Class TlsTrustEvaluator

java.lang.Object

com.cloudforgeci.api.core.TlsTrustEvaluator

public final class TlsTrustEvaluator
extends Object

Single source of truth for "does this deployment's ALB HTTPS listener end up wearing a publicly-trusted certificate" — the same three-way decision FargateRuntimeConfiguration makes when choosing which certificate to actually provision (imported ARN, DNS-validated public, or the untrusted AWS Private CA fallback), extracted here so ContainerFactory doesn't carry its own independently-maintained copy of that logic (a real drift risk — the two classes used to duplicate this inline, one computing which cert to create, the other computing whether to tell cloudforge-manager the result is trustworthy; if they ever disagreed, Manager's license page would report the wrong thing about its own installation).

Deliberately a pure function of plain deployment-context values, not of any CDK construct or SystemContext Slot — the real decision inside FargateRuntimeConfiguration is resolved asynchronously (Slot callbacks, once the ALB/zone exist), but "would this configuration result in a trusted cert" doesn't actually depend on any of that; it's fully determined by the same four inputs a customer configures up front. This lets ContainerFactory compute the answer synchronously at container-env-build time, and lets both classes' behavior be verified with a single, fast, CDK-synthesis-free unit test (TlsTrustEvaluatorTest) instead of only ever being exercised indirectly through a full stack synthesis.

Method Summary

Modifier and Type	Method	Description
static boolean	isPubliclyTrusted(boolean sslEnabled, String domain, String fqdn, String certificateArn)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

isPubliclyTrusted

public static boolean isPubliclyTrusted(boolean sslEnabled,
 String domain,
 String fqdn,
 String certificateArn)

Parameters:

sslEnabled - enableSsl deployment-context value

domain - domain deployment-context value

fqdn - fqdn deployment-context value (subdomain+domain, or an explicit override — see DeploymentConfig#fqdn's javadoc)

certificateArn - certificateArn deployment-context value — an already-issued/ imported ACM certificate, see DeploymentConfig#certificateArn

Returns:

true only when the resulting certificate would be one a real browser already trusts: an imported/existing ACM cert (assumed public — that's the documented contract of the certificateArn field), or ACM's own DNS-validated public path (SSL enabled with a domain, and a Route53 zone this deployment controls). false for SSL disabled entirely, AND for SSL-enabled-with-no-domain — that combination takes FargateRuntimeConfiguration's AWS Private CA fallback path, which the code that provisions it explicitly logs is NOT trusted by browsers.