Package co.ankatech.ankasecure.sdk.internal.service.impl

Class CombinedOperationsServiceImpl

java.lang.Object

co.ankatech.ankasecure.sdk.internal.service.impl.CombinedOperationsServiceImpl

All Implemented Interfaces:

co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

public final class CombinedOperationsServiceImpl
extends Object
implements co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Thread-safe implementation of CombinedOperationsService.

Delegates all operations to the AnkaSecure REST API via OpenAPI client.

Constructor Summary

Constructors

Constructor	Description
CombinedOperationsServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api)	Convenience constructor using the default OverwritePolicy.FAIL_IF_EXISTS policy.
CombinedOperationsServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api, OverwritePolicy overwritePolicy)	Constructor with dependency injection.

Method Summary

Modifier and Type	Method	Description
DecryptVerifyResult	decryptThenVerify(String jweToken)	Decrypts JWE token then verifies the inner JWS signature.
DecryptVerifyResult	decryptThenVerifyFile(Path input, Path output)	Decrypts file then verifies signature (bulk/compact mode).
DecryptVerifyResult	decryptThenVerifyFileStream(Path input, Path output)	Decrypts a nested JWE(JWS) file then verifies the inner signature (streaming mode for large files).
SignEncryptResult	signThenEncrypt(String signKid, String encryptKid, byte[] data)	Signs data with signing key then encrypts the JWS result with encryption key.
SignEncryptResult	signThenEncrypt(String signKid, String encryptKid, byte[] data, JwsSerialization serialization)	Sign-then-encrypt with an explicit inner-JWS serialization selection (PRD §60).
SignEncryptResult	signThenEncryptFile(String signKid, String encryptKid, Path input, Path output)	Signs file content then encrypts result (bulk/compact mode).
SignEncryptResult	signThenEncryptFile(String signKid, String encryptKid, Path input, Path output, JwsSerialization serialization)	Sign-then-encrypt a file with an explicit inner-JWS serialization selection (PRD §60).
SignEncryptResult	signThenEncryptFileStream(String signKid, String encryptKid, Path input, Path output)	Signs file content then encrypts result (streaming mode for large files).

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CombinedOperationsServiceImpl

public CombinedOperationsServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api)

Convenience constructor using the default OverwritePolicy.FAIL_IF_EXISTS policy.

Parameters:

api - OpenAPI client for REST API calls

CombinedOperationsServiceImpl

public CombinedOperationsServiceImpl(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient api,
 OverwritePolicy overwritePolicy)

Constructor with dependency injection.

Parameters:

api - OpenAPI client for REST API calls

overwritePolicy - how an existing output destination is handled at promotion time

Method Details

signThenEncrypt

public SignEncryptResult signThenEncrypt(String signKid,
 String encryptKid,
 byte[] data)
                                  throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Signs data with signing key then encrypts the JWS result with encryption key.

Produces a nested JWE(JWS) token structure: the plaintext is first signed (creating a JWS), then the JWS is encrypted (creating a JWE containing the JWS).

Use case: When you need both authenticity (signature) and confidentiality (encryption) in a single atomic operation.

Specified by:

signThenEncrypt in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

signKid - private key identifier for signing

encryptKid - public key identifier for encryption

data - plaintext bytes to sign and encrypt

Returns:

result containing nested JWE(JWS) token and separated metadata

Throws:

AnkaSecureSdkException - if signing or encryption fails, or if keys not found

signThenEncrypt

public SignEncryptResult signThenEncrypt(String signKid,
 String encryptKid,
 byte[] data,
 JwsSerialization serialization)
                                  throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Sign-then-encrypt with an explicit inner-JWS serialization selection (PRD §60). A null serialization omits the field and lets the server choose the standards-correct representation of the inner JWS.

Specified by:

signThenEncrypt in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

signKid - private key identifier for signing

encryptKid - public key identifier for encryption

data - plaintext bytes to sign and encrypt

serialization - requested inner-JWS serialization, or null to defer

Returns:

result containing nested JWE(JWS) token and separated metadata

Throws:

AnkaSecureSdkException - if signing or encryption fails, or if keys not found

decryptThenVerify

public DecryptVerifyResult decryptThenVerify(String jweToken)
                                      throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Decrypts JWE token then verifies the inner JWS signature.

Reverses the sign-encrypt operation: first decrypts the JWE to extract the JWS, then verifies the JWS signature and extracts the plaintext. Key identifiers are automatically extracted from JWE and JWS headers.

Important: This method will NOT fail if signature verification fails. Check result.isSignatureValid() to confirm authenticity.

Specified by:

decryptThenVerify in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

jweToken - nested JWE(JWS) token with kid claims in headers

Returns:

result containing plaintext, verification status, and metadata

Throws:

AnkaSecureSdkException - if decryption fails or token is malformed

signThenEncryptFile

public SignEncryptResult signThenEncryptFile(String signKid,
 String encryptKid,
 Path input,
 Path output)
                                      throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Signs file content then encrypts result (bulk/compact mode).

Reads entire file into memory, signs it, encrypts the signature, and writes the nested JWE(JWS) token to output file.

Size limit: Use streaming variant for files ≥100MB.

Specified by:

signThenEncryptFile in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

signKid - private key identifier for signing

encryptKid - public key identifier for encryption

input - input file to read plaintext from

output - output file to write nested JWE(JWS) token to

Returns:

result containing token location and separated metadata

Throws:

AnkaSecureSdkException - if signing, encryption, or I/O fails

signThenEncryptFile

public SignEncryptResult signThenEncryptFile(String signKid,
 String encryptKid,
 Path input,
 Path output,
 JwsSerialization serialization)
                                      throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Sign-then-encrypt a file with an explicit inner-JWS serialization selection (PRD §60). A null serialization omits the field.

Specified by:

signThenEncryptFile in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

signKid - private key identifier for signing

encryptKid - public key identifier for encryption

input - input file to read plaintext from

output - output file to write nested JWE(JWS) token to

serialization - requested inner-JWS serialization, or null to defer

Returns:

result containing token location and separated metadata

Throws:

AnkaSecureSdkException - if signing, encryption, or I/O fails

decryptThenVerifyFile

public DecryptVerifyResult decryptThenVerifyFile(Path input,
 Path output)
                                          throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Decrypts file then verifies signature (bulk/compact mode).

Reads nested JWE(JWS) token from input file, decrypts it, verifies signature, and writes plaintext to output file. Key identifiers are automatically extracted from token headers.

Specified by:

decryptThenVerifyFile in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

input - input file containing nested JWE(JWS) token with kid claims

output - output file to write plaintext to

Returns:

result containing plaintext location, verification status, and metadata

Throws:

AnkaSecureSdkException - if decryption or I/O fails

signThenEncryptFileStream

public SignEncryptResult signThenEncryptFileStream(String signKid,
 String encryptKid,
 Path input,
 Path output)
                                            throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Signs file content then encrypts result (streaming mode for large files).

Uses multipart HTTP streaming to process the file in bounded memory so the inner signature is carried ENCRYPTED. Suitable for files ≥100MB. The response is the nested JWE(JWS) ciphertext, written to output via the unified sidecar contract (PRODUCER — plain sidecar copy, no end-of-stream verdict); an existing destination is governed by the SDK's OverwritePolicy.

Specified by:

signThenEncryptFileStream in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

signKid - private key identifier for signing (inner JWS)

encryptKid - public key identifier for encryption (outer JWE)

input - input file to stream

output - output file to write the nested JWE(JWS) artifact to

Returns:

result containing the outer-JWE (encrypt) metadata; the artifact is the output file (streaming — getJweToken() is null)

Throws:

AnkaSecureSdkException - if signing, encryption, or streaming fails

decryptThenVerifyFileStream

public DecryptVerifyResult decryptThenVerifyFileStream(Path input,
 Path output)
                                                throws AnkaSecureSdkException

Description copied from interface: co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Decrypts a nested JWE(JWS) file then verifies the inner signature (streaming mode for large files).

Uses multipart HTTP streaming. The server returns a TWO-verdict trailing part carrying BOTH the outer AES-GCM tag result and the inner JWS signature result; the SDK quarantines the plaintext to a sidecar and promotes it to output ONLY when the overall verdict is VALID (fail-closed). An INVALID or absent verdict discards the output and raises a typed StreamIntegrityException — no file is written.

Specified by:

decryptThenVerifyFileStream in interface co.ankatech.ankasecure.sdk.internal.service.CombinedOperationsService

Parameters:

input - nested JWE(JWS) streaming artifact (the output of signThenEncryptFileStream)

output - destination for the recovered plaintext

Returns:

result with the recovered plaintext location, verification status, and the §60 informational qualified timestamp (which never affects validity)

Throws:

AnkaSecureSdkException - if decryption or I/O fails

StreamIntegrityException - if the integrity verdict is INVALID or absent