refactor: Extract TlsHttpsConfigurator to internal package

Moves the inline TLS protocol pin from OpenApiServer to its own file
under com.retailsvc.http.internal so the ASVS gate can match it by
path (src/main/java/.../internal/.*(Ssl|Tls|Https).*\.java) without
also flagging unrelated edits to OpenApiServer.

Author: thced

docs/superpowers/plans/2026-05-21-owasp-asvs.md

@@ -37,7 +37,7 @@
 - Create: `src/main/java/com/retailsvc/http/internal/TlsHttpsConfigurator.java`
 - Modify: `src/main/java/com/retailsvc/http/OpenApiServer.java` (delete nested class at lines 481–498, adjust imports, add new import)
 
-- [ ] **Step 1: Create the new file**
+- [x] **Step 1: Create the new file**
 
 Write `src/main/java/com/retailsvc/http/internal/TlsHttpsConfigurator.java`:
 
@@ -69,13 +69,13 @@ public final class TlsHttpsConfigurator extends HttpsConfigurator {
 }
 ```
 
-- [ ] **Step 2: Remove the nested class from `OpenApiServer.java`**
+- [x] **Step 2: Remove the nested class from `OpenApiServer.java`**
 
 In `src/main/java/com/retailsvc/http/OpenApiServer.java`:
 
 Delete the entire block that currently sits at lines 480–498 (the Javadoc comment plus the `private static final class TlsHttpsConfigurator` body, inclusive of its closing `}`). The final `}` on line 499 (closing the outer `OpenApiServer` class) stays.
 
-- [ ] **Step 3: Adjust imports in `OpenApiServer.java`**
+- [x] **Step 3: Adjust imports in `OpenApiServer.java`**
 
 Remove these two imports (currently at lines 27 and 44):
 
@@ -103,15 +103,15 @@ grep -n "HttpsConfigurator" src/main/java/com/retailsvc/http/OpenApiServer.java
 
 If the only remaining matches are inside the (deleted) line range, also delete the `HttpsConfigurator` import.
 
-- [ ] **Step 4: Run the full test suite**
+- [x] **Step 4: Run the full test suite**
 
 ```bash
 mvn clean verify
 ```
 
 Expected: BUILD SUCCESS. 432 unit tests pass, 55 integration tests pass — identical counts to the pre-refactor branch. `OpenApiServerHttpsIT#negotiatesTls13` still confirms TLS 1.3 negotiation.
 
-- [ ] **Step 5: Commit**
+- [x] **Step 5: Commit**
 
 ```bash
 git add src/main/java/com/retailsvc/http/internal/TlsHttpsConfigurator.java \

src/main/java/com/retailsvc/http/OpenApiServer.java

@@ -15,6 +15,7 @@
 import com.retailsvc.http.internal.Router;
 import com.retailsvc.http.internal.SecurityFilter;
 import com.retailsvc.http.internal.TextTypeMapper;
+import com.retailsvc.http.internal.TlsHttpsConfigurator;
 import com.retailsvc.http.internal.gson.GsonJsonMapper;
 import com.retailsvc.http.spec.Operation;
 import com.retailsvc.http.spec.Spec;
@@ -23,8 +24,6 @@
 import com.retailsvc.http.validate.DefaultValidator;
 import com.sun.net.httpserver.HttpContext;
 import com.sun.net.httpserver.HttpServer;
-import com.sun.net.httpserver.HttpsConfigurator;
-import com.sun.net.httpserver.HttpsParameters;
 import com.sun.net.httpserver.HttpsServer;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -41,7 +40,6 @@
 import java.util.TreeSet;
 import java.util.stream.Collectors;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLParameters;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -483,23 +481,4 @@ private static TypeMapper tryLoadGsonMapper() {
       return new GsonJsonMapper();
     }
   }
-
-  /**
-   * Pins HTTPS to TLS 1.2 and 1.3 only, regardless of operator-level {@code java.security}
-   * overrides, and explicitly leaves client-cert auth off (no mTLS in v1).
-   */
-  private static final class TlsHttpsConfigurator extends HttpsConfigurator {
-    TlsHttpsConfigurator(SSLContext context) {
-      super(context);
-    }
-
-    @Override
-    public void configure(HttpsParameters params) {
-      SSLParameters sslParams = getSSLContext().getDefaultSSLParameters();
-      sslParams.setProtocols(new String[] {"TLSv1.3", "TLSv1.2"});
-      sslParams.setNeedClientAuth(false);
-      sslParams.setWantClientAuth(false);
-      params.setSSLParameters(sslParams);
-    }
-  }
 }

src/main/java/com/retailsvc/http/internal/TlsHttpsConfigurator.java

@@ -0,0 +1,25 @@
+package com.retailsvc.http.internal;
+
+import com.sun.net.httpserver.HttpsConfigurator;
+import com.sun.net.httpserver.HttpsParameters;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
+
+/**
+ * Pins HTTPS to TLS 1.2 and 1.3 only, regardless of operator-level {@code java.security} overrides,
+ * and explicitly leaves client-cert auth off (no mTLS in v1).
+ */
+public final class TlsHttpsConfigurator extends HttpsConfigurator {
+  public TlsHttpsConfigurator(SSLContext context) {
+    super(context);
+  }
+
+  @Override
+  public void configure(HttpsParameters params) {
+    SSLParameters sslParams = getSSLContext().getDefaultSSLParameters();
+    sslParams.setProtocols(new String[] {"TLSv1.3", "TLSv1.2"});
+    sslParams.setNeedClientAuth(false);
+    sslParams.setWantClientAuth(false);
+    params.setSSLParameters(sslParams);
+  }
+}