25 lines
857 B
C#
25 lines
857 B
C#
using Microsoft.AspNetCore.DataProtection;
|
|
|
|
namespace w4c_workflows.Services.Credentials;
|
|
|
|
/// <summary>
|
|
/// Encrypts credential payloads with ASP.NET Core Data Protection (AES-based,
|
|
/// authenticated). Key management/rotation is delegated to the Data Protection
|
|
/// keyring; the purpose string pins the format so keys can be rotated later.
|
|
/// </summary>
|
|
public sealed class DataProtectionCredentialCipher : ICredentialCipher
|
|
{
|
|
private const string Purpose = "w4c.workflows.credentials.v1";
|
|
|
|
private readonly IDataProtector _protector;
|
|
|
|
public DataProtectionCredentialCipher(IDataProtectionProvider provider)
|
|
{
|
|
_protector = provider.CreateProtector(Purpose);
|
|
}
|
|
|
|
public string Protect(string plaintext) => _protector.Protect(plaintext);
|
|
|
|
public string Unprotect(string ciphertext) => _protector.Unprotect(ciphertext);
|
|
}
|