Package co.ankatech.ankasecure.sdk.jose

Class AnkaJoseUtil

java.lang.Object
co.ankatech.ankasecure.sdk.jose.AnkaJoseUtil
public final class AnkaJoseUtil extends Object
Pure client-side conversion helpers between the JOSE Compact Serialization (RFC 7516 Section 7.1 for JWE / RFC 7515 Section 7.1 for JWS) and the General JSON Serialization (RFC 7516 Section 7.2 / RFC 7515 Section 7.2) used by ANKASecure on the wire.

This class exists because ANKASecure exposes only General JSON Serialization on its REST API. Clients that receive a Compact JOSE payload from a third-party producer (Nimbus JOSE+JWT, jose4j, python-jose, an OAuth issuer, etc.) MUST convert it to General JSON before invoking ANKASecure's decrypt/verify/reencrypt endpoints. Conversely, clients that wish to feed an ANKASecure-produced JOSE artefact to a Compact-only consumer (typical JWT-side tooling) MUST convert the other direction.

Stateless, thread-safe: the ObjectMapper is private static final and no other state is held. No I/O. No HTTP. No dependency on the ANKASecure server. Safe to call from any thread without synchronization.

Multi-recipient / multi-signature rejection: General JSON supports multi-recipient JWE and multi-signature JWS; Compact does not (RFC 7516 Section 7.1 / RFC 7515 Section 7.1 are single-recipient/single-signature only). Attempting to convert a multi-recipient/multi-signature General JSON to Compact throws IllegalArgumentException with a descriptive message — the helper NEVER silently drops recipients or signatures.

  • Method Details

    • compactJweToGeneral

      public static String compactJweToGeneral(String compactJwe)
      Converts a Compact JWE (5 dot-separated base64url segments) into the General JSON Serialization form as a JSON string.

      An empty JWE Encrypted Key segment (Direct Encryption alg=dir or Direct Key Agreement alg=ECDH-ES) yields a recipient with NO encrypted_key member: RFC 7516 Section 7.2.1 requires the member to be absent when the JWE Encrypted Key is empty.

      The recipient carries no header member. Every header parameter of a Compact JWE lives in its protected header, and RFC 7516 Section 7.2.1 requires the protected, shared unprotected and per-recipient headers to be disjoint: copying alg or kid into the recipient would name each twice, which a conforming reader refuses.

      Throws:
      IllegalArgumentException - if the input has the wrong segment count

    • generalJweToCompact

      public static String generalJweToCompact(String generalJsonJwe)
      Converts a General JSON Serialization JWE (as a JSON string) into the Compact Serialization (5 dot-separated segments).

      A recipient without encrypted_key has an empty JWE Encrypted Key (RFC 7516 Section 7.2.1), which Compact Serialization carries as an empty second segment (RFC 7516 Section 7.1).

      Throws:
      IllegalArgumentException - if the General JSON has more than one recipient (multi-recipient cannot be represented in Compact form — RFC 7516 Section 7.1 is single-recipient only), or if the recipient's encrypted_key is present but is not a string

    • compactJwsToGeneral

      public static String compactJwsToGeneral(String compactJws)
      Converts a Compact JWS (3 dot-separated base64url segments) into the General JSON Serialization form as a JSON string.

    • generalJwsToCompact

      public static String generalJwsToCompact(String generalJsonJws)
      Converts a General JSON Serialization JWS (as a JSON string) into the Compact Serialization (3 dot-separated segments).
      Throws:
      IllegalArgumentException - if the General JSON has more than one signature