isRoleKeyId static method

bool isRoleKeyId(
  1. String keyId,
  2. String role
)

Whether keyId names a keypair of role — <role>:<algo>:<generation> exactly, the shape keyIdPrefix composes and every generation parse reads.

The shape is the filter, not the material's part type, which is ambiguous in both directions: an enrollment can hold privateSigning material under more than one keyId, and the atSign's signing root is privateSigning too while belonging to no enrollment.

The algorithm is not matched. A caller asking "is this a root slot" wants every generation of every algorithm, because that is what makes a key of one algorithm replaceable by a key of another.

Implementation

static bool isRoleKeyId(String keyId, String role) {
  final prefix = '$role:';
  if (!keyId.startsWith(prefix)) return false;
  final suffix = keyId.substring(prefix.length).split(':');
  return suffix.length == 2 && int.tryParse(suffix[1]) != null;
}