class AuthorizationGraph extends AuthorizationCheck with NamedLogging

Stores a set of namespace delegations, tracks dependencies and determines which keys are authorized to sign on behalf of a namespace.

Namespace delegations are a bit tricky as there can be an arbitrary number of delegations between the namespace key and the key that will be used for authorizations. Think of it as a certificate chain where we get a series of certificates and we need to figure out a path from one certificate to the root certificate.

NOTE: this class is not thread-safe

Properties of the graph:

  • Each node corresponds to a target key
  • The node with key fingerprint of the namespace is the root node
  • The edges between nodes are namespace delegations. If key A signs a namespace delegation with target key B, then key A authorizes key B to act on the namespace. In this case, the edge is outgoing from node A and incoming into node B.
  • The graph may have cycles. The implementation does not get confused by this.

Computation task: The graph maintains a set of nodes that are connected to the root node. Those correspond to the keys that are authorized to sign on behalf of the namespace.

Limitation: clients need to ensure that the namespace delegations added have valid signatures. If delegations with invalid signatures are added, authorization will break.

Linear Supertypes
NamedLogging, AuthorizationCheck, AnyRef, Any
Ordering
  1. Alphabetic
  2. By Inheritance
Inherited
  1. AuthorizationGraph
  2. NamedLogging
  3. AuthorizationCheck
  4. AnyRef
  5. Any
  1. Hide All
  2. Show All
Visibility
  1. Public
  2. Protected

Instance Constructors

  1. new AuthorizationGraph(namespace: Namespace, extraDebugInfo: Boolean, loggerFactory: NamedLoggerFactory)

    extraDebugInfo

    whether to log the authorization graph at debug level on every recomputation

Value Members

  1. final def !=(arg0: Any): Boolean
    Definition Classes
    AnyRef → Any
  2. final def ##: Int
    Definition Classes
    AnyRef → Any
  3. final def ==(arg0: Any): Boolean
    Definition Classes
    AnyRef → Any
  4. final def asInstanceOf[T0]: T0
    Definition Classes
    Any
  5. def authorizedDelegations(): Map[Namespace, Seq[(AuthorizedNamespaceDelegation, Int)]]

    Per namespace (required for decentralized namespaces), a list of namespace delegations that have a gapless chain to the root certificate together with the length of the chain to the root certificate for each namespace delegation.

    Per namespace (required for decentralized namespaces), a list of namespace delegations that have a gapless chain to the root certificate together with the length of the chain to the root certificate for each namespace delegation.

    Definition Classes
    AuthorizationGraph → AuthorizationCheck
  6. def clone(): AnyRef
    Attributes
    protected[lang]
    Definition Classes
    AnyRef
    Annotations
    @throws(classOf[java.lang.CloneNotSupportedException]) @IntrinsicCandidate() @native()
  7. final def eq(arg0: AnyRef): Boolean
    Definition Classes
    AnyRef
  8. def equals(arg0: AnyRef): Boolean
    Definition Classes
    AnyRef → Any
  9. implicit def errorLoggingContext(implicit traceContext: TraceContext): ErrorLoggingContext
    Attributes
    protected
    Definition Classes
    NamedLogging
  10. def existsAuthorizedKeyIn(authKeys: Set[Fingerprint], mappingToAuthorize: Code): Boolean

    Determines if a subset of the given keys is authorized to sign a given mapping type on behalf of the (possibly decentralized) namespace.

    Determines if a subset of the given keys is authorized to sign a given mapping type on behalf of the (possibly decentralized) namespace.

    mappingToAuthorize

    the Code of the mapping that needs to be authorized.

    Definition Classes
    AuthorizationGraph → AuthorizationCheck
  11. final def getClass(): Class[_ <: AnyRef]
    Definition Classes
    AnyRef → Any
    Annotations
    @IntrinsicCandidate() @native()
  12. def hashCode(): Int
    Definition Classes
    AnyRef → Any
    Annotations
    @IntrinsicCandidate() @native()
  13. final def isInstanceOf[T0]: Boolean
    Definition Classes
    Any
  14. def keysSupportingAuthorization(authKeys: Set[Fingerprint], mappingToAuthorize: Code): Set[SigningPublicKey]

    Returns those keys that are useful for signing on behalf of the (possibly decentralized) namespace.

    Returns those keys that are useful for signing on behalf of the (possibly decentralized) namespace. Only keys with fingerprint in authKeys will be returned. The returned keys are not necessarily sufficient to authorize a transaction on behalf of the namespace; in case of a decentralized namespace, additional signatures may be required. Only returns keys that are permitted to sign the provided mapping type.

    Definition Classes
    AuthorizationGraph → AuthorizationCheck
  15. def logger: TracedLogger
    Attributes
    protected
    Definition Classes
    NamedLogging
  16. val loggerFactory: NamedLoggerFactory
    Attributes
    protected
    Definition Classes
    AuthorizationGraph → NamedLogging
  17. implicit def namedLoggingContext(implicit traceContext: TraceContext): NamedLoggingContext
    Attributes
    protected
    Definition Classes
    NamedLogging
  18. val namespace: Namespace
  19. final def ne(arg0: AnyRef): Boolean
    Definition Classes
    AnyRef
  20. def noTracingLogger: Logger
    Attributes
    protected
    Definition Classes
    NamedLogging
  21. def nodes: Set[Fingerprint]
  22. final def notify(): Unit
    Definition Classes
    AnyRef
    Annotations
    @IntrinsicCandidate() @native()
  23. final def notifyAll(): Unit
    Definition Classes
    AnyRef
    Annotations
    @IntrinsicCandidate() @native()
  24. def recompute()(implicit traceContext: TraceContext): Unit

    Recompute the authorization graph starting from the root certificate: We start at the root certificate and follow outgoing authorizations for all delegations that can sign NamespaceDelegations.

    Recompute the authorization graph starting from the root certificate: We start at the root certificate and follow outgoing authorizations for all delegations that can sign NamespaceDelegations. As a result, every key that doesn't end up in the cache is not connected to the root certificate and therefore useless.

    Attributes
    protected
  25. def remove(item: AuthorizedNamespaceDelegation)(implicit traceContext: TraceContext): Unit

    Remove all mappings with the same target key from this graph.

    Remove all mappings with the same target key from this graph.

    Exceptions thrown

    java.lang.IllegalArgumentException if item does not refer to namespace or the operation is not REMOVE.

  26. def replace(items: Seq[AuthorizedNamespaceDelegation])(implicit traceContext: TraceContext): Unit

    Add the mappings in items to this graph and remove any existing mappings with the same target fingerprint.

    Add the mappings in items to this graph and remove any existing mappings with the same target fingerprint. If an unauthorized namespace delegation is added to the graph, the graph will contain nodes that are not connected to the root. The target key of the unauthorized delegation will still be considered unauthorized.

    Exceptions thrown

    java.lang.IllegalArgumentException if item does not refer to namespace or the operation is not REPLACE.

  27. def replace(item: AuthorizedNamespaceDelegation)(implicit traceContext: TraceContext): Unit
  28. def report()(implicit traceContext: TraceContext): Unit
  29. final def synchronized[T0](arg0: => T0): T0
    Definition Classes
    AnyRef
  30. def toString(): String
    Definition Classes
    AuthorizationGraph → AnyRef → Any
  31. final def wait(arg0: Long, arg1: Int): Unit
    Definition Classes
    AnyRef
    Annotations
    @throws(classOf[java.lang.InterruptedException])
  32. final def wait(arg0: Long): Unit
    Definition Classes
    AnyRef
    Annotations
    @throws(classOf[java.lang.InterruptedException]) @native()
  33. final def wait(): Unit
    Definition Classes
    AnyRef
    Annotations
    @throws(classOf[java.lang.InterruptedException])

Deprecated Value Members

  1. def finalize(): Unit
    Attributes
    protected[lang]
    Definition Classes
    AnyRef
    Annotations
    @throws(classOf[java.lang.Throwable]) @Deprecated
    Deprecated

    (Since version 9)

Inherited from NamedLogging

Inherited from AuthorizationCheck

Inherited from AnyRef

Inherited from Any

Ungrouped