Class EnrollmentRuntime

java.lang.Object
zeroecho.pki.server.enrollment.EnrollmentRuntime
All Implemented Interfaces:
AutoCloseable
public final class EnrollmentRuntime extends Object implements AutoCloseable
Thread-safe realm owner of dedicated enrollment keyrings and immutable authority-scoped credentials. Acquisition is bounded and atomic with shutdown. No caller callback runs under a runtime or control-store monitor.

Closing fences new leases immediately. If borrowers remain, close fails without releasing keys or exclusive file ownership; callers must drain them and retry. This permits the server's bounded shutdown protocol without destroying credentials underneath a live operation.

  • Method Details

    • validateConfiguration

      public static void validateConfiguration(PkiServerConfiguration server, Optional<EnrollmentRuntimeConfiguration> enrollment, Optional<BackupTransferConfiguration> backup)
      Validates companion presence and lexical storage separation without opening stores. Actual paths, keys, certificates and authority records are checked by open(EnrollmentRuntimeConfiguration, ServerRealmConfiguration, PkiRepository, ServerControlStore, EnrollmentEndpointRegistry, PkiSessionRuntimeDependencies, Clock, Optional).
      Parameters:
      server - main schema-8 configuration
      enrollment - explicit optional companion
      backup - optional independently configured backup spool

    • open

      public static EnrollmentRuntime open(EnrollmentRuntimeConfiguration configuration, ServerRealmConfiguration realm, PkiRepository repository, ServerControlStore control, EnrollmentEndpointRegistry endpoints, PkiSessionRuntimeDependencies dependencies, Clock clock, Optional<BackupTransferConfiguration> backup)
      Opens preprovisioned encrypted keyrings, validates the complete credential graph and atomically pins immutable public commitments in server control. Failed construction closes every acquired keyring owner. Parsing and key provider calls happen before any control-store transaction.
      Parameters:
      configuration - strict explicit companion
      realm - exact realm settings
      repository - authoritative issuer and certificate repository
      control - durable realm control
      endpoints - registry owned by the same durable realm control
      dependencies - existing process-local unlock capability
      clock - validity clock
      backup - optional backup spool to exclude from custody paths
      Returns:
      fully validated lifecycle owner
      Throws:
      IllegalStateException - if custody, integrity or credential validation fails

    • configuration

      public EnrollmentRuntimeConfiguration configuration()
      Returns explicit immutable settings; no credential material is exposed.
      Returns:
      runtime configuration

    • requireRetainedCredential

      public void requireRetainedCredential(String credentialId)
      Validates that an exact immutable credential set remains provisioned for a retained transaction. Expiry forbids wire use but does not erase recovery provenance. This metadata-only check acquires no key lease.
      Parameters:
      credentialId - retained immutable credential identity

    • requireRetainedCredential

      public void requireRetainedCredential(String credentialId, String authorityId, String issuerId, String pathId)
      Validates the exact immutable scope of retained credential metadata without requiring current certificate validity or acquiring a private-key lease. Expired credentials may establish recovery provenance but cannot sign.
      Parameters:
      credentialId - retained credential-set identity
      authorityId - frozen logical authority
      issuerId - frozen issuer generation
      pathId - frozen chain path

    • requireRetainedCredential

      public void requireRetainedCredential(EnrollmentRuntimeConfiguration.Protocol protocol, String credentialId, String authorityId, String issuerId, String pathId)
      Checks retained credential scope and its exact protocol capability without acquiring a lease or requiring unexpired signing material.
      Parameters:
      protocol - frozen protocol role; never inferred from another credential
      credentialId - retained immutable credential identity
      authorityId - frozen authority
      issuerId - frozen issuer generation
      pathId - frozen chain path

    • requireAdmissionCredential

      public void requireAdmissionCredential(String credentialId, String authorityId, String issuerId, String pathId)
      Checks a retained credential's current validity and exact frozen authority binding before an unclaimed request is admitted. Does not load private keys or replace the active selection for new requests.
      Parameters:
      credentialId - frozen credential identity
      authorityId - expected logical authority
      issuerId - expected issuer generation
      pathId - expected issuer chain path

    • activeCredentialId

      public String activeCredentialId(EnrollmentRuntimeConfiguration.Protocol protocol, String authorityId)
      Resolves the immutable selection for a new transaction.
      Parameters:
      protocol - exact protocol
      authorityId - exact authority
      Returns:
      configured credential-set identity
      Throws:
      IllegalStateException - if absent, expired, or quiescing

    • admissionDeadline

      public Instant admissionDeadline(String credentialId)
      Returns a deadline bounded by both pending lifetime and the exact authority/response/trust certificate validity window.
      Parameters:
      credentialId - retained immutable credential-set identity
      Returns:
      latest permitted pending deadline

    • credentialNotAfter

      public Instant credentialNotAfter(String credentialId)
      Returns the immutable end of the credential and validated chain validity window. Unlike the admission deadline this does not shorten delivery to the pending lifetime. Expired retained material remains identifiable for recovery.
      Parameters:
      credentialId - exact retained credential-set identity
      Returns:
      exclusive upper bound for credential use and encrypted-key delivery

    • validateEndpoint

      public void validateEndpoint(EnrollmentEndpoint endpoint)
      Validates an endpoint's provisioned capability without loading keys or invoking providers. Suitable for the registry's serialized policy guard.
      Parameters:
      endpoint - exact registration or admission binding

    • acquire

      public EnrollmentRuntime.CredentialLease acquire(String credentialId)
      Acquires bounded access to an exact current or retained credential set. The caller must close the lease and must not retain private/secret keys beyond it. Expired credentials remain pinned but cannot protect responses.
      Parameters:
      credentialId - immutable transaction-selected credential identity
      Returns:
      closeable credential lease
      Throws:
      IllegalStateException - if unavailable, expired, or capacity is exhausted

    • close

      public void close()
      Fences new leases and releases exclusive custody only after all borrowers have released their leases. Idempotent after a successful close.
      Specified by:
      close in interface AutoCloseable
      Throws:
      IllegalStateException - if borrowers still hold leases; retry after draining