box / box/box-java-sdk

Make IPrivateKeyDecryptor Instantiation Configurable in JWTEncryptionPreferences to avoid compilation-time errors

Open
#1,310 1 comment 0 reactions 5 assignees Claimed by @mwwoda View on GitHub
enhancement
Dominant language
Java
Stars
170
Forks
189
Avg merge
20h 26m
Merged PRs (30d)
22

Description

### Is your feature request related to a problem? Please describe.
The class `JWTEncryptionPreferences` has a private `IPrivateKeyDecryptor` field (`privateKeyDecryptor`) that is instantiated immediately with `BCPrivateKeyDecryptor()`. Although it is possible to override the `IPrivateKeyDecryptor` later via a call to `boxConfig.setPrivateKeyDecryptor`, by the time this becomes possible, `BCPrivateKeyDecryptor()` has already been instantiated. `BCPrivateKeyDecryptor` imports `BouncyCastleProvider`, which we exclude from dependencies to ensure that only FIPS-compliant BouncyCastle libraries are present, resulting in a failure.

### Describe the solution you'd like
It would be helpful if the instantiation of `JWTEncryptionPreferences` became more configurable. For example, moving this instantiation to a default constructor while allowing an alternative constructor, or utilizing interfaces to make it easier to override the functionality altogether.

### Describe alternatives you've considered
1. Allowing `BouncyCastleProvider` in just for the sake of not receiving compilation-time errors.
2. Implementing a fake `BouncyCastleProvider` to "trick" the compiler.
3. Using reflection.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.