's main UI/API gate with a specific, actionable reason
instead of Spring Security's default blank/generic response — "authorization failed: missing role
'FAILOVER_ADMIN'" tells an operator exactly what to grant, rather than leaving them to guess why an
authenticated user still can't get in.Marker bean confirming the dashboard's UI security gate has a way to authenticate someone.
Extension point for plugging an arbitrary authentication mechanism onto the dashboard's own
HttpSecurity chain, without re-implementing the parts every mechanism shares: the
securityMatcher(basePath + "/**"), the FailoverSecurityProvider authorization
wiring, and the DashboardAccessDeniedHandler.Autoconfiguration for the embedded failover dashboard.
Builds the configuration view: one
ConfigEntry per @Failover point, sourced from the
MetricsSource — never a live FailoverScanner reference.Read-only JSON API for the dashboard.
Enforces two dashboard policies on every
base-path/** request (design doc §9):
Exposure narrowing — a read API endpoint (config/metrics/health)
whose name is not in exposure.include (or with exposure.api=false) returns
404, even though its controller bean is wired.Opt-in server-side trend history (design doc §8 option B): a bounded in-memory ring buffer of global
counter snapshots, sampled on a fixed schedule.
Read-only metrics endpoints, mapped under the same
base-path/api namespace as the config API.Dashboard-level wrapper around
FailoverMetricsSnapshotService that adds
health classification using the configured DashboardProperties.Health thresholds.Configuration for the embedded failover dashboard.
Where the dashboard reads its metrics from, for correctness across a multi-instance deployment
(see the distributed-dashboard design document).
What the dashboard exposes once
enabled=true.Health-classification thresholds on the
healthyRate (design doc §4.4):
HEALTHY when rate >= degradedThreshold, DEGRADED when
rate >= unhealthyThreshold, otherwise UNHEALTHY.Opt-in server-side trend history (design doc §8 option B): a fixed-size in-memory ring buffer
sampled on a schedule, exposed at
/api/metrics/series.Toggle for the HTTP snapshot-ingest endpoint (
ClusterSnapshotController, mapped at
base-path/api/cluster/snapshot).JDBC durability settings for
cluster.shared-store.store=jdbc (the optional
failover-dashboard-snapshotstore-jdbc module).Dashboard-side toggle for heartbeat liveness tracking (ADR 66), separate from the peer-side
cluster.snapshot.heartbeat.enabled push flag.Prometheus HTTP-API connection settings for
cluster.mode=prometheus.Bounded retention for the cluster trend history (design §5.4): the series ring keeps points no older than
maxAge and no more than maxEntries, truncating the oldest first.Access-control posture for the dashboard (design doc §9 gate 4).
Security type for failover — AUTHORITY, ROLE, or EXPRESSION.
Settings for
cluster.mode=shared-store — the self-contained small-cluster tier (≤ ~10 instances)
where peers push their KPI snapshot to the dashboard and it aggregates them in memory, with no Prometheus.Snapshot push / ingest settings for
cluster.mode=shared-store.Logs a single consolidated INFO summary of the dashboard's own configuration at startup (on
ApplicationReadyEvent), mirroring FailoverStartupSummaryLogger on the peer side.Strategy for detecting the underlying database product name from a live JDBC connection.
Default
DatabaseResolver that reads the database product name from JDBC connection metadata.Default
ExpiryPolicy that computes expiry by adding the annotation-configured duration
to the current clock time, and checks expiry against the current clock.Default
FailoverClock that returns the current UTC instant from the system clock.Default
FailoverHandler that persists payloads to the failover store on success
and retrieves them on failure, applying expiry checks and payload enrichment.Default
FailoverObserver that scans for all @Failover-annotated methods
and publishes a startup summary metric for each one.Default implementation of
FailoverSecurityProvider for dashboard endpoints.Default
FailoverStore decorator that ensures every payload written to or read from
the delegate store has its upToDate flag forced to false.Default
FailoverStoreQueryResolver that resolves all JDBC queries against a given table
prefix, selects the appropriate native merge/upsert dialect for the detected database, and owns
all parameter binding and result-set mapping logic.Default
InstanceIdResolver: produces <appName>:<hostname>:<port>.Default
KeyGenerator that derives a cache key from method arguments.ManifestInfoExtractor that searches all META-INF/MANIFEST.MF resources on
the classpath for an entry whose Implementation-Title matches the requested title.Default
PayloadEnricher that propagates failover metadata (upToDate, asOf,
exception info) into payloads that implement Referential
or ReferentialAware.Serializer decorator that encrypts the serialized payload string before it is stored and
decrypts it on read (audit: payload-at-rest encryption for the JDBC store).Strategy that governs how the failover framework handles exceptions thrown by
the primary method when recovery is unavailable or the stored entry has expired.
One root exception type that triggered failover recovery, with its cumulative count — derived from the
failover.exception.total counter, aggregated across all failover points.Wraps a
Throwable thrown during the actual method execution inside the failover aspect.Spring scheduler that periodically removes expired entries from the failover store via
FailoverHandler.clean().Strategy for computing and checking expiry of stored failover payloads.
Reusable test harness that checks a custom
ExpiryPolicy against the contract every
implementation must honour.Strategy for resolving an
ExpiryPolicy by qualifier or bean name.Thrown when no
ExpiryPolicy bean is found for the qualifier specified in a @Failover annotation.Annotation for handling the failover of the invoking a method.
AspectJ around-advice that intercepts methods annotated with
Failover and delegates
execution to the configured FailoverExecution strategy.Root Spring Boot autoconfiguration for the failover framework.
Abstraction over the system clock used by the failover framework for computing
and comparing expiry timestamps.
Peer-side snapshot-publisher configuration.
Lightweight heartbeat ping settings.
JDBC-direct settings for the shared-store peer publisher: when
enabled, this instance writes its
ClusterSnapshot straight into the dashboard's
FAILOVER_DASHBOARD_SNAPSHOT table (same schema, same reset-aware baseline carry-forward as the
dashboard's own SnapshotStoreJdbc) instead of POSTing to the ingest endpoint.Rebuilds the
@Failover configuration view from the failover.config.expiry.seconds and
failover.config.global gauges that FailoverMeterBinder registers.Strategy for executing a method call with failover semantics.
Extracts expiry configuration (duration and unit) from a
@Failover annotation.Composite
ExpiryPolicy that delegates to a named policy from the lookup when
@Failover#expiryPolicy() is set, falling back to the default policy otherwise.Spring Boot
FailureAnalyzer that produces
actionable startup diagnostics when a required failover bean is missing.Core handler for failover lifecycle operations: storing payloads, recovering them on failure,
and cleaning up expired entries.
Actuator-style overall failover health, mirroring the
/actuator/health/failover contributor:
UP when at least one @Failover is registered, DOWN when none are discovered
(a strong misconfiguration signal).Spring Boot Actuator
HealthIndicator for the failover framework.Primary
KeyGenerator that orchestrates key generation for a failover operation.MeterBinder that exposes static failover configuration as Micrometer gauges.Process-wide framework settings echoed on the
failover.config.global gauge — the same
values DashboardConfigService used to read from the Environment directly, now
emitted so a remote dashboard can read them too.Aggregates the existing
failover.* Micrometer counters into a MetricsSummary.Autoconfiguration for Micrometer-based failover metrics.
Publishes a startup summary of all detected
@Failover configurations.Root configuration properties for the failover framework, bound to the
failover prefix.Scans the application classpath for methods annotated with
Failover
and provides lookup by name.Thrown when the
FailoverScanner encounters an error during Spring context scanning
or detects duplicate @Failover names.Strategy interface used to contribute dashboard-specific authorization rules.
Logs a single consolidated INFO summary of all failover infrastructure and per-endpoint
configuration at application startup (on
ApplicationReadyEvent, after the
SpringContextFailoverScanner has finished).Persistence contract for failover referential data.
FailoverStore decorator that offloads write operations (FailoverStoreAsync.store(com.societegenerale.failover.core.payload.ReferentialPayload<T>),
FailoverStoreAsync.delete(com.societegenerale.failover.core.payload.ReferentialPayload<T>), FailoverStoreAsync.cleanByExpiry(java.time.Instant)) to a TaskExecutor, keeping the calling
thread unblocked.Central assembler that creates the single
FailoverStore<Object> bean by
combining a TenantStoreFactory (raw store) with the standard decorator chain
(DefaultFailoverStore + optionally FailoverStoreAsync and/or MultiTenantFailoverStore).FailoverStore implementation backed by a single Caffeine in-memory cache.Thrown when a
FailoverStore operation (store, find, delete, or clean) fails.FailoverStore implementation backed by an in-process map.JDBC-backed
FailoverStore implementation.Autoconfiguration that activates when
failover.store.multitenant.enabled=true.Contract for resolving JDBC queries, binding parameters, and mapping result-set rows
for the failover store.
Optional capability a
FailoverStore may expose to report its current live entry count per
referential name, backing the failover.live.entries gauge (cache footprint).This describes the type of failover
Resolves the effective store namespace for a
Failover annotation.TenantResolver that always returns the same literal tenant ID.Minimal heartbeat ping body: just the instance id.
Periodic lightweight heartbeat publisher.
Transport abstraction for the lightweight heartbeat ping.
Records the most recent heartbeat time per instance.
In-memory
HeartbeatStore: last-seen epoch per instance in a ConcurrentHashMap.Durable
HeartbeatStore backed by a single JDBC table — the store=jdbc counterpart to
SnapshotStoreJdbc, so per-instance liveness survives a dashboard restart and, more importantly,
stays consistent when the dashboard is embedded in multiple @Failover instances pointed at
the same database: HeartbeatStoreInmemory
is process-local, so each embedded dashboard would only ever see its own loopback heartbeat and show every
peer as UNKNOWN.Configuration properties for
failover.store.inmemory.*.Resolves the unique identity string for this application instance, used to key per-instance
data in the failover dashboard (snapshot store, Instances tab).
One cluster member's metrics, for the dashboard's per-instance view.
JDBC store configuration properties.
Encryption settings for the
PAYLOAD column.HeartbeatPushClient that writes straight into the dashboard's FAILOVER_DASHBOARD_HEARTBEAT
table instead of POSTing to the ingest endpoint — the JDBC-direct counterpart to
JdbcSnapshotPushClient, active alongside it when both
failover.dashboard.cluster.snapshot.jdbc.enabled=true and
failover.dashboard.cluster.snapshot.heartbeat.enabled=true are set.SnapshotPushClient that writes a ClusterSnapshot straight into the dashboard's
FAILOVER_DASHBOARD_SNAPSHOT table instead of POSTing to the ingest endpoint — the
failover.dashboard.cluster.snapshot.jdbc.enabled=true transport.Jackson-backed
Serializer that converts payloads to/from JSON using a provided
ObjectMapper.Strategy interface for generating a cache key from a failover operation's method arguments.
Strategy for resolving a
KeyGenerator by qualifier or bean name.Thrown when no
KeyGenerator bean is found for the qualifier specified in a @Failover annotation.Wall-time latency of the failover store and recover paths, in milliseconds, derived from the
failover.operation.duration timer.Whether a cluster instance is currently reachable, as determined by the optional heartbeat
mechanism.
Default
MetricsSource: the figures come from this instance's in-process
MeterRegistry, via DashboardMetricsService.Extracts build metadata from
META-INF/MANIFEST.MF for a given artifact title.ContextPropagator that propagates the SLF4J Mapped Diagnostic Context (MDC)
across executor boundaries in scatter/gather operations.AbstractObservablePublisher that publishes failover metrics by writing each metric
entry into the MDC before emitting a single INFO log line, then restoring the prior MDC state.Value object returned by
AbstractPayloadSplitter.mergeSlices(List, List) carrying
the outcome of merging recovered slices back into a composite.Key-value bag for additional metadata attached to recovered failover payloads.
Carries all contextual information available at the point where a method exception is handled.
Default
MethodExceptionPolicy — graceful handling with no exception propagator.Strategy for deciding the final outcome after a primary method call fails and failover
recovery has been attempted.
Mutable key-value bag for failover metrics, keyed with a
"failover-" prefix.Where the dashboard's metrics come from.
The
/api/metrics response: the global aggregate plus per-API KPIs and a capture timestamp.Pure
MetricsSummary aggregation math, shared by every consumer that must combine several
summaries into one (the shared-store cluster source merging per-instance snapshots, and the snapshot
stores folding a pre-reset baseline into a live snapshot).ContextPropagator that propagates the active Micrometer Span across
executor boundaries in scatter/gather operations.ObservablePublisher that emits real Micrometer meters on every store/recover event.Autoconfiguration that registers
MicrometerContextPropagator when
io.micrometer.tracing.Tracer is on the classpath and a Tracer bean exists.Multitenant failover store configuration — a
Store-level concern independent of
the backing store technology (JDBC, Caffeine, InMemory).Tenant isolation strategy for the JDBC store.
Outermost
FailoverStore decorator that routes every operation to the correct
per-tenant store.MethodExceptionPolicy that never rethrows: it always returns the recovered result,
suppressing the original exception in every case.Observability configuration for the failover framework, bound under
failover.observable.Non-blocking metric publishing.
Bounds meter cardinality on the
failover.* meters as a safety guard: caps the number of
distinct name tag values, denying further new series once the cap is hit (so a misconfigured
high-cardinality failover name can never explode the registry).Controls the
instance tag on failover.* meters, which makes figures attributable to the
emitting instance in a cluster.instance-tag strategy.SPI for publishing failover metrics to an external sink (log, metrics system, event bus, etc.).
Spring scheduler that periodically calls
FailoverObserver.observe() to collect
metrics from all registered @Failover configurations and publish them to all
registered ObservablePublisher beans.No-op
RecoveredPayloadHandler that returns the recovered payload unchanged.Strategy for encrypting and decrypting the serialized payload string before it is written to /
after it is read from the JDBC failover store.
Strategy for resolving the SQL type and extracting the value of the PAYLOAD column.
Strategy for enriching payloads before they are stored or after they are recovered.
Strategy that splits a composite payload into individual slices for scatter/gather operations.
Thrown when a user-provided
PayloadSplitter raises an exception during
splitOnStore, splitOnRecover, or merge.Strategy for resolving a
PayloadSplitter by qualifier or bean name.Thrown when
PayloadSplitterLookup cannot resolve the PayloadSplitter
named in Failover.payloadSplitter().Marker for controllers that receive peer-to-peer pushes (
cluster.mode=shared-store) rather than
serving a UI-facing read.Thin, read-only client for the Prometheus HTTP API (
GET /api/v1/query).Cluster-wide
MetricsSource that aggregates the failover.* meters across every instance
via the Prometheus HTTP API (design doc / distributed-dashboard design, Option A).Derived rate KPIs for a failover point (design doc §4.4).
Post-processor for payloads recovered from the failover store.
Base class for referential entities which need to be aware of the failover metadata information.
Interface to be implemented by referential entities that wish to be aware of the failover
metadata information.
Envelope that wraps a referential payload with metadata used by the failover mechanism.
What a
BoundedTaskExecutor does with a task submitted while it is at its concurrency limit.BasicFailoverExecution extension that wraps each supplier with a Resilience4j
CircuitBreaker named after the failover point.Autoconfiguration for the Resilience4j-based
FailoverExecution.Abstraction for locating classpath resources by name.
HeartbeatPushClient backed by Spring RestClient.SnapshotPushClient backed by Spring's RestClient.Two independent bounds applied to retained trend history (design §5.4): an age bound (
RetentionPolicy.maxAge) and a
size bound (RetentionPolicy.maxEntries, oldest truncated first).MethodExceptionPolicy that serves recovered data when available, and cascades
the original exception only when there is nothing to recover.Scatter/gather configuration for the failover framework.
FailoverHandler decorator that adds scatter/gather routing to
Failover-annotated methods.Builder for
ScatterGatherFailoverHandler.Scheduler configuration for the failover framework.
Context passed to
FailoverSecurityProvider.configure(org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry, com.societegenerale.failover.dashboard.security.SecurityContext) — the dashboard's base path plus its
DashboardProperties.Security configuration.Strategy for serializing and deserializing business payloads to and from a storable
string representation (e.g.
One sample of the cumulative counters, captured by the server-side history sampler
(design doc §4.2 / §8 option B).
Cluster-wide
MetricsSource for cluster.mode=shared-store: it merges the live per-instance
snapshots held in a SnapshotStore into one aggregate via MetricsSummaryAggregator — the same
MetricsKpis math as every other source, so the shapes and rates are identical to local / Prometheus.Reset-aware carry-forward shared by every JDBC-writing side of the shared-store tier (consistency rule,
design §5.3) — the dashboard's own
SnapshotStoreJdbc and any peer writing directly to the same
table (JDBC-direct publisher).Contract for pushing a local metrics snapshot to an external receiver (e.g. a centralised dashboard).
Transport abstraction for sending a
ClusterSnapshot to the dashboard ingest endpoint.Where pushed per-instance
ClusterSnapshots are held for the shared-store tier.Default
SnapshotStore: latest snapshot per instance in memory, with the SnapshotBaseline
reset-aware carry-forward — a peer restart (counter reset) folds the pre-restart totals into a per-instance
baseline, so the served summary (baseline + raw) and the cluster aggregate never shrink.Durable
SnapshotStore backed by a single JDBC table — the store=jdbc option for the shared-store
tier, so cluster aggregation survives a dashboard restart.Auto-configuration for the durable JDBC shared-store tier (
cluster.shared-store.store=jdbc).Validates the
table-prefix configured for the JDBC shared-store tier, shared by every side that
concatenates it directly into SQL against FAILOVER_DASHBOARD_SNAPSHOT / FAILOVER_DASHBOARD_HEARTBEAT:
the dashboard's SnapshotStoreJdbc / HeartbeatStoreJdbc, and a peer's JDBC-direct publisher.Provenance of the metrics the dashboard is showing, so the UI can never silently misrepresent
single-instance numbers as a cluster aggregate (or vice-versa) — see the distributed-dashboard design.
FailoverScanner backed by the Spring ApplicationContext.Configuration properties for
failover.store.*.Immutable context passed to
PayloadSplitter.splitOnStore(com.societegenerale.failover.core.payload.splitter.StoreContext<T>) and produced by it.This describes the type of failover stores
Per-tenant configuration overrides (JDBC only).
Thread-local holder for the current tenant ID.
ContextPropagator that propagates the current tenant ID from TenantContext
across executor boundaries in scatter/gather operations.TenantResolver that reads the current tenant ID from TenantContext.Strategy for resolving the current tenant identifier from the execution context.
SPI for creating a raw
FailoverStore for a given tenant.Time-threshold extension of
AbstractSnapshotPublisher: implements ThresholdSnapshotPublisher.shouldPublish()
to allow at most one push per intervalSeconds.A failover point's rolling last-
sampleSize-calls rates (design doc, health §4.4 addendum),
as opposed to the lifetime-cumulative rates in Rates.Default
PayloadColumnResolver that maps the PAYLOAD column as VARCHAR.