Record Class IssuanceExecutionEvidence

java.lang.Object
java.lang.Record
zeroecho.pki.application.IssuanceExecutionEvidence
Record Components:
actorType - authenticated actor classification
actorId - authenticated administrative or protocol requester identifier
realmId - realm identity
requestId - trusted originating invocation correlation identifier
authentication - authentication classification
authorization - authorization classification
authorizationPath - exact administrative or enrollment path (absent for legacy ACME ownership evidence)
operationCommitment - exact durable operation commitment (absent for legacy ACME ownership evidence)
issuerCaId - issuing authority identity
profileId - frozen certificate-profile identity governing issuance
outcome - outcome committed atomically with the credential
public record IssuanceExecutionEvidence(IssuanceExecutionEvidence.ActorType actorType, String actorId, String realmId, String requestId, IssuanceExecutionEvidence.Authentication authentication, IssuanceExecutionEvidence.Authorization authorization, Optional<IssuanceExecutionEvidence.AuthorizationPath> authorizationPath, Optional<String> operationCommitment, String issuerCaId, String profileId, IssuanceExecutionEvidence.Outcome outcome) extends Record
Immutable, server-derived evidence co-committed with a successful end-entity issuance.

The evidence is written into the issued Credential's universal attribute set in the same atomic durable write as the credential itself, so a committed credential always carries its authenticated issuance provenance. Native credential fields remain the authority for identity, issuer, profile, validity, and status; this evidence records only the authenticated actor and authorization path that produced it. It mirrors RevocationExecutionEvidence so the two families project through the same generic audit-projection framework.

  • Field Details

    • ACTOR_TYPE

      public static final AttributeId ACTOR_TYPE
      Evidence attribute vocabulary.

    • ACTOR_ID

      public static final AttributeId ACTOR_ID
      Evidence attribute vocabulary.

    • REALM_ID

      public static final AttributeId REALM_ID
      Evidence attribute vocabulary.

    • REQUEST_ID

      public static final AttributeId REQUEST_ID
      Evidence attribute vocabulary.

    • AUTHENTICATION

      public static final AttributeId AUTHENTICATION
      Evidence attribute vocabulary.

    • AUTHORIZATION

      public static final AttributeId AUTHORIZATION
      Evidence attribute vocabulary.

    • AUTHORIZATION_PATH

      public static final AttributeId AUTHORIZATION_PATH
      Evidence attribute vocabulary.

    • OPERATION_COMMITMENT

      public static final AttributeId OPERATION_COMMITMENT
      Evidence attribute vocabulary.

    • ISSUER_CA_ID

      public static final AttributeId ISSUER_CA_ID
      Evidence attribute vocabulary.

    • PROFILE_ID

      public static final AttributeId PROFILE_ID
      Evidence attribute vocabulary.

    • OUTCOME

      public static final AttributeId OUTCOME
      Evidence attribute vocabulary.

  • Constructor Details

  • Method Details

    • administrative

      public static IssuanceExecutionEvidence administrative(String principalId, String realmId, String requestId, IssuanceExecutionEvidence.Authentication authentication, IssuanceExecutionEvidence.AuthorizationPath path, String operationCommitment, String issuerCaId, String profileId)
      Creates authoritative administrative issuance evidence.
      Parameters:
      principalId - bounded authenticated administrator identifier
      realmId - bounded authorization realm identifier
      requestId - trusted originating invocation correlation identifier
      authentication - direct mutual TLS or trusted reverse-proxy mutual TLS
      path - administrative grant, approval, or break-glass path
      operationCommitment - lowercase 64-hex-character operation commitment
      issuerCaId - issuing authority identifier
      profileId - frozen certificate-profile identifier
      Returns:
      validated immutable administrative evidence

    • acme

      public static IssuanceExecutionEvidence acme(String accountId, String realmId, String requestId, String issuerCaId, String profileId)
      Creates authoritative protocol-native ACME issuance evidence.
      Parameters:
      accountId - bounded ACME account identifier
      realmId - bounded authorization realm identifier
      requestId - trusted originating invocation correlation identifier
      issuerCaId - issuing authority identifier
      profileId - frozen certificate-profile identifier
      Returns:
      validated immutable ACME ownership evidence

    • enrollment

      public static IssuanceExecutionEvidence enrollment(IssuanceExecutionEvidence.ActorType actorType, String actorId, String realmId, String requestId, IssuanceExecutionEvidence.Authentication authentication, boolean approved, String operationCommitment, String issuerCaId, String profileId)
      Creates evidence for a verified protocol requester admitted through an exact durable enrollment policy and, when required, independent approval. This factory grants no authority and cannot represent an administrator.
      Parameters:
      actorType - protocol-native requester classification
      actorId - authenticated protocol identity
      realmId - owning realm
      requestId - durable enrollment request identity
      authentication - matching verified protocol mechanism
      approved - whether the frozen policy required and obtained approval
      operationCommitment - complete frozen enrollment intent commitment
      issuerCaId - frozen issuing authority
      profileId - frozen certificate profile
      Returns:
      immutable evidence suitable for exact signing-context validation

    • attributes

      public AttributeSet attributes()
      Returns an immutable set containing only the closed evidence vocabulary.
      Returns:
      canonical version-one evidence attributes

    • decode

      public static Optional<IssuanceExecutionEvidence> decode(AttributeSet attributes)
      Strictly decodes the closed version-one evidence vocabulary.
      Parameters:
      attributes - credential attributes to inspect
      Returns:
      empty only when no version-one evidence attribute is present
      Throws:
      IllegalArgumentException - if evidence is unknown, partial, duplicated, mistyped, or semantically inconsistent

    • decode

      public static Optional<IssuanceExecutionEvidence> decode(byte[] payload)
      Decodes a feed payload containing UTF-8 canonical unpadded base64url attributes. The encoded byte count is bounded before allocation; the existing attribute decoder enforces canonical framing and its decoded-byte and entry limits.
      Parameters:
      payload - exact evidence-feed bytes, borrowed for this call
      Returns:
      empty only when this evidence family's vocabulary is absent
      Throws:
      IllegalArgumentException - if framing or this family's vocabulary is invalid

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • actorType

      public IssuanceExecutionEvidence.ActorType actorType()
      Returns the value of the actorType record component.
      Returns:
      the value of the actorType record component

    • actorId

      public String actorId()
      Returns the value of the actorId record component.
      Returns:
      the value of the actorId record component

    • realmId

      public String realmId()
      Returns the value of the realmId record component.
      Returns:
      the value of the realmId record component

    • requestId

      public String requestId()
      Returns the value of the requestId record component.
      Returns:
      the value of the requestId record component

    • authentication

      public IssuanceExecutionEvidence.Authentication authentication()
      Returns the value of the authentication record component.
      Returns:
      the value of the authentication record component

    • authorization

      public IssuanceExecutionEvidence.Authorization authorization()
      Returns the value of the authorization record component.
      Returns:
      the value of the authorization record component

    • authorizationPath

      public Optional<IssuanceExecutionEvidence.AuthorizationPath> authorizationPath()
      Returns the value of the authorizationPath record component.
      Returns:
      the value of the authorizationPath record component

    • operationCommitment

      public Optional<String> operationCommitment()
      Returns the value of the operationCommitment record component.
      Returns:
      the value of the operationCommitment record component

    • issuerCaId

      public String issuerCaId()
      Returns the value of the issuerCaId record component.
      Returns:
      the value of the issuerCaId record component

    • profileId

      public String profileId()
      Returns the value of the profileId record component.
      Returns:
      the value of the profileId record component

    • outcome

      public IssuanceExecutionEvidence.Outcome outcome()
      Returns the value of the outcome record component.
      Returns:
      the value of the outcome record component