CryptoConfig class

Selects and configures the crypto providers for an AtClient.

Constructors

CryptoConfig({required String defaultProviderId, List<CryptoProvider> providers = const [], NskeyKeyRing? keyRing, CkRotationPolicy ckRotationPolicy = rotateCkAfterOneYear, Duration supersededCkGrace = defaultSupersededCkGrace, NskeyRotationPolicy nskeyRotationPolicy = rotateNskeyAfterOneYear})

const

CryptoConfig.eraDefault()

The distinguished "the app named nothing" marker — the default value of AtClientPreference.crypto.

const

factory

CryptoConfig.legacy()

Legacy-only — the default for un-migrated apps.

const

CryptoConfig.nskey({required NskeyKeyRing keyRing, List<String> sealsToKeyAlgorithms = SecretSharingAlgos.keyAlgos, CkRotationPolicy ckRotationPolicy = rotateCkAfterOneYear, Duration supersededCkGrace = defaultSupersededCkGrace, NskeyRotationPolicy nskeyRotationPolicy = rotateNskeyAfterOneYear})

The nskey data path: application data under at/symmetric/AES/GCM, content keys conveyed by at/nskey, and the CK manager that mints one the first time a destination is written to.

factory

CryptoConfig.readsNskeyWritesLegacy({required NskeyKeyRing keyRing, List<String> sealsToKeyAlgorithms = SecretSharingAlgos.keyAlgos, CkRotationPolicy ckRotationPolicy = rotateCkAfterOneYear, Duration supersededCkGrace = defaultSupersededCkGrace, NskeyRotationPolicy nskeyRotationPolicy = rotateNskeyAfterOneYear})

The nskey providers wired for reading, with writes still going out under legacyCryptoProviderId.

factory

Properties

ckManager → CkManager?

The CkManager the configured providers share, or null if this config has no nskey data path.

no setter

ckRotationPolicy → CkRotationPolicy

Asked, on the write path, whether the content key for a destination and namespace should be replaced before anything else is written under it.

final

contentKeyCache → ContentKeyCache?

The content-key cache this config's nskey providers share, or null for a config that has none (the legacy set, or a caller's own providers).

no setter

defaultProviderId → String

The provider a put or notification the SDK encrypts uses when it names no cryptoProviderId.

final

hashCode → int

The hash code for this object.

no setter, inherited

keyRing → NskeyKeyRing?

The namespace key material these providers share, when there is any.

final

nskeyRotationPolicy → NskeyRotationPolicy

Asked whether a namespace key this atSign owns should be replaced.

final

providers → List<CryptoProvider>

The provider instances the SDK resolves against, in addition to the built-in legacy provider.

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

supersededCkGrace → Duration

How long a superseded content key is kept after the key that replaced it was cut, even when nothing in local storage cites it.

final

Methods

lookup(String id) → CryptoProvider?

The configured provider with id, or null if none matches.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

adoptEraDefault(AtClient atClient, CryptoConfig config) → void

Gives atClient the era's default config, unless the app named its own. Idempotent — a re-used cached client keeps the set it was built with, so its content-key cache and key ring survive re-creation.

clearEraDefault(AtClient atClient) → void

Forgets atClient's era default, so a test can rebuild a client's crypto world from scratch.

eraDefaultFor(AtClient atClient) → CryptoConfig?

The era default atClient holds, or null if it was never given one.

forClient(AtClient? atClient) → CryptoConfig

The config atClient encrypts under — the app's if it named one, else the SDK's default for this release.