| PingModeGrantProcessor | Handles CIBA ping mode token retrieval at the token endpoint. In ping mode, the server notifies the client, then the client makes a single token request. The auth_req_id is single-use (CIBA Core 1.0 Section 7.3), so the grant is removed from storage on retrieval — identically to poll mode (Section 10.1.1 defines their token responses the same). |
| PollModeGrantProcessor | Handles CIBA poll mode token retrieval at the token endpoint. In poll mode, clients repeatedly poll until authentication completes. Tokens are removed from storage immediately after retrieval to prevent duplicate issuance. Uses atomic try-remove operation to prevent race conditions. |
| PushModeGrantProcessor | Handles CIBA push mode token retrieval validation at the token endpoint. In push mode, tokens are delivered directly to the client's notification endpoint. Push mode clients should NEVER poll the token endpoint - this is an error. |