Package co.ankatech.ankasecure.sdk.exception

Class StreamIntegrityException

java.lang.Object
java.lang.Throwable
java.lang.Exception
java.lang.RuntimeException
co.ankatech.ankasecure.sdk.exception.AnkaSecureSdkException
co.ankatech.ankasecure.sdk.exception.StreamIntegrityException
All Implemented Interfaces:
Serializable
Direct Known Subclasses:
DecryptVerifyIntegrityException
public class StreamIntegrityException extends AnkaSecureSdkException
Thrown when a streaming file-output operation cannot commit its result because the server-emitted end-of-stream integrity verdict did not pass (fail-closed).

The end-of-stream-integrity streaming operations (stream/decrypt, stream/reencrypt, stream/resign) frame their response as multipart/mixed: the streamed payload is PART 1 and a trailing application/json verdict is PART 2, emitted only AFTER the server has run its end-of-stream integrity check. The SDK quarantines the payload to a sidecar (<destination>.part) and promotes it to the final destination via an atomic rename ONLY when the trailing verdict is VALID.

This exception is raised when the verdict is INVALID (tampered ciphertext, failed GCM tag, unverifiable old signature) or ABSENT (a truncated stream or a body carrying no trailing verdict part), or when the verdict part breaks the server contract (a signatureResults entry without its verified or algorithm member: such a verdict cannot say which signer passed, so it cannot vouch for the output; the message starts "Server contract violation: " and names the entry). In every case the sidecar has already been deleted and NO file exists at the destination — success is never inferred from a closed socket. The failure surfaces as this TYPED exception rather than an opaque socket / I/O error.

The carried reason is the server's oracle-safe explanation and never leaks plaintext, key material, tenant identity, or BouncyCastle / JCE internals.

Extends AnkaSecureSdkException (the SDK's documented exception base) so consumers catch it with a uniform catch (AnkaSecureSdkException e); being a client-side fail-closed outcome it carries no HTTP status/body (AnkaSecureSdkException.getHttpStatus() is 0) — the integrity dimensions are exposed via getVerdict()/getReason().

An INVALID two-verdict stream/decrypt-verify part is raised as the subclass DecryptVerifyIntegrityException, which also carries the server's per-signer verdicts.

See Also:

  • Constructor Details

    • StreamIntegrityException

      public StreamIntegrityException(String message, String operation, String verdict, String reason, String correlationId, Throwable cause)
      Constructs a new streaming-integrity exception.
      Parameters:
      message - the detail message (oracle-safe; must not embed plaintext / key material)
      operation - the operation whose verdict failed (may be null)
      verdict - the verdict outcome — INVALID or ABSENT (may be null)
      reason - the server's oracle-safe reason (may be null)
      correlationId - the request correlation id (may be null)
      cause - the underlying cause (may be null)

  • Method Details

    • getOperation

      public String getOperation()
      Returns the operation whose end-of-stream verdict failed.
      Returns:
      decrypt / reencrypt / resign, or null when unknown

    • getVerdict

      public String getVerdict()
      Returns the verdict outcome.
      Returns:
      INVALID or ABSENT (a verdict part that breaks the server contract is INVALID when the server reported INVALID, otherwise ABSENT: no readable verdict vouched for the output); null when unknown

    • getReason

      public String getReason()
      Returns the server's oracle-safe reason for the failing verdict.
      Returns:
      the reason, or null when the server supplied none

    • getCorrelationId

      public String getCorrelationId()
      Returns the request correlation id, for cross-service tracing.
      Returns:
      the correlation id, or null when absent