Class EnvelopeCodec.Builder

java.lang.Object

org.jwcarman.codec.crypto.EnvelopeCodec.Builder

Enclosing class:

EnvelopeCodec

public static final class EnvelopeCodec.Builder
extends Object

Builder for EnvelopeCodec.

Method Summary

Modifier and Type	Method	Description
EnvelopeCodec.Builder	aad(byte[] aad)	Sets the additional authenticated data (AAD) bound to every message produced by this codec.
EnvelopeCodec.Builder	allowedKeyIds(Predicate<String> allowedKeyIds)	Sets the predicate used to admit a wire keyId on decode, overriding the provider's DataKeyProvider.allowsKeyId(String).
EnvelopeCodec	build()	Builds the EnvelopeCodec.
EnvelopeCodec.Builder	provider(Provider provider)	Sets the Provider used to look up the AES/GCM/NoPadding Cipher for every encode and decode, so a FIPS-validated or otherwise pinned provider can be selected per codec instead of being installed as the JVM's globally highest-priority provider.
EnvelopeCodec.Builder	secureRandom(SecureRandom random)	Sets the source of randomness used to generate nonces.
EnvelopeCodec.Builder	strategy(DataKeyStrategy strategy)	Sets the strategy used to acquire the data key for each message.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

strategy

public EnvelopeCodec.Builder strategy(DataKeyStrategy strategy)

Sets the strategy used to acquire the data key for each message.

Parameters:

strategy - the DataKeyStrategy to use; defaults to DirectDataKeyStrategy

Returns:

this builder

aad

public EnvelopeCodec.Builder aad(byte[] aad)

Sets the additional authenticated data (AAD) bound to every message produced by this codec.

Parameters:

aad - the AAD bytes, defensively copied; must not be empty

Returns:

this builder

Throws:

IllegalArgumentException - if aad is empty

allowedKeyIds

public EnvelopeCodec.Builder allowedKeyIds(Predicate<String> allowedKeyIds)

Sets the predicate used to admit a wire keyId on decode, overriding the provider's DataKeyProvider.allowsKeyId(String).

Parameters:

allowedKeyIds - the predicate to consult; defaults to provider::allowsKeyId

Returns:

this builder

secureRandom

public EnvelopeCodec.Builder secureRandom(SecureRandom random)

Sets the source of randomness used to generate nonces.

Parameters:

random - the SecureRandom to use; defaults to a new instance

Returns:

this builder

provider

public EnvelopeCodec.Builder provider(Provider provider)

Sets the Provider used to look up the AES/GCM/NoPadding Cipher for every encode and decode, so a FIPS-validated or otherwise pinned provider can be selected per codec instead of being installed as the JVM's globally highest-priority provider.

Resolved once at build() time: if the provider cannot supply the transform, build() throws IllegalStateException immediately rather than letting the misconfiguration surface later as a DecryptionException on the first message.

Parameters:

provider - the Provider to use; defaults to the JDK's default provider lookup

Returns:

this builder

build

public EnvelopeCodec build()

Builds the EnvelopeCodec.

Returns:

a new EnvelopeCodec

Throws:

IllegalStateException - if a provider was set and cannot supply AES/GCM/NoPadding