authenticationAlgorithmFor method

SigningAlgoType? authenticationAlgorithmFor(String? enrollmentId)

The algorithm half of authenticationFor, without building an AtChops.

A caller holding an injected AtChops still has to name the algorithm, and building one it will discard is not free — _toAtChops throws on a keyfile that is missing any of the material it needs, so resolving eagerly would fail a caller that never needed the keypair at all.

Null means the flat fields and nothing else: this enrollment files no typed authentication material, so its keypair is the flat RSA pair and rsa2048 is what signs it. An enrollment whose typed material names an algorithm this build cannot sign with is refused rather than reported as null, because the two are indistinguishable afterwards and the obvious reading of null — legacy, so rsa2048 — would sign a different enrollment's credentials with the wrong routine. Where both really are wanted as null, signingAlgorithmForEnrollment is the call that says so.

Throws AtKeyNotFoundException for that case. A keyfile written by a newer client is the way it happens.

Implementation

SigningAlgoType? authenticationAlgorithmFor(String? enrollmentId) {
  if (enrollmentId == null) return null;
  final algorithm = signingAlgorithmForEnrollment(enrollmentId);
  if (algorithm != null) return algorithm;
  final material = _activeAuthenticationMaterial(enrollmentId);
  if (material != null) {
    throw AtKeyNotFoundException(
        'Enrollment $enrollmentId authenticates with '
        '"${material.algorithm}", which this build cannot sign '
        'with. Its keypair is in this keyfile; the flat fields are a '
        'different enrollment\'s and are not a substitute for it.');
  }
  return null;
}