Class OperationSecurityDescriptors

java.lang.Object
zeroecho.pki.server.OperationSecurityDescriptors
public final class OperationSecurityDescriptors extends Object
Immutable security descriptors keyed by existing typed-operation identities.

  • Constructor Details

    • OperationSecurityDescriptors

      public OperationSecurityDescriptors()
      Creates the closed current gateway descriptor registry.

    • OperationSecurityDescriptors

      public OperationSecurityDescriptors(List<OperationSecurityDescriptors.Descriptor> values)
      Creates a registry and rejects duplicate operation identities.
      Parameters:
      values - complete finite descriptor set

  • Method Details

    • available

      public static boolean available(String operationId)
      Tests current operation availability without changing its security descriptor.
      Parameters:
      operationId - stable operation identity
      Returns:
      false for remote restoration until its transport workflow is available

    • definitions

      public static List<OperationSecurityDescriptors.Descriptor> definitions()
      Returns the typed, immutable security definitions used to assemble the catalog. This factory does not initialize a registry or consult catalog projections.
      Returns:
      all current operation security definitions

    • require

      public OperationSecurityDescriptors.Descriptor require(PkiOperation operation)
      Resolves one PKI descriptor or fails closed.
      Parameters:
      operation - exact typed PKI operation
      Returns:
      corresponding security descriptor

    • require

      public OperationSecurityDescriptors.Descriptor require(AdministrativeOperation operation)
      Resolves either operation family through the sole descriptor authority.
      Parameters:
      operation - exact typed administrative operation
      Returns:
      corresponding security descriptor

    • descriptors

      public Map<String, OperationSecurityDescriptors.Descriptor> descriptors()
      Returns the complete descriptor registry.
      Returns:
      immutable descriptor map keyed by operation ID

    • require

      public OperationSecurityDescriptors.Descriptor require(String operationId)
      Resolves one descriptor by stable ID for strict transport decoding.
      Parameters:
      operationId - stable typed-operation identifier
      Returns:
      corresponding security descriptor

    • commitment

      public String commitment(RealmId realmId, PkiOperation operation, Permission.Resource resource)
      Computes an exact deterministic safe PKI-operation commitment.
      Parameters:
      realmId - owning realm
      operation - exact typed PKI operation
      resource - exact authorized resource
      Returns:
      lowercase SHA-256 operation commitment

    • commitment

      public String commitment(RealmId realmId, AdministrativeOperation operation, Permission.Resource resource)
      Computes an exact deterministic commitment for either closed operation family.
      Parameters:
      realmId - owning realm
      operation - exact typed administrative operation
      resource - exact authorized resource
      Returns:
      lowercase SHA-256 operation commitment

    • approvalPolicyCategory

      public OperationSecurityDescriptors.ApprovalCategory approvalPolicyCategory(AdministrativeOperation operation, boolean grantApprovalRequired)
      Resolves the configured policy category for an operation's actual approval requirement.

      Credential revocation is ordinarily approval-free. A matching RBAC grant may condition that permission on approval, in which case the existing high-risk approval policy supplies the real approval workflow without classifying every revocation as high risk.

      Parameters:
      operation - exact typed operation
      grantApprovalRequired - whether the authorizing grant requires approval
      Returns:
      policy category, or OperationSecurityDescriptors.ApprovalCategory.NONE when approval is not required

    • validateResource

      public void validateResource(PkiOperation operation, Permission.Resource resource)
      Verifies that caller-supplied security scope matches operation identities.
      Parameters:
      operation - exact typed PKI operation
      resource - caller-supplied resource and security scope

    • validateResource

      public void validateResource(PkiSigningOperation operation, Permission.Resource resource)
      Checks the exact resource of a signing request before preparation.
      Parameters:
      operation - closed signing operation
      resource - caller-supplied resource