DPoPNonceCache
Thread-safe in-memory nonce cache for DPoP proof JWTs.
RFC 9449 §8 allows a server to supply a DPoP-Nonce response header. Salesforce issues nonces from the token endpoint; resource-server responses (identity, REST) are not expected to carry one, though the SDK still harvests a DPoP-Nonce from any response that does (e.g. the userinfo nonce-challenge retry in AuthenticationUtilities). This cache is keyed by (credentialsIdentifier, host) so a nonce supplied by a specific host takes precedence for that host.
Since resource servers aren't expected to issue their own nonce, get falls back to the most recently stored nonce for credentialsIdentifier (any host) when there is no entry for the exact (credentialsIdentifier, host) pair, so the client reuses the latest token-endpoint nonce on every DPoP call for that credential. An exact host match always takes precedence over the fallback. Logins where the token host differs from the resource hosts (e.g. communities, login.* pool servers) rely on this fallback. This matches the credential-scoped fallback used by the iOS implementation (DPoPNonceCache.swift's nonce(htu:scope:) ?? latest(forScope:)), layered on top of Android's existing per-host isolation.
Functions
Returns the nonce cached for the exact (credentialsIdentifier, host) pair, or, if none was ever stored for that host, the most recently stored nonce for credentialsIdentifier on any host — i.e. the latest nonce issued at the token endpoint for this credential. Returns null if neither is available.