Package co.ankatech.ankasecure.sdk.internal.service.impl

Class CryptoServiceImpl

java.lang.Object
co.ankatech.ankasecure.sdk.internal.service.impl.CryptoServiceImpl
All Implemented Interfaces:
co.ankatech.ankasecure.sdk.internal.service.CryptoService
public final class CryptoServiceImpl extends Object implements co.ankatech.ankasecure.sdk.internal.service.CryptoService
Thread-safe concrete implementation of CryptoService.

  • Constructor Details

    • CryptoServiceImpl

      public CryptoServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api)
      Convenience constructor using the default OverwritePolicy.FAIL_IF_EXISTS policy.

    • CryptoServiceImpl

      public CryptoServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api, OverwritePolicy overwritePolicy)

  • Method Details

    • encryptFile

      public EncryptResult encryptFile(String kid, Path input, Path output) throws AnkaSecureSdkException
      Specified by:
      encryptFile in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Throws:
      AnkaSecureSdkException

    • decryptFile

      public DecryptResultMetadata decryptFile(String recipientKid, Path input, Path output) throws AnkaSecureSdkException
      Specified by:
      decryptFile in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Parameters:
      recipientKid - the recipient to decrypt with, or null when the JWE names one key
      Throws:
      AnkaSecureSdkException

    • reencryptFile

      public ReencryptResult reencryptFile(String newKid, String sourceKid, Path input, Path output) throws AnkaSecureSdkException
      Specified by:
      reencryptFile in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      sourceKid - the recipient the re-encryption replaces, or null when the JWE names one key
      Throws:
      AnkaSecureSdkException

    • encryptFileStream

      public EncryptResult encryptFileStream(String kid, Path input, Path output) throws AnkaSecureSdkException
      Specified by:
      encryptFileStream in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Throws:
      AnkaSecureSdkException

    • decryptFileStream

      public DecryptResultMetadata decryptFileStream(String recipientKid, Path input, Path output) throws AnkaSecureSdkException
      Decrypts a JWET multipart file via streaming API.

      This implementation extracts the original JWET header JSON and forwards it as-is to the API without parsing, ensuring perfect forward compatibility with server-side fields unknown to this SDK version (e.g., anka_composite_mode, future extensions).

      Zero-overhead design: The header is treated as an opaque string that is simply forwarded to the server. No deserialization, no validation, no conditional logic based on key type.

      Specified by:
      decryptFileStream in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Parameters:
      recipientKid - the recipient to decrypt with, or null when the JWE names one key
      input - JWET multipart file (header + envelope)
      output - destination for decrypted plaintext
      Returns:
      metadata about the decryption operation
      Throws:
      AnkaSecureSdkException - if decryption fails

    • reencryptFileStream

      public ReencryptResult reencryptFileStream(String newKid, String sourceKid, Path input, Path output) throws AnkaSecureSdkException
      Server-side re-encryption of a ciphertext with a new key.

      This implementation extracts the original JWET header JSON and forwards it as-is to the API without parsing, ensuring perfect forward compatibility with server-side fields unknown to this SDK version (e.g., anka_composite_mode, future extensions).

      Zero-overhead design: The header is treated as an opaque string that is simply forwarded to the server. No deserialization, no validation, no conditional logic based on key type.

      Specified by:
      reencryptFileStream in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Parameters:
      newKid - public-key identifier for the new ciphertext
      sourceKid - the recipient this re-encryption replaces, or null when the JWE names one key
      input - JWET multipart file (header + envelope)
      output - destination for the re-encrypted file
      Returns:
      metadata about both old and new keys used
      Throws:
      AnkaSecureSdkException - if re-encryption fails

    • encryptBytes

      public EncryptResult encryptBytes(String kid, byte[] plaintext) throws AnkaSecureSdkException
      Encrypt raw bytes with a server-side **public** key.
      Specified by:
      encryptBytes in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Parameters:
      kid - key ID in the platform (must not be null)
      plaintext - data to protect (must not be null)
      Returns:
      EncryptResult exposing the Compact JWE token and metadata
      Throws:
      AnkaSecureSdkException - on validation or remote failure

    • decryptBytes

      public co.ankatech.ankasecure.sdk.internal.service.CryptoService.DecryptBytesHolder decryptBytes(String recipientKid, String jweToken) throws AnkaSecureSdkException
      Decrypt a JWE (Compact or General JSON) that is already in RAM.
      Specified by:
      decryptBytes in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Parameters:
      recipientKid - the recipient to decrypt with, or null when the JWE names one key (required by the server when it is addressed to several)
      jweToken - textual Compact JWE (UTF-8, not Base64 wrapped)
      Returns:
      CryptoService.DecryptBytesHolder containing plaintext and metadata
      Throws:
      AnkaSecureSdkException - on validation or remote failure

    • reencryptBytes

      public ReencryptResult reencryptBytes(String newKid, String sourceKid, String jweToken) throws AnkaSecureSdkException
      Re-encrypt a JWE in memory so it becomes protected by newKid.
      Specified by:
      reencryptBytes in interface co.ankatech.ankasecure.sdk.internal.service.CryptoService
      Parameters:
      newKid - key that must protect the data after rotation
      sourceKid - the recipient the re-encryption replaces, or null when the JWE names one key
      jweToken - current Compact JWE (text form)
      Returns:
      metadata for old/new keys plus the refreshed JWE token
      Throws:
      AnkaSecureSdkException - on validation or remote failure