Class ServerControlOperationExecutor

java.lang.Object

zeroecho.pki.server.ServerControlOperationExecutor

public final class ServerControlOperationExecutor
extends Object

Sole closed dispatcher for transport-neutral server-control operations.

Constructor Summary

Constructors

Constructor

Description

ServerControlOperationExecutor(PkiOperationExecutor pkiExecutor, RealmId realmId, AuthorityExposurePolicy exposure, ServerControlStore store, RoleTemplateCatalog roles, AuthorizationEngine authorization, ApprovalService approvals, BreakGlassService breakGlass, DisclosureService disclosure, CredentialPublicationGate credentialPublication, AuditorViews auditorViews, Optional<RepositoryAliasService> repositoryAliases, OperationSecurityDescriptors descriptors, Map<OperationSecurityDescriptors.ApprovalCategory, ApprovalService.Policy> approvalPolicies)

Creates the one control dispatcher over existing durable authorities.

Method Summary

Modifier and Type	Method	Description
Permission.Scope	enrollmentScope(String id)	Resolves scope from the retained request before gateway authorization.
ServerControlOperationOutcome	execute(ServerControlOperation operation, String actorPrincipalId, Permission.Resource authorizedResource, Optional<String> approvalId, CancellationSignal cancellation)	Executes exactly one already-authorized control operation synchronously.
void	installAcme(AcmeService service)	Installs the explicitly configured ACME capability exactly once before listener readiness.
void	installAudit(AuditService search, AuditIntegrityService integrity)	Installs the queryable/verifiable audit capability exactly once.
void	installBackup(BackupService backupService)	Installs the backup capability exactly once.
void	installCmp(CmpService service)	Installs the CMP RFC 4210/9480 endpoint registry exactly once before listener readiness.
void	installEnrollmentCoordinator(EnrollmentCoordinator service)	Installs the realm-owned durable protocol approval coordinator exactly once.
void	installEnrollmentProfiles(EnrollmentProfileService service)	Installs the enrollment profile registry exactly once before listener readiness.
void	installEst(EstService service)	Installs the EST RFC 7030 endpoint registry exactly once before listener readiness.
void	installOcsp(OcspResponderService service)	Installs the realm-owned durable OCSP responder capability exactly once.
void	installScep(ScepService service)	Installs the SCEP RFC 8894 endpoint registry exactly once before listener readiness.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ServerControlOperationExecutor

public ServerControlOperationExecutor(PkiOperationExecutor pkiExecutor,
 RealmId realmId,
 AuthorityExposurePolicy exposure,
 ServerControlStore store,
 RoleTemplateCatalog roles,
 AuthorizationEngine authorization,
 ApprovalService approvals,
 BreakGlassService breakGlass,
 DisclosureService disclosure,
 CredentialPublicationGate credentialPublication,
 AuditorViews auditorViews,
 Optional<RepositoryAliasService> repositoryAliases,
 OperationSecurityDescriptors descriptors,
 Map<OperationSecurityDescriptors.ApprovalCategory, ApprovalService.Policy> approvalPolicies)

Creates the one control dispatcher over existing durable authorities.

The credential-publication gate must use the same disclosure service supplied to this constructor.

Parameters:

pkiExecutor - realm-owned executor supplying typed safe runtime choices

realmId - exact realm identity

exposure - authority exposure policy for the realm

store - durable server-control store

roles - role-template catalog

authorization - authorization engine

approvals - durable approval service

breakGlass - emergency-access service

disclosure - durable disclosure service

credentialPublication - authoritative credential-publication gate

auditorViews - audit-view service

repositoryAliases - optional repository-alias capability

descriptors - closed operation-security descriptor catalog

approvalPolicies - approval policy by operation category

Method Details

execute

public ServerControlOperationOutcome execute(ServerControlOperation operation,
 String actorPrincipalId,
 Permission.Resource authorizedResource,
 Optional<String> approvalId,
 CancellationSignal cancellation)

Executes exactly one already-authorized control operation synchronously.

Parameters:

operation - exact control operation

actorPrincipalId - authenticated actor identity

authorizedResource - resource proven by gateway authorization

approvalId - optional approval identity presented for the operation

cancellation - cancellation signal checked before dispatch

Returns:

finite control-operation outcome

installAcme

public void installAcme(AcmeService service)

Installs the explicitly configured ACME capability exactly once before listener readiness.

Parameters:

service - realm-owned ACME service

Throws:

IllegalStateException - if an ACME service is already installed

installOcsp

public void installOcsp(OcspResponderService service)

Installs the realm-owned durable OCSP responder capability exactly once.

Parameters:

service - realm-owned OCSP responder service

Throws:

IllegalStateException - if an OCSP service is already installed

installEst

public void installEst(EstService service)

Installs the EST RFC 7030 endpoint registry exactly once before listener readiness.

Parameters:

service - realm-owned EST service

Throws:

IllegalStateException - if an EST service is already installed

installScep

public void installScep(ScepService service)

Installs the SCEP RFC 8894 endpoint registry exactly once before listener readiness.

Parameters:

service - realm-owned SCEP service

Throws:

IllegalStateException - if a SCEP service is already installed

installCmp

public void installCmp(CmpService service)

Installs the CMP RFC 4210/9480 endpoint registry exactly once before listener readiness.

Parameters:

service - realm-owned CMP service

Throws:

IllegalStateException - if a CMP service is already installed

installEnrollmentProfiles

public void installEnrollmentProfiles(EnrollmentProfileService service)

Installs the enrollment profile registry exactly once before listener readiness.

Parameters:

service - realm-owned enrollment profile service

Throws:

IllegalStateException - if an enrollment profile service is already installed

installEnrollmentCoordinator

public void installEnrollmentCoordinator(EnrollmentCoordinator service)

Installs the realm-owned durable protocol approval coordinator exactly once.

Parameters:

service - validated coordinator

enrollmentScope

public Permission.Scope enrollmentScope(String id)

Resolves scope from the retained request before gateway authorization.

Parameters:

id - persisted enrollment identity

Returns:

exact authoritative realm/authority/issuer/profile scope

installAudit

public void installAudit(AuditService search,
 AuditIntegrityService integrity)

Installs the queryable/verifiable audit capability exactly once.

Only invoked when the configured audit sink supports bounded search and hash-chain verification; otherwise the audit admin operations fail closed as unsupported.

Parameters:

search - bounded audit-log search capability

integrity - audit-log integrity-verification capability

installBackup

public void installBackup(BackupService backupService)

Installs the backup capability exactly once.

Parameters:

backupService - backup service backed by the store

Throws:

NullPointerException - if backupService is null

IllegalStateException - if a backup service is already installed