| | | 1 | | using System.Collections.ObjectModel; |
| | | 2 | | |
| | | 3 | | namespace AsiBackbone.Core.Signing; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Maps signature verification categories to host-facing verification policy actions. |
| | | 7 | | /// </summary> |
| | | 8 | | public sealed class VerificationPolicyOptions |
| | | 9 | | { |
| | 2 | 10 | | private static readonly IReadOnlyDictionary<SignatureVerificationCategory, VerificationPolicyAction> DefaultActionMa |
| | 2 | 11 | | new ReadOnlyDictionary<SignatureVerificationCategory, VerificationPolicyAction>( |
| | 2 | 12 | | new Dictionary<SignatureVerificationCategory, VerificationPolicyAction> |
| | 2 | 13 | | { |
| | 2 | 14 | | [SignatureVerificationCategory.Valid] = VerificationPolicyAction.Allow, |
| | 2 | 15 | | [SignatureVerificationCategory.InvalidSignature] = VerificationPolicyAction.Deny, |
| | 2 | 16 | | [SignatureVerificationCategory.HashMismatch] = VerificationPolicyAction.Deny, |
| | 2 | 17 | | [SignatureVerificationCategory.MissingSignature] = VerificationPolicyAction.RequireAcknowledgment, |
| | 2 | 18 | | [SignatureVerificationCategory.UnknownKeyVersion] = VerificationPolicyAction.Escalate, |
| | 2 | 19 | | [SignatureVerificationCategory.RevokedKey] = VerificationPolicyAction.Deny, |
| | 2 | 20 | | [SignatureVerificationCategory.ProviderUnavailable] = VerificationPolicyAction.Defer, |
| | 2 | 21 | | [SignatureVerificationCategory.CanonicalizationMismatch] = VerificationPolicyAction.Escalate, |
| | 2 | 22 | | [SignatureVerificationCategory.UnsupportedAlgorithm] = VerificationPolicyAction.Deny, |
| | 2 | 23 | | [SignatureVerificationCategory.Failed] = VerificationPolicyAction.Escalate |
| | 2 | 24 | | }); |
| | | 25 | | |
| | 8 | 26 | | private VerificationPolicyOptions(IReadOnlyDictionary<SignatureVerificationCategory, VerificationPolicyAction> actio |
| | | 27 | | { |
| | 8 | 28 | | Actions = actions; |
| | 8 | 29 | | } |
| | | 30 | | |
| | | 31 | | /// <summary> |
| | | 32 | | /// Gets the default verification policy action map. |
| | | 33 | | /// </summary> |
| | 76 | 34 | | public static VerificationPolicyOptions Default { get; } = new(DefaultActionMap); |
| | | 35 | | |
| | | 36 | | /// <summary> |
| | | 37 | | /// Gets the configured verification category to host action map. |
| | | 38 | | /// </summary> |
| | 82 | 39 | | public IReadOnlyDictionary<SignatureVerificationCategory, VerificationPolicyAction> Actions { get; } |
| | | 40 | | |
| | | 41 | | /// <summary> |
| | | 42 | | /// Creates verification policy options with optional host overrides. |
| | | 43 | | /// </summary> |
| | | 44 | | public static VerificationPolicyOptions Create( |
| | | 45 | | IReadOnlyDictionary<SignatureVerificationCategory, VerificationPolicyAction>? actionOverrides = null) |
| | | 46 | | { |
| | 10 | 47 | | Dictionary<SignatureVerificationCategory, VerificationPolicyAction> actions = new(DefaultActionMap); |
| | | 48 | | |
| | 10 | 49 | | if (actionOverrides is not null) |
| | | 50 | | { |
| | 40 | 51 | | foreach (KeyValuePair<SignatureVerificationCategory, VerificationPolicyAction> item in actionOverrides) |
| | | 52 | | { |
| | 12 | 53 | | if (!Enum.IsDefined(item.Key)) |
| | | 54 | | { |
| | 2 | 55 | | throw new ArgumentOutOfRangeException(nameof(actionOverrides), item.Key, "Verification category must |
| | | 56 | | } |
| | | 57 | | |
| | 10 | 58 | | if (!Enum.IsDefined(item.Value)) |
| | | 59 | | { |
| | 2 | 60 | | throw new ArgumentOutOfRangeException(nameof(actionOverrides), item.Value, "Verification policy acti |
| | | 61 | | } |
| | | 62 | | |
| | 8 | 63 | | actions[item.Key] = item.Value; |
| | | 64 | | } |
| | | 65 | | } |
| | | 66 | | |
| | 6 | 67 | | return new VerificationPolicyOptions(new ReadOnlyDictionary<SignatureVerificationCategory, VerificationPolicyAct |
| | | 68 | | } |
| | | 69 | | |
| | | 70 | | /// <summary> |
| | | 71 | | /// Gets the action configured for the supplied verification category. |
| | | 72 | | /// </summary> |
| | | 73 | | public VerificationPolicyAction GetAction(SignatureVerificationCategory category) |
| | | 74 | | { |
| | 84 | 75 | | return !Enum.IsDefined(category) |
| | 84 | 76 | | ? throw new ArgumentOutOfRangeException(nameof(category), category, "Verification category must be defined." |
| | 84 | 77 | | : Actions.TryGetValue(category, out VerificationPolicyAction action) |
| | 84 | 78 | | ? action |
| | 84 | 79 | | : VerificationPolicyAction.Escalate; |
| | | 80 | | } |
| | | 81 | | } |