Package co.ankatech.ankasecure.sdk.internal.service.impl

Class SignatureServiceImpl

java.lang.Object

co.ankatech.ankasecure.sdk.internal.service.impl.SignatureServiceImpl

All Implemented Interfaces:

co.ankatech.ankasecure.sdk.internal.service.SignatureService

public final class SignatureServiceImpl
extends Object
implements co.ankatech.ankasecure.sdk.internal.service.SignatureService

Thread-safe implementation of SignatureService.

Constructor Summary

Constructors

Constructor	Description
SignatureServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api)	Convenience constructor using the default OverwritePolicy.FAIL_IF_EXISTS policy.
SignatureServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api, OverwritePolicy overwritePolicy)

Method Summary

Modifier and Type	Method	Description
ResignResult	resignBytes(String newKid, String sourceKid, String oldJws)	Re-sign a Compact JWS switching to newKid.
ResignResult	resignBytes(String newKid, String sourceKid, String oldJws, JwsSerialization serialization)	Re-signs a JWS with an explicit JWS serialization selection.
ResignResult	resignFile(String newKid, String sourceKid, Path oldJws, Path newJws)
ResignResult	resignFile(String newKid, String sourceKid, Path oldJws, Path newJws, JwsSerialization serialization)	Attached file re-sign with an explicit JWS serialization selection.
ResignResult	resignFileStream(Path oldJws, String newKid, String sourceKid, Path input, Path newSigOut)	Re-sign a detached-payload JWS in streaming mode. The existing detached JWS (flattened JWS JSON whose protected header names the old kid, with "b64": false) is supplied in oldJwsHeader.
SignResult	signBytes(String kid, byte[] data)	Sign an in-memory payload with a server-side **private** key.
SignResult	signBytes(String kid, byte[] data, JwsSerialization serialization)	Signs an in-memory payload with an explicit JWS serialization selection.
SignResult	signFile(String kid, Path input, Path jwsOut)
SignResult	signFile(String kid, Path input, Path jwsOut, JwsSerialization serialization)	Attached file sign with an explicit JWS serialization selection.
SignResult	signFileStream(String kid, Path input, Path sigOut)
VerifySignatureResult	verifySignature(Path jwsFile)
VerifySignatureResult	verifySignatureBytes(String jwsToken)	Verify a Compact JWS that is fully in memory.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SignatureServiceImpl

public SignatureServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api)

Convenience constructor using the default OverwritePolicy.FAIL_IF_EXISTS policy.

SignatureServiceImpl

public SignatureServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api,
 OverwritePolicy overwritePolicy)

Method Details

signFile

public SignResult signFile(String kid,
 Path input,
 Path jwsOut)
                    throws AnkaSecureSdkException

Specified by:

signFile in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Throws:

AnkaSecureSdkException

signFile

public SignResult signFile(String kid,
 Path input,
 Path jwsOut,
 JwsSerialization serialization)
                    throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.SignatureService

Attached file sign with an explicit JWS serialization selection. A null serialization omits the field and lets the server choose the standards-correct representation.

Specified by:

signFile in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Throws:

AnkaSecureSdkException

verifySignature

public VerifySignatureResult verifySignature(Path jwsFile)
                                      throws AnkaSecureSdkException

Specified by:

verifySignature in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Throws:

AnkaSecureSdkException

resignFile

public ResignResult resignFile(String newKid,
 String sourceKid,
 Path oldJws,
 Path newJws)
                        throws AnkaSecureSdkException

Specified by:

resignFile in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

sourceKid - the signer whose signature is replaced, or null when the protected header names one key (required by the server for a JWS signed by several keys or naming none)

Throws:

AnkaSecureSdkException

resignFile

public ResignResult resignFile(String newKid,
 String sourceKid,
 Path oldJws,
 Path newJws,
 JwsSerialization serialization)
                        throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.SignatureService

Attached file re-sign with an explicit JWS serialization selection. A null serialization omits the field.

Specified by:

resignFile in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

sourceKid - the signer whose signature is replaced, or null when the protected header names one key (required by the server for a JWS signed by several keys or naming none)

Throws:

AnkaSecureSdkException

signFileStream

public SignResult signFileStream(String kid,
 Path input,
 Path sigOut)
                          throws AnkaSecureSdkException

Specified by:

signFileStream in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Throws:

AnkaSecureSdkException

resignFileStream

public ResignResult resignFileStream(Path oldJws,
 String newKid,
 String sourceKid,
 Path input,
 Path newSigOut)
                              throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.SignatureService

Re-sign a detached-payload JWS in streaming mode.
The existing detached JWS (flattened JWS JSON whose protected header names the old kid, with "b64": false) is supplied in oldJwsHeader. The payload itself is streamed from input.

Specified by:

resignFileStream in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Parameters:

oldJws - UTF-8 file that contains the original detached JWS (flattened JWS JSON, detached payload)

newKid - key identifier that must sign the refreshed JWS

sourceKid - the signer whose signature is replaced, or null when the protected header names one key (required by the server for a JWS signed by several keys or naming none)

input - data whose signature is being replaced

newSigOut - destination file that will receive the new signature

Throws:

AnkaSecureSdkException

signBytes

public SignResult signBytes(String kid,
 byte[] data)
                     throws AnkaSecureSdkException

Sign an in-memory payload with a server-side **private** key.

Specified by:

signBytes in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Parameters:

kid - private-key ID in ANKASecure (must not be null)

data - bytes to be signed (must not be null)

Returns:

SignResult containing the attached JWS (payload embedded) and metadata

Throws:

AnkaSecureSdkException - on validation or remote failure

signBytes

public SignResult signBytes(String kid,
 byte[] data,
 JwsSerialization serialization)
                     throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.SignatureService

Signs an in-memory payload with an explicit JWS serialization selection. A null serialization omits the field and lets the server choose the standards-correct representation.

Specified by:

signBytes in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Parameters:

kid - private-key ID in ANKASecure (must not be null)

data - bytes to be signed (must not be null)

serialization - requested serialization, or null to defer to the server

Returns:

SignResult containing the JWS and metadata

Throws:

AnkaSecureSdkException - on validation or remote failure

verifySignatureBytes

public VerifySignatureResult verifySignatureBytes(String jwsToken)
                                           throws AnkaSecureSdkException

Verify a Compact JWS that is fully in memory.

Specified by:

verifySignatureBytes in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Parameters:

jwsToken - textual Compact JWS (UTF-8)

Returns:

outcome, metadata, and Base64 payload

Throws:

AnkaSecureSdkException - on validation or remote failure

resignBytes

public ResignResult resignBytes(String newKid,
 String sourceKid,
 String oldJws)
                         throws AnkaSecureSdkException

Re-sign a Compact JWS switching to newKid.

Specified by:

resignBytes in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Parameters:

newKid - private-key ID that must generate the new signature

sourceKid - the signer whose signature is replaced, or null when the protected header names one key (required by the server for a JWS signed by several keys or naming none)

oldJws - existing Compact JWS (UTF-8)

Returns:

dual-key metadata plus the new token

Throws:

AnkaSecureSdkException - on validation or remote failure

resignBytes

public ResignResult resignBytes(String newKid,
 String sourceKid,
 String oldJws,
 JwsSerialization serialization)
                         throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.SignatureService

Re-signs a JWS with an explicit JWS serialization selection. A null serialization omits the field.

Specified by:

resignBytes in interface co.ankatech.ankasecure.sdk.internal.service.SignatureService

Parameters:

newKid - private-key ID that must generate the new signature

sourceKid - the signer whose signature is replaced, or null when the protected header names one key (required by the server for a JWS signed by several keys or naming none)

oldJws - existing JWS (Compact or JWS-JSON, UTF-8)

serialization - requested serialization, or null to defer to the server

Returns:

dual-key metadata plus the new token

Throws:

AnkaSecureSdkException - on validation or remote failure