EnrollmentUpdateRequest constructor

EnrollmentUpdateRequest({ required String enrollmentId, String? apkamPublicKey, String? apkamPrivateKey, SigningAlgoType? signingAlgo, List<ApskSigningKey>? signingKeys, String? apskLegacy, Map<String, dynamic>? metadata, })

Implementation

EnrollmentUpdateRequest({
  required this.enrollmentId,
  this.apkamPublicKey,
  this.apkamPrivateKey,
  this.signingAlgo,
  this.signingKeys,
  this.apskLegacy,
  this.metadata,
}) {
  if ((apkamPublicKey == null) != (apkamPrivateKey == null)) {
    throw AtEnrollmentException(
        'a rotation supplies both halves of the APKAM keypair: the public '
        'half is what the atServer installs, and the private half is the '
        'only thing that can prove the sender holds it');
  }
  if ((apkamPublicKey == null) != (signingAlgo == null)) {
    throw AtEnrollmentException(
        'apkamPublicKey and signingAlgo are supplied together: the algorithm '
        'describes the key, and each is unusable without the other — the '
        'atServer refuses an algorithm with no key, and the possession '
        'proof over a key needs the algorithm to sign under');
  }
  if (signingKeys != null && apskLegacy != null) {
    throw AtEnrollmentException(
        'signingKeys and apskLegacy are mutually exclusive: one enrollment '
        'publishes one _apsk value');
  }
  if (signingKeys != null && signingKeys!.isEmpty) {
    throw AtEnrollmentException(
        'an _apsk advertising no key at all is one every reader refuses, '
        'which leaves this enrollment unable to have anything it signs '
        'verified; omit signingKeys to leave the advertisement alone');
  }
  if (apkamPublicKey == null &&
      signingKeys == null &&
      apskLegacy == null &&
      metadata == null) {
    throw AtEnrollmentException(
        'an enroll:update must name something to change: an APKAM keypair, '
        'signing keys, a legacy _apsk or metadata');
  }
}