EnrollmentUpdateRequest class

What an approved enrollment is asking to change about its own record, through enroll:update.

The operation reaches four things and nothing else: the APKAM authentication public key (and the algorithm that describes it), the _apsk signing-key advertisement, and the opaque metadata. It cannot reach the namespaces or the approval state — an enrollment that could amend those could widen its own grant, which is privilege escalation with a valid signature on it — and the atServer refuses a request that names them.

It is self-only: the connection must be authenticated as the enrollment being updated. An owner connection is refused rather than waved through, because an owner cannot sign anything with this enrollment's APKAM private key and so could only deny it service.

// Advertise a second algorithm's signing key beside the first.
final request = EnrollmentUpdateRequest(
  enrollmentId: enrollmentId,
  signingKeys: [
    ApskSigningKey.forPublicKey(
        alg: SigningAlgoType.mldsa65, pub: mlDsaPublicKey),
    ApskSigningKey.forPublicKey(
        alg: SigningAlgoType.rsa2048, pub: rsaPublicKey),
  ],
);
await atEnrollment.update(request, atLookUp);

Constructors

EnrollmentUpdateRequest({required String enrollmentId, String? apkamPublicKey, String? apkamPrivateKey, SigningAlgoType? signingAlgo, List<ApskSigningKey>? signingKeys, String? apskLegacy, Map<String, dynamic>? metadata})

Properties

apkamPrivateKey → String?
The private half of apkamPublicKey. Never sent — it signs the proof of possession the atServer requires before it will install the public half.
final
apkamPublicKey → String?
The APKAM authentication public key to move this enrollment onto, or null to leave it as it is.
final
apskLegacy → String?
The bare RSA _apsk string to publish verbatim, for an enrollment that must keep the shape every deployed consumer parses.
final
enrollmentId → String
The enrollment being amended, which must be the one the connection is authenticated as.
final
hashCode → int
The hash code for this object.
no setterinherited
metadata → Map<String, dynamic>?
Metadata to merge into the record's, or null to leave it alone.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
signingAlgo → SigningAlgoType?
The algorithm apkamPublicKey is spelled in — required with it and meaningless without it, in both directions.
final
signingKeys → List<ApskSigningKey>?
The signing keys to advertise at public:_apsk.<enrollmentId>.a.__e@<atSign>, replacing what is published there, or null to leave the advertisement alone.
final

Methods

noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited