Class DefaultCredentialConfirmationService

java.lang.Object

zeroecho.pki.impl.core.DefaultCredentialConfirmationService

All Implemented Interfaces:

CredentialConfirmationService

public final class DefaultCredentialConfirmationService
extends Object
implements CredentialConfirmationService

Default store-backed confirmation facade with session lifecycle enforcement.

Proof issuance takes O(D + K) CPU time. Pending proof verification takes O(D + T + R + V(K)) CPU time, where D is certificate DER length bounded to 1 MiB, T is canonical proof-transcript length bounded to 2 KiB, R is response length bounded by the exact suite descriptor, and V(K) is the provider's algorithm-dependent verification cost for key K. Verification additionally performs a constant count of O(log M) metadata point operations and one best-effort audit I/O operation. Peak auxiliary memory is bounded but has parser-dependent constants and object graphs; it includes the DER, canonical re-encoding, parsed certificate, extracted key, temporary public-key encodings, and bounded proof objects. Exact terminal replay performs only bounded point-store work and does not invoke a proof provider.

Constructor Summary

Constructors

Constructor	Description
DefaultCredentialConfirmationService(PkiStore store, Runnable lifecycleGuard, Map<String, KeyPossessionProofProvider> proofProviders, Optional<CredentialConfirmationProofRuntimePolicy> proofPolicy, SecureRandom secureRandom, Optional<AuditSink> auditSink, Clock clock)	Creates a facade over one session-owned store.

Method Summary

Modifier and Type	Method	Description
Optional<CredentialConfirmationLifecycle>	get(PkiId credentialId)	Returns one authoritative lifecycle when initialized.
CredentialConfirmationLifecycle	initialize(CredentialConfirmationInitialization initialization)	Initializes or exactly replays one frozen confirmation lifecycle.
CredentialConfirmationProofChallenge	issueProofChallenge(CredentialConfirmationProofChallengeRequest request)	Issues or exactly replays one authoritative key-possession proof challenge.
CredentialConfirmationReviewPage	pagePendingReviews(PkiId authorityId, Optional<String> profileId, Instant cutoffInclusive, Optional<CredentialConfirmationReviewCursor> afterExclusive, int limit)	Returns one bounded snapshot-consistent page of reduced pending reviews.
CredentialConfirmationProofResult	verifyAndComplete(CredentialConfirmationProofSubmission submission)	Resolves one bounded key-possession response against its exact confirmation lifecycle.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DefaultCredentialConfirmationService

public DefaultCredentialConfirmationService(PkiStore store,
 Runnable lifecycleGuard,
 Map<String, KeyPossessionProofProvider> proofProviders,
 Optional<CredentialConfirmationProofRuntimePolicy> proofPolicy,
 SecureRandom secureRandom,
 Optional<AuditSink> auditSink,
 Clock clock)

Creates a facade over one session-owned store.

Parameters:

store - authoritative store owned by the session

lifecycleGuard - guard rejecting access outside the session lifecycle

proofProviders - immutable suite-ID lookup composed before store use

proofPolicy - optional immutable server-controlled challenge policy

secureRandom - session-local cryptographically secure nonce source

auditSink - optional session-owned best-effort audit sink

clock - authoritative session clock used for proof liveness and audit timestamps

Method Details

initialize

public CredentialConfirmationLifecycle initialize(CredentialConfirmationInitialization initialization)

Description copied from interface: CredentialConfirmationService

Initializes or exactly replays one frozen confirmation lifecycle.

Specified by:

initialize in interface CredentialConfirmationService

Parameters:

initialization - exact immutable initialization inputs

Returns:

committed initial or identical existing lifecycle

get

public Optional<CredentialConfirmationLifecycle> get(PkiId credentialId)

Description copied from interface: CredentialConfirmationService

Returns one authoritative lifecycle when initialized.

Specified by:

get in interface CredentialConfirmationService

Parameters:

credentialId - exact credential identity

Returns:

current lifecycle, or empty when not initialized

issueProofChallenge

public CredentialConfirmationProofChallenge issueProofChallenge(CredentialConfirmationProofChallengeRequest request)

Description copied from interface: CredentialConfirmationService

Issues or exactly replays one authoritative key-possession proof challenge.

The session derives realm, audience, lifetime, proof provider, nonce, and certificate material from trusted runtime and persisted state. Callers supply only the exact pending lifecycle expectation.

Specified by:

issueProofChallenge in interface CredentialConfirmationService

Parameters:

request - exact pending lifecycle expectation

Returns:

bounded public proof challenge correlated to the persisted challenge

verifyAndComplete

public CredentialConfirmationProofResult verifyAndComplete(CredentialConfirmationProofSubmission submission)

Description copied from interface: CredentialConfirmationService

Resolves one bounded key-possession response against its exact confirmation lifecycle.

CredentialConfirmationProofResult.CONFIRMED means the authoritative lifecycle is confirmed. This includes an exact terminal replay, for which the supplied response is not cryptographically reverified. CredentialConfirmationProofResult.REJECTED means only that a bounded proof cryptographically failed verification while the lifecycle was pending; rejection does not mutate the lifecycle. Persistence conflicts, expired or rotated challenges, unavailable providers, and verification failures propagate as exceptions.

Specified by:

verifyAndComplete in interface CredentialConfirmationService

Parameters:

submission - exact proof coordinates and bounded suite response

Returns:

data-free confirmed-lifecycle or pending-proof-rejection classification

pagePendingReviews

public CredentialConfirmationReviewPage pagePendingReviews(PkiId authorityId,
 Optional<String> profileId,
 Instant cutoffInclusive,
 Optional<CredentialConfirmationReviewCursor> afterExclusive,
 int limit)

Description copied from interface: CredentialConfirmationService

Returns one bounded snapshot-consistent page of reduced pending reviews. The query is confined to the exact authority and optional profile before traversal, and the cursor cannot be reused for another scope or cutoff.

Specified by:

pagePendingReviews in interface CredentialConfirmationService

Parameters:

authorityId - mandatory exact issuing-authority scope

profileId - optional exact profile scope

cutoffInclusive - latest review time included

afterExclusive - optional exclusive store-issued cursor

limit - page size from 1 through 4096

Returns:

immutable review page in canonical order