In KeyTemplate, either store a proto or a parameters, and convert them on demand.

This means registration of the respective serializer/parser can be done later. Users might save the object, and then later use it in e.g. Keysethandle.generateNew() and only have the serializer register at the later point. Hence we do it like this.

Unfortunately, this means that we may have to throw a TinkBugException (or something else which is unchecked) since the APIs do not throw anything. Within Google nobody called these APIs outside of Tink, so I am relatively sure that this is no problem.

Within Tink, the only remaining usage is in KeysetManager, and I changed things to throw a GeneralSecurityException there.

PiperOrigin-RevId: 549594684

2 files changed, 37 insertions, 1 deletions

diff --git a/java_src/src/test/java/com/google/crypto/tink/BUILD.bazel b/java_src/src/test/java/com/google/crypto/tink/BUILD.bazel
index adba38e7a..faec6a9b1 100644
--- a/java_src/src/test/java/com/google/crypto/tink/BUILD.bazel
+++ b/java_src/src/test/java/com/google/crypto/tink/BUILD.bazel
@@ -659,6 +659,9 @@ java_test(
         "//src/main/java/com/google/crypto/tink/aead:aes_gcm_parameters",
         "//src/main/java/com/google/crypto/tink/aead:predefined_aead_parameters",
         "//src/main/java/com/google/crypto/tink/internal:legacy_proto_parameters",
+        "//src/main/java/com/google/crypto/tink/internal:mutable_serialization_registry",
+        "//src/main/java/com/google/crypto/tink/internal:parameters_serializer",
+        "//src/main/java/com/google/crypto/tink/internal:proto_parameters_serialization",
         "@maven//:com_google_protobuf_protobuf_java",
         "@maven//:com_google_truth_truth",
         "@maven//:junit_junit",
diff --git a/java_src/src/test/java/com/google/crypto/tink/KeyTemplateTest.java b/java_src/src/test/java/com/google/crypto/tink/KeyTemplateTest.java
index 9d1ac8b89..67f66565a 100644
--- a/java_src/src/test/java/com/google/crypto/tink/KeyTemplateTest.java
+++ b/java_src/src/test/java/com/google/crypto/tink/KeyTemplateTest.java
@@ -23,6 +23,9 @@ import com.google.crypto.tink.aead.AeadConfig;
 import com.google.crypto.tink.aead.AesGcmParameters;
 import com.google.crypto.tink.aead.PredefinedAeadParameters;
 import com.google.crypto.tink.internal.LegacyProtoParameters;
+import com.google.crypto.tink.internal.MutableSerializationRegistry;
+import com.google.crypto.tink.internal.ParametersSerializer;
+import com.google.crypto.tink.internal.ProtoParametersSerialization;
 import com.google.crypto.tink.proto.AesGcmKeyFormat;
 import com.google.crypto.tink.proto.OutputPrefixType;
 import com.google.protobuf.ByteString;
@@ -110,7 +113,37 @@ public final class KeyTemplateTest {
             return false;
           }
         };
+    KeyTemplate t = KeyTemplate.createFrom(p);
+    assertThrows(RuntimeException.class, () -> t.getTypeUrl());
+  }
+
+  private static class ParametersSubclass extends Parameters {
+    ParametersSubclass() {}
+
+    @Override
+    public boolean hasIdRequirement() {
+      return false;
+    }
+  }
+
+  private static ParametersSerializer<ParametersSubclass, ProtoParametersSerialization>
+      PARAMETERS_SUBCLASS_SERIALIZER =
+          ParametersSerializer.create(
+              (ParametersSubclass p) ->
+                  ProtoParametersSerialization.create(
+                      "sometypeurl", OutputPrefixType.RAW, AesGcmKeyFormat.getDefaultInstance()),
+              ParametersSubclass.class,
+              ProtoParametersSerialization.class);
 
-    assertThrows(GeneralSecurityException.class, () -> KeyTemplate.createFrom(p));
+  @Test
+  public void testCreateFromParameters_unserializableAtCreationButLaterYes_works()
+      throws Exception {
+    Parameters p = new ParametersSubclass();
+    KeyTemplate t = KeyTemplate.createFrom(p);
+    // We only do this in this test, and never use it elsewhere -- hence this global state does not
+    // break anything.
+    MutableSerializationRegistry.globalInstance()
+        .registerParametersSerializer(PARAMETERS_SUBCLASS_SERIALIZER);
+    assertThat(t.getTypeUrl()).isEqualTo("sometypeurl");
   }
 }