Class RepositoryAliasService

java.lang.Object

zeroecho.pki.server.RepositoryAliasService

public final class RepositoryAliasService
extends Object

Durable non-authoritative repository alias administration.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	RepositoryAliasService.Record	Immutable finite alias metadata; no content bytes or filesystem paths.
static enum	RepositoryAliasService.State	Durable alias state; removal never deletes its immutable target.
static enum	RepositoryAliasService.Type	Closed stable repository alias types.

Constructor Summary

Constructors

Constructor	Description
RepositoryAliasService(RealmId realmId, ServerControlStore store, PkiRepository repository, DisclosureService disclosure, Clock clock, AuditSink auditSink)	Creates a repository alias authority over one realm control store.

Method Summary

Modifier and Type	Method	Description
static String	idFor(RealmId realmId, PkiId authorityId, RepositoryAliasService.Type type)	Returns the deterministic alias ID for one realm, authority, and type.
ServerControlStore.Page<RepositoryAliasService.Record>	list(int offset, int limit)	Returns a bounded alias page.
RepositoryAliasService.Record	remove(PkiId authorityId, RepositoryAliasService.Type type, String expectedCommitment, String actorPrincipalId)	Atomically removes an alias without deleting its target.
RepositoryAliasService.Record	require(PkiId authorityId, RepositoryAliasService.Type type)	Returns an exact alias, including a durable removed record.
RepositoryAliasService.Record	setCurrentChain(PkiId authorityId, PkiId issuerId, PkiId pathId, Optional<String> expected, String actorPrincipalId)	Atomically publishes one exact current public chain path.
RepositoryAliasService.Record	setCurrentCrl(PkiId authorityId, PkiId statusObjectId, Optional<String> expected, String actorPrincipalId)	Atomically publishes a validated current-CRL alias.
RepositoryAliasService.Record	setCurrentDeltaCrl(PkiId authorityId, PkiId statusObjectId, Optional<String> expected, String actorPrincipalId)	Atomically publishes a validated current-delta-CRL alias.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RepositoryAliasService

public RepositoryAliasService(RealmId realmId,
 ServerControlStore store,
 PkiRepository repository,
 DisclosureService disclosure,
 Clock clock,
 AuditSink auditSink)

Creates a repository alias authority over one realm control store.

Parameters:

realmId - owning security realm

store - durable server-control store

repository - authoritative PKI repository

disclosure - effective disclosure-policy service

clock - authoritative server clock

auditSink - required safe audit sink

Method Details

require

public RepositoryAliasService.Record require(PkiId authorityId,
 RepositoryAliasService.Type type)

Returns an exact alias, including a durable removed record.

Parameters:

authorityId - exact logical authority identifier

type - repository alias type

Returns:

exact durable alias including removed state

list

public ServerControlStore.Page<RepositoryAliasService.Record> list(int offset,
 int limit)

Returns a bounded alias page.

Parameters:

offset - zero-based page offset

limit - positive page-size limit

Returns:

bounded alias page

setCurrentCrl

public RepositoryAliasService.Record setCurrentCrl(PkiId authorityId,
 PkiId statusObjectId,
 Optional<String> expected,
 String actorPrincipalId)

Atomically publishes a validated current-CRL alias.

Parameters:

authorityId - exact logical authority identifier

statusObjectId - exact immutable status-object identifier

expected - optional expected current alias commitment

actorPrincipalId - authenticated audit actor

Returns:

durably active current-CRL alias

setCurrentDeltaCrl

public RepositoryAliasService.Record setCurrentDeltaCrl(PkiId authorityId,
 PkiId statusObjectId,
 Optional<String> expected,
 String actorPrincipalId)

Atomically publishes a validated current-delta-CRL alias.

Parameters:

authorityId - exact logical authority identifier

statusObjectId - exact immutable status-object identifier

expected - optional expected current alias commitment

actorPrincipalId - authenticated audit actor

Returns:

durably active current-delta-CRL alias

setCurrentChain

public RepositoryAliasService.Record setCurrentChain(PkiId authorityId,
 PkiId issuerId,
 PkiId pathId,
 Optional<String> expected,
 String actorPrincipalId)

Atomically publishes one exact current public chain path.

Parameters:

authorityId - exact logical authority identifier

issuerId - exact issuer generation

pathId - exact issuer chain path

expected - optional expected current alias commitment

actorPrincipalId - authenticated audit actor

Returns:

durably active current-chain alias

remove

public RepositoryAliasService.Record remove(PkiId authorityId,
 RepositoryAliasService.Type type,
 String expectedCommitment,
 String actorPrincipalId)

Atomically removes an alias without deleting its target.

Parameters:

authorityId - exact logical authority identifier

type - repository alias type

expectedCommitment - required current alias commitment

actorPrincipalId - authenticated audit actor

Returns:

durably removed alias record

idFor

public static String idFor(RealmId realmId,
 PkiId authorityId,
 RepositoryAliasService.Type type)

Returns the deterministic alias ID for one realm, authority, and type.

Parameters:

realmId - owning security realm

authorityId - exact logical authority identifier

type - repository alias type

Returns:

deterministic alias identifier