ksecuremessage-storage-rotation-core/dev.kreienbuehl.ksecuremessage.storage.rotation

Package-level declarations

Types

What a persistent storage adapter provides so StorageKeyRotationManager can rotate its storage key (docs/storage-key-rotation.md). The manager owns the order of the steps and the rules between them; the backend owns the persisted rotation state, its transactions, the records and the proof that no record uses a key.

StorageKeyRotationInProgressException

class StorageKeyRotationInProgressException(val status: StorageKeyRotationStatus) : IllegalStateException

StorageKeyRotationManager.rotate was called while a rotation is already migrating or retiring. Finish it with StorageKeyRotationManager.resume first.

StorageKeyRotationManager

class StorageKeyRotationManager(backend: StorageKeyRotationBackend, keyProvider: StorageKeyProvider)

The storage key rotation state machine (docs/storage-key-rotation.md): STABLE → PREPARING → MIGRATING → RETIRING → STABLE, over a backend that persists the state and records and a keyProvider that holds the key material.

StorageKeyRotationPhase

enum StorageKeyRotationPhase : Enum<StorageKeyRotationPhase>

Phase of a storage key rotation (docs/storage-key-rotation.md). Storage key rotation replaces the key that encrypts client storage records; it is unrelated to signed prekey rotation.

StorageKeyRotationState

sealed class StorageKeyRotationState

The persisted storage key rotation state of one storage, validated. Key IDs only. Each phase carries exactly the key IDs it needs, so an inconsistent combination cannot be represented. highestKeyId is the key ID high-water mark: IDs are allocated above it, never reused and never wrapped around.

StorageKeyRotationStatus

data class StorageKeyRotationStatus(val phase: StorageKeyRotationPhase, val currentKeyId: StorageKeyId, val nextKeyId: StorageKeyId?, val retiringKeyId: StorageKeyId?, val remainingRecords: Long)

State of storage key rotation. Key IDs only, never key material. remainingRecords counts the records not yet sealed with currentKeyId; it is 0 outside StorageKeyRotationPhase.MIGRATING.