Package co.ankatech.keymanagement.client.keymanagement.model

Class CreateInternalCryptoUseCaseRequest

java.lang.Object
co.ankatech.keymanagement.client.keymanagement.model.CreateInternalCryptoUseCaseRequest
@Generated(value="org.openapitools.codegen.languages.JavaClientCodegen", comments="Generator version: 7.23.0") public class CreateInternalCryptoUseCaseRequest extends Object
Provision an internal crypto use case (Application self-use) as an authorization overlay over keys that ALREADY EXIST. Creates the control-plane entities atomically: Exchange Context (INTERNAL) + Actor (INTERNAL) + Credential + Asset references + Constraint Policy (permissive) + 1..N Capability Grants. It creates NO key: provision keys with POST /api/v3/admin/tenants/{tenantId}/keys and reference them here by kid.

  • Field Details

  • Constructor Details

    • CreateInternalCryptoUseCaseRequest

      public CreateInternalCryptoUseCaseRequest()

  • Method Details

    • applicationId

      public CreateInternalCryptoUseCaseRequest applicationId(@Nonnull UUID applicationId)

    • getApplicationId

      @Nonnull public UUID getApplicationId()
      Application that owns this use case. MUST exist in the tenant AND have status=ACTIVE (SUSPENDED/DELETED/PROVISIONING applications → 409).
      Returns:
      applicationId

    • setApplicationId

      public void setApplicationId(@Nonnull UUID applicationId)

    • description

      public CreateInternalCryptoUseCaseRequest description(@Nullable String description)

    • getDescription

      @Nullable public String getDescription()
      Auditor-readable description of the use case.
      Returns:
      description

    • setDescription

      public void setDescription(@Nullable String description)

    • displayName

      public CreateInternalCryptoUseCaseRequest displayName(@Nullable String displayName)

    • getDisplayName

      @Nullable public String getDisplayName()
      Human-readable display name (UI label). Defaults to name when omitted.
      Returns:
      displayName

    • setDisplayName

      public void setDisplayName(@Nullable String displayName)

    • keyKid

      public CreateInternalCryptoUseCaseRequest keyKid(@Nullable String keyKid)

    • getKeyKid

      @Nullable public String getKeyKid()
      Stable KID of an EXISTING key in this tenant that the use case authorizes. The key is referenced, never created: it must already exist (provision one with POST /api/v3/admin/tenants/{tenantId}/keys), it keeps its own lifecycle, and revoking the use case leaves it untouched. OPTIONAL: omit it when every declared operation is INTEROP_*, ANALYZE_PKCS7 or CONVERT_PKCS7_TO_JOSE — the first two bind no tenant-owned key, and the conversion names its keys in pkcs7Conversion, never here. Declaring a key-bound operation without a kid is refused 422.
      Returns:
      keyKid

    • setKeyKid

      public void setKeyKid(@Nullable String keyKid)

    • name

      public CreateInternalCryptoUseCaseRequest name(@Nonnull String name)

    • getName

      @Nonnull public String getName()
      Tenant-scoped slug for the use case (kebab-case, 1-64 chars). Reusable after the use case is REVOKED (partial unique index excludes soft-deleted rows).
      Returns:
      name

    • setName

      public void setName(@Nonnull String name)

    • operations

      public CreateInternalCryptoUseCaseRequest operations(@Nonnull List<String> operations)

    • addOperationsItem

      public CreateInternalCryptoUseCaseRequest addOperationsItem(String operationsItem)

    • getOperations

      @Nonnull public List<String> getOperations()
      Operations to grant. Vocabulary (11 values): ENCRYPT, DECRYPT, SIGN, VERIFY (atomic — require keyKid); REENCRYPT, RESIGN (cross-kid first-class — require keyKid + targetKeyKid); INTEROP_ENCRYPT, INTEROP_VERIFY (caller-supplied keys, no key reference); CONVERT_PKCS7_TO_JOSE (requires pkcs7Conversion, which names the opener, the other recipients and the signers; emits one REENCRYPT grant per recipient leg and one RESIGN grant per signer); ANALYZE_PKCS7 (no key reference); EXPORT_KEY (requires keyKid, emits no grant).
      Returns:
      operations

    • setOperations

      public void setOperations(@Nonnull List<String> operations)

    • pkcs7Conversion

      public CreateInternalCryptoUseCaseRequest pkcs7Conversion(@Nullable Pkcs7Conversion pkcs7Conversion)

    • getPkcs7Conversion

      @Nullable public Pkcs7Conversion getPkcs7Conversion()
      The keys a CONVERT_PKCS7_TO_JOSE use case converts with. Required if and only if operations contains CONVERT_PKCS7_TO_JOSE: missing there is 422 key-reference-required, present without that operation is 400 naming it. Every kid names an EXISTING key in this tenant (404 with a fixed detail otherwise) and is referenced, never created. The conversion's grant gate in the cryptographic service asks REENCRYPT over [opener, recipient] for every recipient of the PKCS#7 structure (the opener's own pair included) and RESIGN over [signer, signer] for every signer, so the use case emits exactly those grants: one REENCRYPT [openerKid, recipient] per entry of recipientKids, an in-place REENCRYPT [openerKid] when recipientKids is empty (the opener is the sole recipient), and one RESIGN [signer] per entry of signerKids. A structure naming a recipient or signer this member does not bind is refused at conversion.
      Returns:
      pkcs7Conversion

    • setPkcs7Conversion

      public void setPkcs7Conversion(@Nullable Pkcs7Conversion pkcs7Conversion)

    • targetKeyKid

      public CreateInternalCryptoUseCaseRequest targetKeyKid(@Nullable String targetKeyKid)

    • getTargetKeyKid

      @Nullable public String getTargetKeyKid()
      Stable KID of the EXISTING destination key for cross-kid REENCRYPT/RESIGN. Required when operations contains REENCRYPT or RESIGN, and forbidden otherwise — both violations are refused 422. The grant binds the PAIR as asset_kids [keyKid, targetKeyKid], written source-first by convention — the order records intent and is not enforced: the runtime matches a grant's asset set with containsAll, a subset test, so the same grant authorizes the reversed pair too. Setting targetKeyKid equal to keyKid is VALID and expresses an in-place migration across material versions of one key. Patent-critical: the REENCRYPT capability authorizes re-encryption over that pair WITHOUT granting standalone DECRYPT.
      Returns:
      targetKeyKid

    • setTargetKeyKid

      public void setTargetKeyKid(@Nullable String targetKeyKid)

    • validityWindow

      public CreateInternalCryptoUseCaseRequest validityWindow(@Nullable ValidityWindow validityWindow)

    • getValidityWindow

      @Nullable public ValidityWindow getValidityWindow()
      Optional validity window for the underlying Constraint Policy. Defaults: validFrom=now, validUntil=now+1y when omitted (server-side).
      Returns:
      validityWindow

    • setValidityWindow

      public void setValidityWindow(@Nullable ValidityWindow validityWindow)

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • validateJsonElement

      public static void validateJsonElement(com.google.gson.JsonElement jsonElement) throws IOException
      Validates the JSON Element and throws an exception if issues found
      Parameters:
      jsonElement - JSON Element
      Throws:
      IOException - if the JSON Element is invalid with respect to CreateInternalCryptoUseCaseRequest

    • validateJsonElementAsCandidate

      public static void validateJsonElementAsCandidate(com.google.gson.JsonElement jsonElement) throws IOException
      Validates the JSON Element as a candidate of a oneOf schema: the checks of validateJsonElement(JsonElement), and the element carries no member this model does not declare. A oneOf schema without a discriminator tells its candidates apart by their member sets, so a candidate is matched on its closed member set.
      Parameters:
      jsonElement - JSON Element
      Throws:
      IOException - if the JSON Element is not a CreateInternalCryptoUseCaseRequest

    • fromJson

      public static CreateInternalCryptoUseCaseRequest fromJson(String jsonString) throws IOException
      Create an instance of CreateInternalCryptoUseCaseRequest given an JSON string
      Parameters:
      jsonString - JSON string
      Returns:
      An instance of CreateInternalCryptoUseCaseRequest
      Throws:
      IOException - if the JSON string is invalid with respect to CreateInternalCryptoUseCaseRequest

    • toJson

      public String toJson()
      Convert an instance of CreateInternalCryptoUseCaseRequest to an JSON string
      Returns:
      JSON string