Package zeroecho.pki.server
package zeroecho.pki.server
-
ClassDescriptionExplicit mutually exclusive administrative authentication deployment mode.Immutable trusted administrative actor passed from gateway authorization to control dispatch.One closed administrative namespace spanning PKI and server-control families.Server security-control operation family.Existing transport-neutral PKI operation family.Server-owned inputs for one semantic signing acceptance.Durable exact-operation multi-party approval service.Individual immutable approval choice.One attributable immutable decision.Immutable approval policy.Durable approval authority record.Approval lifecycle states.Explicit certificate/request/status projection boundary for auditor data views.Full binary content projection; byte content is never redacted in place.Full non-PII metadata projection.Explicit PII-enabled projection, separately authorized from content.Redacted metadata projection containing indicators rather than PII.Safe source metadata from which authorized projections are produced.Immutable process policy controlling which logical authorities one realm context may expose.Closed authority-exposure modes.Deterministic side-effect-free default-deny authorization engine.Safe decision codes that reveal no protected-object existence.Finite safe authorization result.One complete authorization input.Transport-owned binary streams opened only after full gateway authorization and approval.Explicit, opt-in budgets for remote backup transfer.Durable, scoped, mandatory-expiry emergency authorization service.Active grants plus their identities for authorization and use auditing.Durable break-glass record.Break-glass lifecycle states.Immutable realm-bound certificate and mathematical key commitments used only for enrollment separation.Immutable realm configuration for credential-confirmation proof challenges.Synchronous stateless gate that freezes confirmation before leaf disclosure.Explicit administrative audit identity, distinct from credential ownership.Durable disclosure authority and capability-based retrieval decision service.Persisted commitment-only capability authority.Safe retrieval result that reveals no protected-object existence.Configuration-driven safe defaults.Durable one-time delivery classification without retaining the raw token.One-time raw-token issuance result.Public-object classes with independent default policies.Typed disclosure owner, keeping ACME accounts outside administrative principals.Closed owner categories.Persisted disclosure states, independent of issuance and publication.Durable policy bound to exact object and profile/policy commitment.Closed forwarding representation selected explicitly by server configuration.Transport-neutral signed-OCSP requester authentication and scoped query authorization.Safe successful authentication result.Exact bounded cryptographic fields retained from one canonical request.Safe authentication or authorization rejection.Dependency corruption or recovery-required authorization authority.Durable exact responder-binding authority over the server control store.Closed nonce behavior.One cryptographic requester-certificate mapping.Cryptographic requester-to-principal mapping type.Closed administrator input without server-authoritative timestamps, state, or record commitments.Closed signed-request authentication policy.Closed local requester-certificate revocation behavior.Finite immutable requester trust, mapping, signature and chain policy.One exact active request-signature binding reference.Strict versioned responder binding.Exact signing authority.Durable activation state.One explicit repository-backed trust selector.Repository-backed requester trust selector.Immutable security descriptors keyed by existing typed-operation identities.Approval treatment for one operation.Immutable operation security descriptor.Future transport eligibility without defining a transport protocol.Internally fixed execution family; callers cannot select it.Closed permission vocabulary and immutable scoped grant model.Stable permission actions; semantic separation is part of the public contract.Closed non-programmable grant conditions.Safe finite context used only by closed conditions.Explicitly separated disclosure and audit data views.Grant effect.Immutable persisted permission grant.Relationship between the requesting principal and the target object.Transport-neutral target reference.Security resource types, distinct from PKI authority ownership.Canonical resource scope supplied independently of object contents.Lifecycle owner for one bounded administrative mutual-TLS HTTPS server.Closed process lifecycle.Strict immutable configuration for one administrative HTTPS server instance.Separately bounded ACME listener and protocol-security configuration.Closed ACME listener transport topologies.Bounded audit-projection policy, independently applied to revocation and each evidence family.Strict mode-separated administrative client-certificate authentication.One exact client-certificate mapping.Configuration for the optional CMP RFC 4210/9480 HTTPS listener.Separately bounded EST protocol listener configuration.Bounded worker, queue, admission, deadline and shutdown policy.HTTPS listener configuration.Separately bounded public repository listener configuration.Process-local capability references.Configuration for the optional SCEP RFC 8894 HTTPS listener.Bounds for one signing-reconciliation pass executed by
SigningReconciliationWorker.Strict current-version server configuration decoder with closed field sets.Production command-line entry point for the administrative HTTPS server.Transport-neutral, read-only disclosed repository gateway.Safe request identity, without certificate or bearer-token logging fields.Safe public authority metadata.Cache policy classes with distinct privacy semantics.Exact explicit chain path represented as ordered immutable certificate links.Lifecycle-owned binary response descriptor.Canonical identity of one PKI realm.Durable non-authoritative repository alias administration.Immutable finite alias metadata; no content bytes or filesystem paths.Durable alias state; removal never deletes its immutable target.Closed stable repository alias types.Strict deterministic loader for versioned built-in role templates.Persistable scoped role assignment; the template itself grants nothing.Immutable role template that has no authority until scoped assignment.Transport-independent authenticated-identity target used by authorization.Closed principal types.Closed transport-neutral server-control administration operation hierarchy.Server-resolved exact profile precondition bound into approval canonicalization.Activation of one already-created approved emergency grant.Activates a suspended enrollment profile.Requests an action on an owned opaque archive or restore workflow.Closed workflow actions and their stable operation identities.Approval cancellation.Lists safe configured metadata and one page of known key references.Independently approved emergency grant creation.Direct grant creation.Scoped assignment creation.Durably deactivates one ACME account without deleting history.Approval or rejection decision.Independently approves or rejects the exact record reviewed by an administrator.De-registers a CMP endpoint by label.De-registers an EST endpoint by label.De-registers a SCEP endpoint by label.Explicit post-issuance enrollment into confirmation and disclosure.Side-effect-free authorization simulation.Executes a restore from a backup artifact.Exports a backup of PKI state, excluding private keys.Creates a file-backed export for a subsequent authorized download.Inspects one protocol-scoped ACME account.Inspects one exact ACME directory revision.Approval lookup.Existing safe auditor projection over one server-control object.Break-glass lookup.Inspects one registered CMP endpoint.Disclosure metadata lookup.Inspects one enrollment profile.Inspects a durable protocol request using its authoritative persisted scope.Inspects one registered EST endpoint.Direct grant lookup.Inspects one exact OCSP responder binding.Principal lookup.Exact repository alias inspection.Scoped assignment lookup.Immutable role-template lookup.Inspects one registered SCEP endpoint.One-time unlisted retrieval capability issuance.Lists a bounded account page without contact PII.Lists a bounded page of ACME directory revisions.Bounded approval page.Bounded break-glass page.Lists non-bearer capabilities for one authoritative disclosure object.Lists registered CMP endpoints.Lists enrollment profiles.Lists retained enrollment requests within the authorized scope.Lists registered EST endpoints.Bounded direct-grant page.Lists a bounded OCSP responder page.Bounded principal page.Bounded repository alias page.Bounded assignment page.Immutable role-template list.Lists registered SCEP endpoints.Registers one immutable inactive ACME directory revision.Registers a CMP RFC 4210/9480 endpoint.Registers a new enrollment profile.Registers an EST RFC 7030 endpoint.Registers one exact inactive OCSP responder binding.Principal registration.Registers a SCEP RFC 8894 endpoint.Durable repository alias removal without target mutation.Exact future-operation approval request.Reserves bounded storage for a streaming archive upload.Break-glass revocation.Capability revocation by non-bearer record identity.Durable direct-grant revocation.Durable assignment revocation.Bounded audit-log search over the packaged admin API; preserves tamper-evidence (read-only).Activates or deactivates one exact ACME directory revision.Disclosure-only state transition.Activates or deactivates one exact responder.Principal enablement transition.Exact CRL or chain alias publication with expected-current protection.Suspends an active enrollment profile.Updates an existing enrollment profile (replaces all mutable fields).Verifies the audit-log hash chain, optionally against a trusted head anchor.Verifies structural integrity and completeness of a backup artifact.Sole closed dispatcher for transport-neutral server-control operations.Closed server-control result with explicit one-time-sensitive handling.Response handling classification.Single-consumption capability delivery result, never a PKI operation value.Ordinary safe replayable operation result.Dedicated durable authority for finite server security and disclosure control metadata.Finite page returned without materializing the complete namespace.Thread-confined, closeable iterator over one immutable protocol snapshot.One compare-and-set mutation participating in an atomic protocol-state change.Strict opaque protocol payload framed by the server-control authority.Durable realm-control identity and commitments.In-process transport-neutral security gateway for existing typed PKI operations.Closed gateway outcome preserving typed backend results.High-risk operation requires a separately created durable approval.Successfully admitted server-control result.Safe denial without protected-object existence information.Successfully admitted operation and exact backend outcome.Complete transport-neutral request admission input.Executes one already-authorized signing operation through semantic admission.Immutable transport-neutral configuration for one server realm.Lifecycle owner for one server realm, one long-lived PKI session, and one dedicated durable server-control authority.Closed lifecycle states.