Class EnrollmentProfileService

java.lang.Object
zeroecho.pki.server.enrollment.EnrollmentProfileService
public final class EnrollmentProfileService extends Object
Durable, thread-safe enrollment profile registry owned by one realm.

Writes use the server-control transaction boundary and compare-and-set commitments. Concurrent replacement conflicts fail rather than losing an update. Every stored replacement advances a revision, including a replacement with identical policy, so an intervening change cannot evade the comparison. The caller owns and closes the supplied store. Construction validates all persisted profiles before the realm accepts requests.

Since:
1.0

  • Constructor Details

    • EnrollmentProfileService

      public EnrollmentProfileService(ServerControlStore control)
      Opens and validates the realm's durable registry.
      Parameters:
      control - open realm-owned server-control store
      Throws:
      IllegalStateException - if a stored profile is corrupt or unsupported

  • Method Details

    • register

      public void register(EnrollmentProfile profile)
      Durably creates a profile; existing identities cannot be overwritten.
      Parameters:
      profile - non-null immutable profile to persist
      Throws:
      IllegalStateException - if the identity exists or persistence fails

    • update

      public EnrollmentProfile update(EnrollmentProfile profile)
      Updates an existing enrollment profile. Active endpoint bindings must remain compatible with the certificate profile and allowed authorities. Deregister incompatible endpoints before changing those fields; suspension itself is always permitted. Validation and commit share the control-store monitor with endpoint registration.
      Parameters:
      profile - non-null replacement profile
      Returns:
      the durably committed replacement
      Throws:
      IllegalArgumentException - if no profile with the given id exists
      IllegalStateException - if an active endpoint would become incompatible, a concurrent change conflicts, or persistence fails

    • find

      public Optional<EnrollmentProfile> find(String id)
      Looks up the current profile by identifier.
      Parameters:
      id - non-null identifier
      Returns:
      the observed profile, or empty if absent

    • list

      public List<EnrollmentProfile> list()
      Collects all current profiles in deterministic store-key order. Concurrent writes between pages need not form one atomic snapshot.
      Returns:
      immutable profiles; O(N) retained profile memory

    • requireBinding

      public EnrollmentProfile requireBinding(String id, String certificateProfileId, String authorityId, boolean active)
      Resolves a compatible enrollment binding under the shared control monitor.
      Parameters:
      id - enrollment policy identity
      certificateProfileId - distinct certificate policy identity
      authorityId - selected logical authority
      active - whether admission requires an active policy
      Returns:
      exact current compatible policy

    • requireBinding

      public static EnrollmentProfile requireBinding(ServerControlStore control, String id, String certificateProfileId, String authorityId, boolean active)
      Resolves one policy without constructing another registry or scanning it. Protocol registries use the same control monitor for validation and mutation.
      Parameters:
      control - owning realm authority
      id - enrollment policy identity
      certificateProfileId - selected certificate profile
      authorityId - selected authority
      active - whether the profile must be active
      Returns:
      exact compatible profile

    • list

      public ServerControlStore.Page<EnrollmentProfile> list(int offset, int limit)
      Reads a bounded page without retaining the complete registry.
      Parameters:
      offset - nonnegative store-key offset
      limit - page size accepted by the server-control store
      Returns:
      immutable page in deterministic store-key order

    • setState

      public EnrollmentProfile setState(String id, EnrollmentProfileState state)
      Transitions the profile to the given state.
      Parameters:
      id - non-null profile identifier
      state - non-null replacement state
      Returns:
      the durably committed profile
      Throws:
      IllegalArgumentException - if no profile with the given id exists
      IllegalStateException - if a concurrent change conflicts or persistence fails

    • commitment

      public static String commitment(EnrollmentProfile profile)
      Commits every policy field using the same canonical encoding as persistence. Set ordering is normalized; list ordering and optional-value presence are preserved.
      Parameters:
      profile - exact proposed policy
      Returns:
      lowercase SHA-256 commitment, independent of its storage revision
      Throws:
      IllegalArgumentException - if the profile exceeds the finite encoding bounds