Class EnrollmentEndpointRegistry

java.lang.Object
zeroecho.pki.server.enrollment.EnrollmentEndpointRegistry
public final class EnrollmentEndpointRegistry extends Object
Realm-owned, thread-safe durable endpoint registry.

Every replacement or removal advances a monotonic revision. Removal retains a tombstone; re-registration cannot reuse an earlier revision or commitment. Writes use the control store's atomic compare-and-set boundary. The caller owns the store and must keep it open throughout registry use.

  • Constructor Details

    • EnrollmentEndpointRegistry

      public EnrollmentEndpointRegistry(ServerControlStore control, EnrollmentProfileService profiles)
      Opens the registry and validates every persisted record and active binding. A suspended profile is permitted at startup so administrators can reactivate it.
      Parameters:
      control - realm-owned open persistence authority
      profiles - realm-owned enrollment profile registry
      Throws:
      IllegalStateException - if persisted records or active references are invalid

  • Method Details

    • installRuntime

      public void installRuntime(EnrollmentRuntime capability)
      Validates every active endpoint, durably pins the credential identities, and installs custody under the same control-store monitor. A validation failure writes no pin; uncertain persistence is never rolled back. Validation uses immutable provisioned metadata, never key-provider calls.
      Parameters:
      capability - fully validated runtime owner

    • register

      public EnrollmentEndpointRegistry.Snapshot register(EnrollmentEndpoint endpoint)
      Creates or atomically replaces an endpoint after validating its active policy.
      Parameters:
      endpoint - complete immutable endpoint with an explicit enrollment policy
      Returns:
      exact committed snapshot
      Throws:
      IllegalStateException - if binding validation, CAS, or persistence fails

    • deregister

      public Optional<EnrollmentEndpoint> deregister(EnrollmentEndpointRegistry.Protocol protocol, String label)
      Atomically tombstones an active endpoint without discarding its revision.
      Parameters:
      protocol - exact protocol family
      label - canonical label
      Returns:
      removed configuration, or empty if absent or already removed

    • find

      public Optional<EnrollmentEndpoint> find(EnrollmentEndpointRegistry.Protocol protocol, String label)
      Reads one active endpoint without admitting an enrollment request.
      Parameters:
      protocol - exact protocol family
      label - canonical label
      Returns:
      active configuration, or empty for absent/tombstoned identities

    • list

      public List<EnrollmentEndpoint> list(EnrollmentEndpointRegistry.Protocol protocol)
      Collects active endpoints in deterministic control-store order. Concurrent writes across pages do not form one atomic snapshot.
      Parameters:
      protocol - exact protocol family
      Returns:
      immutable configurations; O(N) retained output memory

    • requireCurrent

      public EnrollmentEndpointRegistry.Snapshot requireCurrent(EnrollmentEndpoint endpoint)
      Revalidates the exact endpoint and current active enrollment policy at admission. The returned revision must be frozen by workflows that outlive this call.
      Parameters:
      endpoint - configuration resolved for the incoming protocol request
      Returns:
      exact current active endpoint snapshot
      Throws:
      IllegalStateException - if removed, replaced, unbound, suspended, or unauthorized

    • commitment

      public static String commitment(EnrollmentEndpoint endpoint)
      Commits all endpoint fields independently of the storage revision.
      Parameters:
      endpoint - complete proposed configuration
      Returns:
      lowercase SHA-256 content commitment