Package co.ankatech.ankasecure.sdk.examples

Class ExamplePlaygroundKeys

java.lang.Object
co.ankatech.ankasecure.sdk.examples.ExamplePlaygroundKeys
public final class ExamplePlaygroundKeys extends Object
Resolves PRE-PROVISIONED playground key ids for the realigned data-plane examples.

The SDK is data-plane-only: examples no longer create keys (key lifecycle lives in cli-admin / the Admin API). They operate on the keys the cli-reference actor — the all-operations actor of the demo-cli playground provisioned by the demo-provisioning tool — already holds capability grants on.

The kid catalogue is the comma-separated ankasecure.demo.kids property emitted into cli.properties by the demo-provisioning tool, in YAML file order. Selection is by algorithm via AuthenticatedSdk.getKeyMetadata(String) (never by list position): an example asks for the algorithm it needs and receives a matching pre-provisioned kid. Resolved metadata is cached per instance.

  • Method Details

    • from

      public static ExamplePlaygroundKeys from(Properties props, AuthenticatedSdk sdk)
      Builds a resolver from the loaded cli.properties and an authenticated SDK. Fails fast (via parseKids(Properties)) when the ankasecure.demo.kids property is missing or blank.
      Parameters:
      props - the loaded CLI properties (must carry ankasecure.demo.kids)
      sdk - an authenticated, data-plane SDK bound to the cli-reference actor
      Returns:
      a resolver over the pre-provisioned playground kids

    • kids

      public List<String> kids()
      The pre-provisioned playground kids, in file order.
      Returns:
      an immutable copy of the kid list

    • requireKid

      public String requireKid(String kid)
      Returns the named pre-provisioned kid, asserting it is present in the ankasecure.demo.kids catalogue. Use this for cross-kid REENCRYPT/RESIGN demos, which must operate on a SPECIFIC granted source/target pair (the cli-reference actor holds the cross-kid grant on those dedicated endpoint kids, not on an arbitrary key of the same algorithm) — by-algorithm resolution cannot distinguish the granted endpoint from another key of the same algorithm.
      Parameters:
      kid - the exact pre-provisioned kid (e.g. a dedicated cross-kid endpoint)
      Returns:
      the same kid, once validated as provisioned
      Throws:
      IllegalStateException - if the kid is not in the playground catalogue

    • kidForAlgorithm

      public String kidForAlgorithm(String alg) throws AnkaSecureSdkException
      Returns the first pre-provisioned kid whose algorithm equals alg (case-insensitive).
      Parameters:
      alg - the requested algorithm (e.g. ML-KEM-512, ML-DSA-65)
      Returns:
      a matching pre-provisioned kid
      Throws:
      AnkaSecureSdkException - if a metadata lookup fails
      IllegalStateException - if no granted kid matches the algorithm

    • kidForAlgorithmAndOp

      public String kidForAlgorithmAndOp(String alg, String keyOp) throws AnkaSecureSdkException
      Returns the first pre-provisioned kid whose algorithm equals alg AND whose keyOps include keyOp — for picking between keys that share an algorithm but differ in operation (e.g. distinct cross-kid endpoints).
      Parameters:
      alg - the requested algorithm
      keyOp - the required key operation (e.g. encrypt, sign)
      Returns:
      a matching pre-provisioned kid
      Throws:
      AnkaSecureSdkException - if a metadata lookup fails
      IllegalStateException - if no granted kid matches