chore: Make all public API declarations explicitly public

Author: sureshg

module.yaml

@@ -32,11 +32,12 @@ settings:
     languageVersion: 2.3
     apiVersion: 2.3
     progressiveMode: true
-    allWarningsAsErrors: false
+    allWarningsAsErrors: true
     suppressWarnings: false
     powerAssert: enabled
     verbose: false
     freeCompilerArgs:
+      - -Xexplicit-api=strict
       - -Wextra
       - -Xcontext-parameters
       - -Xreport-all-warnings
@@ -60,6 +61,8 @@ settings:
 
 test-settings:
   kotlin:
+    freeCompilerArgs:
+      - -Xexplicit-api=disable
     powerAssert:
       enabled: true
       functions:

src/certkit/cert/Cert.kt

@@ -36,7 +36,7 @@ import kotlinx.datetime.*
  * }
  * ```
  */
-object Cert {
+public object Cert {
 
   private val SHA256_ECDSA_OID = Der.oid("1.2.840.10045.4.3.2")
   private val SUBJECT_KEY_ID_OID = Der.oid("2.5.29.14")
@@ -53,7 +53,7 @@ object Cert {
    * whole-second precision ([RFC 5280 §4.1.2.5.1](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5.1)).
    * Any sub-second component is silently truncated.
    */
-  fun buildSelfSigned(
+  public fun buildSelfSigned(
       keyPair: KeyPair,
       serialNumber: Long = 0,
       issuer: X500Principal,
@@ -123,7 +123,7 @@ object Cert {
   }
 
   /** Convenience overload that accepts [LocalDate] instead of [Instant]. */
-  fun buildSelfSigned(
+  public fun buildSelfSigned(
       keyPair: KeyPair,
       serialNumber: Long = 0,
       issuer: X500Principal,
@@ -143,7 +143,7 @@ object Cert {
           sans = sans,
       )
 
-  fun hashPublicKey(key: ECPublicKey): ByteArray {
+  public fun hashPublicKey(key: ECPublicKey): ByteArray {
     val raw = Der.sequence(Der.integer(key.w.affineX), Der.integer(key.w.affineY))
     return MessageDigest.getInstance("SHA-1").digest(raw)
   }

src/certkit/cert/Extns.kt

@@ -5,11 +5,12 @@ import javax.naming.ldap.LdapName
 import kotlin.time.Clock
 import kotlin.time.Duration
 import kotlin.time.Instant
+import kotlinx.datetime.LocalDateTime
 import kotlinx.datetime.TimeZone
 import kotlinx.datetime.toLocalDateTime
 
 /** Returns the subject common name (CN) from the certificate's distinguished name. */
-val X509Certificate.commonName: String
+public val X509Certificate.commonName: String
   get() =
       LdapName(subjectX500Principal.name)
           .rdns
@@ -22,7 +23,7 @@ val X509Certificate.commonName: String
  *
  * SAN type OIDs: 1 = RFC822/email, 2 = DNS, 7 = IP address.
  */
-val X509Certificate.subjectAltNames: List<String>
+public val X509Certificate.subjectAltNames: List<String>
   get() =
       subjectAlternativeNames
           .orEmpty()
@@ -37,11 +38,11 @@ val X509Certificate.subjectAltNames: List<String>
           }
 
 /** Returns `true` if this certificate is signed by the given [ca] certificate. */
-fun X509Certificate.signedBy(ca: X509Certificate): Boolean =
+public fun X509Certificate.signedBy(ca: X509Certificate): Boolean =
     issuerX500Principal == ca.subjectX500Principal && runCatching { verify(ca.publicKey) }.isSuccess
 
 /** Returns `true` if this certificate is self-signed. */
-val X509Certificate.selfSigned: Boolean
+public val X509Certificate.selfSigned: Boolean
   get() = signedBy(this)
 
 /**
@@ -54,43 +55,43 @@ val X509Certificate.selfSigned: Boolean
  *
  * Self-signed certs often include only Basic Constraints without Key Usage.
  */
-val X509Certificate.isCA: Boolean
+public val X509Certificate.isCA: Boolean
   get() = basicConstraints >= 0 || keyUsage?.get(5) == true
 
 /** Returns `true` if this certificate is an intermediate CA (CA but not self-signed). */
-val X509Certificate.isIntermediateCA: Boolean
+public val X509Certificate.isIntermediateCA: Boolean
   get() = isCA && !selfSigned
 
 /** Returns the certificate's start (notBefore) date/time in UTC. */
-val X509Certificate.startDateUtc
+public val X509Certificate.startDateUtc: LocalDateTime
   get() = Instant.fromEpochMilliseconds(notBefore.time).toLocalDateTime(TimeZone.UTC)
 
 /** Returns the certificate's start (notBefore) date/time in the system's local time zone. */
-val X509Certificate.startDate
+public val X509Certificate.startDate: LocalDateTime
   get() =
       Instant.fromEpochMilliseconds(notBefore.time).toLocalDateTime(TimeZone.currentSystemDefault())
 
 /** Returns the certificate's expiry (notAfter) date/time in UTC. */
-val X509Certificate.expiryDateUtc
+public val X509Certificate.expiryDateUtc: LocalDateTime
   get() = Instant.fromEpochMilliseconds(notAfter.time).toLocalDateTime(TimeZone.UTC)
 
 /** Returns the certificate's expiry (notAfter) date/time in the system's local time zone. */
-val X509Certificate.expiryDate
+public val X509Certificate.expiryDate: LocalDateTime
   get() =
       Instant.fromEpochMilliseconds(notAfter.time).toLocalDateTime(TimeZone.currentSystemDefault())
 
 /** Returns `true` if this certificate has expired. */
-val X509Certificate.isExpired: Boolean
+public val X509Certificate.isExpired: Boolean
   get() = Clock.System.now() > Instant.fromEpochMilliseconds(notAfter.time)
 
 /** Returns the remaining duration until this certificate expires (negative if already expired). */
-val X509Certificate.expiresIn: Duration
+public val X509Certificate.expiresIn: Duration
   get() = Instant.fromEpochMilliseconds(notAfter.time) - Clock.System.now()
 
 /**
  * Returns `true` if this certificate chain is signed by one of the given [root] CA certificates.
  */
-fun List<X509Certificate>.isSignedByRoot(root: List<X509Certificate>): Boolean {
+public fun List<X509Certificate>.isSignedByRoot(root: List<X509Certificate>): Boolean {
   check(isNotEmpty()) { "Cert chain is empty" }
   val trustAnchors = root.map { TrustAnchor(it, null) }.toSet()
   val params = PKIXParameters(trustAnchors).apply { isRevocationEnabled = false }

src/certkit/cert/San.kt

@@ -4,15 +4,15 @@ import certkit.der.Der
 import java.net.InetAddress
 
 /** Subject Alternative Name entry for X.509 certificates and CSR extension requests. */
-sealed interface San {
-  data class Dns(val name: String) : San
+public sealed interface San {
+  public data class Dns(val name: String) : San
 
-  data class Ip(val address: String) : San
+  public data class Ip(val address: String) : San
 
-  data class Email(val address: String) : San
+  public data class Email(val address: String) : San
 
   /** DER-encodes this SAN as a context-tagged GeneralName (RFC 5280 §4.2.1.6). */
-  fun toDer(): ByteArray =
+  public fun toDer(): ByteArray =
       when (this) {
         is Dns -> Der.implicitTag(2, name.encodeToByteArray())
         is Email -> Der.implicitTag(1, address.encodeToByteArray())

src/certkit/crl/Crl.kt

@@ -11,7 +11,7 @@ import kotlin.io.encoding.Base64
 import kotlin.time.Instant
 
 /** Parses and builds X.509 Certificate Revocation Lists (CRLs). */
-object Crl {
+public object Crl {
 
   private val CRL_PATTERN =
       """-+BEGIN\s+X509\s+CRL[^-]*-+[\s\r\n]+([a-z0-9+/=\r\n]+)-+END\s+X509\s+CRL[^-]*-+"""
@@ -22,14 +22,14 @@ object Crl {
   private val certFactory = CertificateFactory.getInstance("X.509")
 
   /** Parses an [X509CRL] from a PEM-encoded string. */
-  fun from(pem: String): X509CRL {
+  public fun from(pem: String): X509CRL {
     val match = CRL_PATTERN.find(pem) ?: error("No PEM-encoded CRL found")
     val der = Base64.Mime.decode(match.groupValues[1].encodeToByteArray())
     return certFactory.generateCRL(der.inputStream()) as X509CRL
   }
 
   /** Parses an [X509CRL] from DER-encoded bytes. */
-  fun from(bytes: ByteArray): X509CRL = certFactory.generateCRL(bytes.inputStream()) as X509CRL
+  public fun from(bytes: ByteArray): X509CRL = certFactory.generateCRL(bytes.inputStream()) as X509CRL
 
   /**
    * Builds a minimal X.509 CRL signed with SHA256withECDSA.
@@ -43,7 +43,7 @@ object Crl {
    * }
    * ```
    */
-  fun build(
+  public fun build(
       keyPair: KeyPair,
       issuer: X500Principal,
       thisUpdate: Instant,
@@ -92,7 +92,7 @@ object Crl {
    * GeneralName  ::= CHOICE { uniformResourceIdentifier [6] IA5String, ... }
    * ```
    */
-  fun distributionPoints(cert: X509Certificate): List<String> =
+  public fun distributionPoints(cert: X509Certificate): List<String> =
       cert
           .getExtensionValue("2.5.29.31")
           ?.let { unwrapOctetString(it) }

src/certkit/crl/Extns.kt

@@ -5,7 +5,7 @@ import java.security.cert.X509Certificate
 import javax.naming.ldap.LdapName
 
 /** Returns the issuer common name (CN) from the CRL's issuer distinguished name. */
-val X509CRL.issuerCN: String
+public val X509CRL.issuerCN: String
   get() =
       LdapName(issuerX500Principal.name)
           .rdns
@@ -14,11 +14,11 @@ val X509CRL.issuerCN: String
           .single()
 
 /** Returns `true` if this CRL was signed by the given [ca] certificate. */
-fun X509CRL.isSignedBy(ca: X509Certificate): Boolean =
+public fun X509CRL.isSignedBy(ca: X509Certificate): Boolean =
     issuerX500Principal == ca.subjectX500Principal && runCatching { verify(ca.publicKey) }.isSuccess
 
 /** Returns `true` if the given [cert] is revoked in this CRL. */
-operator fun X509CRL.contains(cert: X509Certificate): Boolean = isRevoked(cert)
+public operator fun X509CRL.contains(cert: X509Certificate): Boolean = isRevoked(cert)
 
 /** Returns `true` if this certificate is revoked per the given [crl]. */
-fun X509Certificate.isRevokedBy(crl: X509CRL): Boolean = crl.isRevoked(this)
+public fun X509Certificate.isRevokedBy(crl: X509CRL): Boolean = crl.isRevoked(this)

src/certkit/csr/Csr.kt

@@ -19,12 +19,12 @@ import javax.security.auth.x500.X500Principal
  * }
  * ```
  */
-object Csr {
+public object Csr {
 
   private const val SIGNATURE_OID_PREFIX = "Alg.Alias.Signature.OID."
 
   /** All signature algorithms discovered from JCA security providers, keyed by name. */
-  val signatureAlgorithms: Map<String, SignatureAlgo> by lazy {
+  public val signatureAlgorithms: Map<String, SignatureAlgo> by lazy {
     buildMap {
       Security.getProviders()
           .flatMap { it.entries }
@@ -38,7 +38,7 @@ object Csr {
   }
 
   /** Creates a CSR from an X.500 name string, signing with the given [keyPair]. */
-  fun create(
+  public fun create(
       x500Name: String,
       algorithmName: String,
       keyPair: KeyPair,
@@ -51,7 +51,7 @@ object Csr {
   }
 
   /** Creates a CSR by signing the given [info] with the [privateKey]. */
-  fun create(info: CsrInfo, algorithm: SignatureAlgo, privateKey: PrivateKey): CsrRequest =
+  public fun create(info: CsrInfo, algorithm: SignatureAlgo, privateKey: PrivateKey): CsrRequest =
       CsrRequest(info, algorithm, sign(info, algorithm, privateKey))
 
   private fun sign(info: CsrInfo, algorithm: SignatureAlgo, privateKey: PrivateKey): ByteArray =

src/certkit/csr/CsrRequest.kt

@@ -6,40 +6,40 @@ import java.security.PublicKey
 import javax.security.auth.x500.X500Principal
 
 /** An immutable PKCS#10 Certificate Signing Request. */
-class CsrRequest(
-    val info: CsrInfo,
-    val algorithm: SignatureAlgo,
-    val signature: ByteArray,
+public class CsrRequest(
+    public val info: CsrInfo,
+    public val algorithm: SignatureAlgo,
+    public val signature: ByteArray,
 ) {
-  val encoded =
+  public val encoded: ByteArray =
       Der.sequence(info.encoded, Der.sequence(algorithm.encoded), Der.bitString(0, signature))
 
-  override fun equals(other: Any?) =
+  override fun equals(other: Any?): Boolean =
       this === other || (other is CsrRequest && encoded.contentEquals(other.encoded))
 
-  override fun hashCode() = encoded.contentHashCode()
+  override fun hashCode(): Int = encoded.contentHashCode()
 
-  override fun toString() = "CsrRequest(info=$info, algorithm=$algorithm)"
+  override fun toString(): String = "CsrRequest(info=$info, algorithm=$algorithm)"
 }
 
 /**
  * Signature algorithm (name + OID) resolved from JCA security providers. Equality is by OID only.
  */
-class SignatureAlgo(val name: String, val oid: String) {
-  val encoded = Der.oid(oid)
+public class SignatureAlgo(public val name: String, public val oid: String) {
+  public val encoded: ByteArray = Der.oid(oid)
 
-  override fun equals(other: Any?) = this === other || (other is SignatureAlgo && oid == other.oid)
+  override fun equals(other: Any?): Boolean = this === other || (other is SignatureAlgo && oid == other.oid)
 
-  override fun hashCode() = oid.hashCode()
+  override fun hashCode(): Int = oid.hashCode()
 
-  override fun toString() = "SignatureAlgo(name=$name, oid=$oid)"
+  override fun toString(): String = "SignatureAlgo(name=$name, oid=$oid)"
 }
 
 /** PKCS#10 CSR info: subject name + public key + optional SANs, DER-encoded per RFC 2986 §4.1. */
-data class CsrInfo(
-    val subject: X500Principal,
-    val publicKey: PublicKey,
-    val sans: List<San> = emptyList(),
+public data class CsrInfo(
+    public val subject: X500Principal,
+    public val publicKey: PublicKey,
+    public val sans: List<San> = emptyList(),
 ) {
 
   private companion object {
@@ -56,7 +56,7 @@ data class CsrInfo(
     const val SUBJECT_ALT_NAME_OID = "2.5.29.17"
   }
 
-  val encoded: ByteArray
+  public val encoded: ByteArray
     get() =
         Der.sequence(
             VERSION_0,