Class X509BindingCatalog

java.lang.Object
zeroecho.pki.impl.framework.x509.X509BindingCatalog
public final class X509BindingCatalog extends Object
Deeply immutable snapshot of authoritative X.509 binding rules.

One rule exclusively owns each role and OID parameter domain. The current implementation requires one authoritative rule for a role/OID pair; that rule may itself be parameterized. This permits RSA-PSS and named-curve EC while rejecting order-dependent overlapping contributions.

  • Field Details

    • BUILTIN_PREFIX

      public static final String BUILTIN_PREFIX
      Prefix reserved for built-in binding identifiers.
      See Also:

  • Method Details

    • builtIn

      public static X509BindingCatalog builtIn(List<X509BindingRule> rules)
      Creates the immutable built-in catalog.
      Parameters:
      rules - fixed standard rules
      Returns:
      built-in catalog

    • extension

      public static X509BindingCatalog extension(List<X509BindingRule> rules)
      Creates a trusted additive extension catalog.
      Parameters:
      rules - extension rules
      Returns:
      extension catalog

    • merge

      public X509BindingCatalog merge(List<X509BindingCatalog> extensions)
      Produces a new immutable additive snapshot.
      Parameters:
      extensions - installed extension catalogs
      Returns:
      merged catalog
      Throws:
      IllegalArgumentException - if a rule identifier or role/OID domain collides

    • resolve

      public X509AlgorithmIdentifier resolve(AlgorithmIdentity identity, X509AlgorithmRole role)
      Resolves one exact identity for a closed role.
      Implementation Note:
      Fixed standard lookup uses one expected constant-time hash lookup, followed by every applicable parameterized or extension rule. Hashing costs are proportional to identity size; fallback work is proportional to the number and encoding cost of those rules. No descriptor graph is rebuilt.
      Parameters:
      identity - exact identity
      role - X.509 role
      Returns:
      canonical X.509 representation
      Throws:
      IllegalArgumentException - if no rule or more than one rule resolves

    • resolve

      public X509AlgorithmIdentifier resolve(String bindingId, AlgorithmIdentity identity, X509AlgorithmRole role)
      Resolves one exact identity through an explicitly selected binding.
      Parameters:
      bindingId - stable binding identifier
      identity - exact cryptographic identity
      role - internal structural role
      Returns:
      canonical identifier
      Throws:
      IllegalArgumentException - if the binding is absent, has the wrong role, or cannot encode the identity

    • reverse

      public AlgorithmIdentity reverse(X509AlgorithmIdentifier identifier, X509AlgorithmRole role)
      Reverse-resolves an exact role-specific representation.
      Parameters:
      identifier - canonical X.509 representation
      role - X.509 role
      Returns:
      exact identity
      Throws:
      IllegalArgumentException - if the representation is unknown or invalid

    • bindingId

      public String bindingId(X509AlgorithmIdentifier identifier, X509AlgorithmRole role)
      Returns the stable binding identifier owning an exact representation.
      Parameters:
      identifier - canonical representation
      role - structural role
      Returns:
      stable binding identifier

    • rules

      public List<X509BindingRule> rules()
      Returns deterministic immutable binding rules.
      Returns:
      rule snapshot