Package co.ankatech.ankasecure.keymanagement

Class CapabilityGrantOperations

java.lang.Object
co.ankatech.ankasecure.keymanagement.CapabilityGrantOperations
public final class CapabilityGrantOperations extends Object
The tenant's explicit capability grants: which actor may use which key for which operation, in which exchange context, under which constraints. A basic grant names its keys; a REENCRYPT or RESIGN grant names ordered key pairs, each authorizing its own direction only. Obtained from AuthenticatedKeyManagementSdk.capabilityGrants(). 

 ConferralPlanResponse plan = sdk.capabilityGrants().preview(request);
 CapabilityGrantResponse grant = sdk.capabilityGrants().create(request);

  • Method Details

    • list

      public PageCapabilityGrantResponse list(CapabilityGrantListQuery query)
      Lists capability grants (GET /tenants/{t}/capability-grants).
      Parameters:
      query - the filters and page; must not be null
      Returns:
      one page of grants
      Throws:
      KeyManagementSdkException - when the call is refused

    • create

      public CapabilityGrantResponse create(CreateCapabilityGrantRequest request)
      Creates a capability grant (POST /tenants/{t}/capability-grants).
      Parameters:
      request - the grant; must not be null
      Returns:
      the created grant
      Throws:
      KeyManagementSdkException - when the call is refused

    • preview

      public ConferralPlanResponse preview(CreateCapabilityGrantRequest request)
      Previews what a grant would confer, without creating it (POST /tenants/{t}/capability-grants/preview).
      Parameters:
      request - the grant to preview; must not be null
      Returns:
      the conferral plan
      Throws:
      KeyManagementSdkException - when the call is refused

    • get

      public CapabilityGrantResponse get(UUID grantId)
      Reads one capability grant (GET /tenants/{t}/capability-grants/{g}).
      Parameters:
      grantId - the grant; must not be null
      Returns:
      the grant
      Throws:
      KeyManagementSdkException - when the call is refused

    • revoke

      public void revoke(UUID grantId, RevokeCapabilityGrantRequest request)
      Revokes a capability grant (POST /tenants/{t}/capability-grants/{g}/revoke). The revocation is terminal.
      Parameters:
      grantId - the grant; must not be null
      request - the audited reason for the revocation, required; must not be null
      Throws:
      KeyManagementSdkException - when the call is refused

    • replacePolicyVersion

      public CapabilityGrantPolicyAssignment replacePolicyVersion(UUID grantId, ReplaceCapabilityGrantPolicyVersionRequest request)
      Re-pins a grant to a constraint policy version (PUT /tenants/{t}/capability-grants/{g}/policy-version), which governs it from the next request on. The grant's capabilities, keys, exchange context and owner are unchanged, and the pin is recorded as a new entry of the grant's assignment history.

      The grant keeps the uses already counted against it, and the new version's maxUsage applies to that count. Uses made while no limit was pinned are not counted, so they do not count toward a limit pinned later: re-pinning from an unlimited version starts counting at 0.

      Parameters:
      grantId - the grant; must not be null
      request - the constraint policy version to pin; must not be null
      Returns:
      the new assignment
      Throws:
      KeyManagementSdkException - when the call is refused (409 when the grant was used up or revoked, is already pinned to the version, or the version is not one of the tenant's)

    • policyAssignments

      public List<CapabilityGrantPolicyAssignment> policyAssignments(UUID grantId)
      Lists the constraint policy versions a grant has been pinned to, oldest first (GET /tenants/{t}/capability-grants/{g}/policy-assignments).
      Parameters:
      grantId - the grant; must not be null
      Returns:
      the grant's assignment history
      Throws:
      KeyManagementSdkException - when the call is refused

    • effectiveRestrictions

      public CapabilityGrantEffectiveRestrictions effectiveRestrictions(UUID grantId, OffsetDateTime at)
      Reads the restrictions in force for a grant at an instant (GET /tenants/{t}/capability-grants/{g}/effective-restrictions). When no version was pinned at that instant, every version member is null and the grant was unlimited.
      Parameters:
      grantId - the grant; must not be null
      at - the instant, or null for now
      Returns:
      the constraint policy version in force, with its limits and schedule
      Throws:
      KeyManagementSdkException - when the call is refused (404 for an instant before the grant was created)