class TopologyTransactionAuthorizationValidator[+PureCrypto <: CryptoPureApi] extends NamedLogging with TransactionAuthorizationCache[PureCrypto]
validate topology transactions
NOT THREAD SAFE. Note that this class is not thread safe
we check three things:
- are the signatures valid
- are the signatures properly authorized
- load current set of authorized keys
- for each transaction, verify that the authorization keys are valid. a key is a valid authorization if there is a certificate chain that originates from the root certificate at the time when the transaction is added (one by one).
- if the transaction is a namespace, update its impact on the authorization set. This means that if we add or remove a namespace delegation, then we need to perform a cascading update that activates or deactivates states that depend on this delegation.
- finally, what we compute as the "authorized graph" is then used to compute the derived table of "namespace delegations"
Linear Supertypes
Ordering
- Alphabetic
- By Inheritance
Inherited
- TopologyTransactionAuthorizationValidator
- TransactionAuthorizationCache
- NamedLogging
- AnyRef
- Any
- Hide All
- Show All
Visibility
- Public
- Protected
Instance Constructors
- new TopologyTransactionAuthorizationValidator(pureCrypto: PureCrypto, store: TopologyStore[TopologyStoreId], validationIsFinal: Boolean, loggerFactory: NamedLoggerFactory)(implicit executionContext: ExecutionContext)
Value Members
- final def !=(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def ##: Int
- Definition Classes
- AnyRef → Any
- final def ==(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def asInstanceOf[T0]: T0
- Definition Classes
- Any
- def clone(): AnyRef
- Attributes
- protected[lang]
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.CloneNotSupportedException]) @IntrinsicCandidate() @native()
- val decentralizedNamespaceCache: TrieMap[Namespace, Option[DecentralizedNamespaceAuthorizationGraph]]
Invariants:
Invariants:
- If it stores ns -> Some(graph), then the graph corresponds to the active decentralized namespace delegation for ns. Moreover, for each owner o, the owner graph is namespaceCache(o).
- If it stores ns -> None, then there is no decentralized namespace delegation active for ns.
- If it stores ns -> Some(graph), then there is no direct namespace delegation active for ns.
- Attributes
- protected
- Definition Classes
- TransactionAuthorizationCache
- final def eq(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def equals(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef → Any
- implicit def errorLoggingContext(implicit traceContext: TraceContext): ErrorLoggingContext
- Attributes
- protected
- Definition Classes
- NamedLogging
- implicit val executionContext: ExecutionContext
- Definition Classes
- TopologyTransactionAuthorizationValidator → TransactionAuthorizationCache
- final def getClass(): Class[_ <: AnyRef]
- Definition Classes
- AnyRef → Any
- Annotations
- @IntrinsicCandidate() @native()
- def hashCode(): Int
- Definition Classes
- AnyRef → Any
- Annotations
- @IntrinsicCandidate() @native()
- final def isInstanceOf[T0]: Boolean
- Definition Classes
- Any
- def loadNamespaceCaches(asOfExclusive: CantonTimestamp, namespaces: Set[Namespace])(implicit traceContext: TraceContext): FutureUnlessShutdown[Unit]
- Attributes
- protected
- Definition Classes
- TransactionAuthorizationCache
- def logger: TracedLogger
- Attributes
- protected
- Definition Classes
- NamedLogging
- val loggerFactory: NamedLoggerFactory
- Definition Classes
- TopologyTransactionAuthorizationValidator → NamedLogging
- implicit def namedLoggingContext(implicit traceContext: TraceContext): NamedLoggingContext
- Attributes
- protected
- Definition Classes
- NamedLogging
- val namespaceCache: TrieMap[Namespace, AuthorizationGraph]
Invariants:
Invariants:
- If it stores ns -> graph, then graph consists of all active namespace delegations for ns.
- If it stores ns -> graph and graph is non-empty, then there is no decentralized namespace delegation active for ns.
- Attributes
- protected
- Definition Classes
- TransactionAuthorizationCache
- final def ne(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def noTracingLogger: Logger
- Attributes
- protected
- Definition Classes
- NamedLogging
- final def notify(): Unit
- Definition Classes
- AnyRef
- Annotations
- @IntrinsicCandidate() @native()
- final def notifyAll(): Unit
- Definition Classes
- AnyRef
- Annotations
- @IntrinsicCandidate() @native()
- final def populateCaches(asOfExclusive: CantonTimestamp, toProcess: GenericTopologyTransaction, inStore: Option[GenericTopologyTransaction])(implicit traceContext: TraceContext): FutureUnlessShutdown[Unit]
- Definition Classes
- TransactionAuthorizationCache
- val pureCrypto: PureCrypto
- Definition Classes
- TopologyTransactionAuthorizationValidator → TransactionAuthorizationCache
- final def reset(): Unit
- Definition Classes
- TransactionAuthorizationCache
- val store: TopologyStore[TopologyStoreId]
- Definition Classes
- TopologyTransactionAuthorizationValidator → TransactionAuthorizationCache
- final def synchronized[T0](arg0: => T0): T0
- Definition Classes
- AnyRef
- def toString(): String
- Definition Classes
- AnyRef → Any
- def tryGetAuthorizationCheckForNamespace(namespace: Namespace)(implicit traceContext: TraceContext): AuthorizationCheck
- Attributes
- protected
- Definition Classes
- TransactionAuthorizationCache
- def tryGetAuthorizationGraphForNamespace(namespace: Namespace)(implicit traceContext: TraceContext): AuthorizationGraph
- Attributes
- protected
- Definition Classes
- TransactionAuthorizationCache
- def validateAndUpdateHeadAuthState(effectiveTime: CantonTimestamp, toValidate: GenericSignedTopologyTransaction, inStore: Option[GenericSignedTopologyTransaction], expectFullAuthorization: Boolean, transactionMayHaveMissingSigningKeySignatures: Boolean)(implicit traceContext: TraceContext): FutureUnlessShutdown[GenericValidatedTopologyTransaction]
Validates the provided topology transactions and applies the certificates to the auth state
Validates the provided topology transactions and applies the certificates to the auth state
When receiving topology transactions we have to evaluate them and continuously apply any update to the namespace delegations to the "head state".
And we use that "head state" to verify if the transactions are authorized or not.
- transactionMayHaveMissingSigningKeySignatures
If set to true, the validation of the transaction does not consider missing signatures for extra keys (e.g. new signing keys for OwnerToKeyMapping) to be required for the transaction to become fully authorized. This flag allows importing legacy topology snapshots that contain topology transactions that did not require signatures for new signing keys.
- final def wait(arg0: Long, arg1: Int): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(arg0: Long): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException]) @native()
- final def wait(): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])