Merge Java package 'c.y.s.tls.{auth,json,policy}' into 'c.y.s.tls'

Facilitate improved encapsulation of Vespa mTLS related classes

1 files changed, 24 insertions, 0 deletions

diff --git a/security-utils/src/main/java/com/yahoo/security/tls/ConnectionAuthContext.java b/security-utils/src/main/java/com/yahoo/security/tls/ConnectionAuthContext.java
new file mode 100644
index 00000000000..821d41cfabe
--- /dev/null
+++ b/security-utils/src/main/java/com/yahoo/security/tls/ConnectionAuthContext.java
@@ -0,0 +1,24 @@
+package com.yahoo.security.tls;
+
+import java.security.cert.X509Certificate;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author bjorncs
+ */
+public record ConnectionAuthContext(List<X509Certificate> peerCertificateChain,
+                                    CapabilitySet capabilities,
+                                    Set<String> matchedPolicies) {
+
+    public ConnectionAuthContext {
+        if (peerCertificateChain.isEmpty()) throw new IllegalArgumentException("Peer certificate chain is empty");
+        peerCertificateChain = List.copyOf(peerCertificateChain);
+        matchedPolicies = Set.copyOf(matchedPolicies);
+    }
+
+    public boolean authorized() { return !capabilities.hasNone(); }
+
+    public X509Certificate peerCertificate() { return peerCertificateChain.get(0); }
+
+}