Class DisclosureService

java.lang.Object
zeroecho.pki.server.DisclosureService
public final class DisclosureService extends Object
Durable disclosure authority and capability-based retrieval decision service.

  • Constructor Details

    • DisclosureService

      public DisclosureService(RealmId realmId, ServerControlStore store, DisclosureService.Defaults defaults, Clock clock, SecureRandom random, AuditSink auditSink)
      Creates a durable disclosure service with an injected random source and clock.
      Parameters:
      realmId - owning security realm
      store - durable server-control store
      defaults - configuration-driven disclosure defaults
      clock - authoritative server clock
      random - cryptographically secure token source
      auditSink - required safe audit sink

  • Method Details

    • defaultPolicy

      public DisclosureService.Policy defaultPolicy(DisclosureService.ObjectType type, boolean rootCa, boolean sensitive)
      Returns the default policy for one object classification.
      Parameters:
      type - protected object classification
      rootCa - whether a CA certificate is a root
      sensitive - whether a leaf contains sensitive data
      Returns:
      configured default disclosure policy

    • register

      public DisclosureService.Record register(PkiId objectId, DisclosureService.ObjectType type, DisclosureService.Policy policy, Optional<String> ownerPrincipalId, String profileOrPolicyCommitment, String actorPrincipalId)
      Persists the first disclosure record without touching PKI content.
      Parameters:
      objectId - exact protected object identifier
      type - protected object classification
      policy - effective or requested disclosure policy
      ownerPrincipalId - optional administrative owner
      profileOrPolicyCommitment - governing profile or policy commitment
      actorPrincipalId - authenticated audit actor
      Returns:
      newly persisted disclosure record

    • registerExact

      public DisclosureService.Record registerExact(PkiId objectId, DisclosureService.ObjectType type, DisclosureService.Policy policy, Optional<DisclosureService.Owner> owner, String profileOrPolicyCommitment, String actorPrincipalId)
      Persists or exactly replays one disclosure record with an optional typed owner.
      Parameters:
      objectId - exact disclosed object identity
      type - exact object classification
      policy - frozen disclosure policy
      owner - optional explicit protocol or administrative owner
      profileOrPolicyCommitment - exact governing policy commitment
      actorPrincipalId - audit actor; never inferred from owner
      Returns:
      newly committed or exactly matching existing record
      Throws:
      IllegalStateException - if an existing record differs

    • change

      public DisclosureService.Record change(PkiId objectId, DisclosureService.Policy policy, boolean exposureApprovalRequired, boolean approvalPresented, String actorPrincipalId)
      Changes only disclosure metadata; increased exposure may require approval.
      Parameters:
      objectId - exact protected object identifier
      policy - effective or requested disclosure policy
      exposureApprovalRequired - whether increased exposure requires approval
      approvalPresented - whether the required approval is present
      actorPrincipalId - authenticated audit actor
      Returns:
      durably updated disclosure record

    • decide

      public DisclosureService.Decision decide(PkiId objectId, Optional<SecurityPrincipal> principal, boolean ownerRelationship, boolean administrativePermission, Optional<byte[]> capabilityToken)
      Evaluates direct retrieval separately from search authorization.
      Parameters:
      objectId - exact protected object identifier
      principal - optional authenticated principal
      ownerRelationship - whether the principal owns the object
      administrativePermission - whether explicit administrative access is granted
      capabilityToken - optional raw capability token
      Returns:
      non-revealing retrieval decision

    • decideRepository

      public DisclosureService.Decision decideRepository(PkiId objectId, Optional<SecurityPrincipal> principal, boolean ownerRelationship, boolean administrativePermission, Optional<String> bearer)
      Evaluates public repository retrieval using a point-addressable bearer credential. Capability and principal authority are not combined.
      Parameters:
      objectId - exact repository object identity
      principal - authenticated principal, or empty for a public request
      ownerRelationship - whether the principal owns the object
      administrativePermission - whether administrative disclosure is authorized
      bearer - point-addressable bearer credential, or empty
      Returns:
      a non-disclosing allow or deny decision

    • bearerCredential

      public static String bearerCredential(DisclosureService.Capability capability, byte[] token)
      Returns the strict one-time bearer credential for an issued capability.
      Parameters:
      capability - persisted capability metadata
      token - exact 32-byte raw capability token
      Returns:
      strict point-addressable bearer credential

    • bearerCredential

      public static String bearerCredential(String capabilityId, byte[] token)
      Returns the strict bearer credential for one non-secret capability ID.
      Parameters:
      capabilityId - stable non-bearer capability identifier
      token - exact 32-byte raw capability token
      Returns:
      strict point-addressable bearer credential

    • issueCapability

      public DisclosureService.IssuedCapability issueCapability(PkiId objectId, Instant expiresAt, String actorPrincipalId)
      Issues 256 random capability bits and persists only their commitment.
      Parameters:
      objectId - exact protected object identifier
      expiresAt - mandatory capability expiry
      actorPrincipalId - authenticated audit actor
      Returns:
      one-time raw token and persisted commitment-only metadata

    • revokeCapability

      public DisclosureService.Capability revokeCapability(String capabilityId, String actorPrincipalId)
      Revokes a capability without revealing or recovering its raw token.
      Parameters:
      capabilityId - stable non-bearer capability identifier
      actorPrincipalId - authenticated audit actor
      Returns:
      durably revoked capability

    • classifyDelivery

      public DisclosureService.Capability classifyDelivery(String capabilityId, boolean delivered)
      Persists the safe post-write delivery classification without changing token validity.
      Parameters:
      capabilityId - stable non-bearer capability identifier
      delivered - whether raw-token delivery completed
      Returns:
      durably classified capability metadata