DeviceRegistrationRepository
Device authentication public keys, one per DeviceAddress (docs/server-authentication.md). A registration is added by register and replaced only by replaceForRecovery (docs/device-recovery.md) or replaceForRotation (docs/device-authentication-rotation.md); it is never removed. Atomic; byte arrays are copied at the boundary.
Every registration has an authentication epoch: 1 for the first registration, one more for each recovery or rotation. Epochs only grow and never wrap: at Long.MAX_VALUE no further replacement is possible.
Every registration also has the server time its current key was installed at (DeviceRegistrationState.authKeyInstalledAt): set by register for a new registration and by a successful replacement, together with the key and the epoch. The caller supplies that time (the server's clock, never a client-supplied timestamp); retries that change nothing keep it (docs/device-authentication-rotation.md).
Functions
Registers registration if its address has none. Returns true if it was stored, false if exactly this key is registered already. Throws DeviceRegistrationException.Conflict and changes nothing if another key is registered. Concurrent calls behave as if they ran one after the other: of several different keys for one address, exactly one wins. A new registration has epoch 1 and installedAt as installation time; registering the registered key again changes neither.
The registration of address with its epoch, its key's installation time and the transition that installed its key, or null.
Replaces the target's key by a last-device recovery (docs/last-device-recovery.md) in one atomic step, together with the consumption of its challenge (LastDeviceRecoveryRepository). No nonce is claimed: the server-issued challenge is the single-use value. In this order:
Replaces the target's key in one atomic step, together with the claim of the recovery's nonce (AuthenticationNonceRepository, same nonces, under the target's address). In this order:
Replaces the device's key by a routine rotation (docs/device-authentication-rotation.md) in one atomic step, together with the claim of the rotation's nonce (AuthenticationNonceRepository, same nonces, under the device's address). In this order: