AtClientEnvelopeSigner class

The signing and verifying half of the secret-sharing substrate, on its own: ApkamSigning and EnvelopeSigning sign a payload with this client's APKAM keypair and verify another client's signature against the _apsk its enrollment published, without pulling in a whole secret-sharing instance.

Use AtClientSecretSharing.forClient instead when the caller also sends or receives secrets; it mixes these in too.

Mixed-in types

Constructors

AtClientEnvelopeSigner(AtClient atClient, {({Duration cacheExpiry})? publicKeyCacheSettings = (cacheExpiry: Duration(minutes: 5))})

Properties

atClient → AtClient
final
authenticationSigningKey → Future<ApkamSigningKeys?>
The APKAM authentication keypair as a signing key: the keyfile's for enrollmentId — typed material first, the flat pair as rsa2048 otherwise — or null when it holds neither.
no setterinherited
enrollmentId → String
no setterinherited
hashCode → int
The hash code for this object.
no setterinherited
heldSigningKeys → Future<List<ApkamSigningKeys>>
What the keyfile holds for enrollmentId, filtered to what this build can sign an envelope with. Empty when the client has no key source or no keyfile, or when the enrollment holds none; a keyfile that cannot be read throws.
no setterinherited
logger → AtSignLogger
final
pubKeyCache → Map<String, (String, DateTime)>
Cached public keys and when each expires. An entry is dropped when a lookup finds it expired, and on each insert, so nothing here holds a timer.
no setterinherited
publicKeyCacheSettings → ({Duration cacheExpiry})?
How long a public key fetched for verification is used before it is fetched again: cacheExpiry from the fetch, however often it is used.
final
publicSigningKeyUri → String
Where this enrollment's signing keys are advertised, e.g. public:_apsk.<enrollment_id>.a.__e@atsign. The record holds publicSigningKeyValue — every key, not one.
no setterinherited
publicSigningKeyValue → Future<String>
What publishPublicSigningKey writes: what signs for this enrollment now plus the signing keys it has withdrawn from service, composed by apskEntries and spelled by apskValueOf.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
signingKeys → Future<List<ApkamSigningKeys>>
The keys this client signs content with, strongest algorithm first: those of its client data signing keys that have a link, while any do, and otherwise every one it holds. Never empty: throws AtKeyNotFoundException when it holds no key to sign with, as when it has no keyfile, and a keyfile that cannot be read throws that read's error.
no setterinherited
withdrawnSigningKeys → Future<List<({SigningAlgoType algorithm, String publicKey, KeyEntryStatus status})>>
The public half of every signing key this enrollment has taken out of service, each with the status the keyfile gives it — the non-active entries of its advertisement, which keep envelopes signed before the key was withdrawn verifiable.
no setterinherited

Methods

cachePubKey(String atSign, String enrollmentId, String pubKey) → void
inherited
getApkamPublicKey(String atSign, String enrollmentId) → Future<String>
Fetch the APKAM public signing key which enrollmentId of atSign has published in its per-enrollment namespace. See ApkamSigning.publicSigningKeyUri.
inherited
lookupPubKey(String atSign, String enrollmentId) → String?
inherited
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
publishPublicSigningKey({String? value}) → Future
Publishes this client's signing keys at publicSigningKeyUri, if what is there is not already what it holds.
inherited
publishPublicSigningKeyLocked({String? value}) → Future
publishPublicSigningKey without taking the lock, for a caller that already holds it. Taking it twice from one call chain would deadlock: the second acquire waits on a chain entry only the first can complete.
inherited
toString() → String
A string representation of this object.
inherited
verifyEnvelopeSignature(SignedEnvelope envelope, {required String signerAtSign, String? signerEnrollmentId, EnvelopeType expecting = EnvelopeType.app}) → Future<void>
Verify an envelope created by wrapAndSign or wrapAndSignAndJsonEncode.
inherited
wrapAndSign(Object? payload, {Object? toEncodable(Object? nonEncodable)?, EnvelopeType type = EnvelopeType.app}) → Future<SignedEnvelope>
Create a json envelope around payload in a format that can be verified by verifyEnvelopeSignature.
inherited
wrapAndSignAndJsonEncode(Object? payload, {Object? toEncodable(Object? nonEncodable)?, EnvelopeType type = EnvelopeType.app}) → FutureOr<String>
Same as wrapAndSign but we also call jsonEncode for you :)
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited