| | | 1 | | namespace AsiBackbone.Signing.ManagedKey; |
| | | 2 | | |
| | | 3 | | /// <summary> |
| | | 4 | | /// Configures the managed-key signing provider. |
| | | 5 | | /// </summary> |
| | | 6 | | /// <remarks> |
| | | 7 | | /// The options carry provider-neutral key references and operational behavior. They must not contain private keys, |
| | | 8 | | /// credentials, connection strings, client secrets, or managed identity tokens. |
| | | 9 | | /// </remarks> |
| | | 10 | | public sealed class ManagedKeySigningOptions |
| | | 11 | | { |
| | | 12 | | /// <summary> |
| | | 13 | | /// Gets the default provider descriptor returned in signing metadata. |
| | | 14 | | /// </summary> |
| | | 15 | | public const string DefaultProviderName = "managed-key"; |
| | | 16 | | |
| | | 17 | | /// <summary> |
| | | 18 | | /// Gets the default provider-neutral signature algorithm descriptor. |
| | | 19 | | /// </summary> |
| | | 20 | | public const string DefaultSignatureAlgorithm = "RSASSA-PKCS1-v1_5-SHA256-MANAGED-KEY"; |
| | | 21 | | |
| | | 22 | | /// <summary> |
| | | 23 | | /// Gets the default supported hash algorithm descriptor. |
| | | 24 | | /// </summary> |
| | | 25 | | public const string DefaultHashAlgorithm = "SHA-256"; |
| | | 26 | | |
| | | 27 | | /// <summary> |
| | | 28 | | /// Gets or sets the provider descriptor returned in signing metadata. |
| | | 29 | | /// </summary> |
| | 48 | 30 | | public string ProviderName { get; set; } = DefaultProviderName; |
| | | 31 | | |
| | | 32 | | /// <summary> |
| | | 33 | | /// Gets or sets the managed key identifier or key URI reference. |
| | | 34 | | /// </summary> |
| | 46 | 35 | | public string KeyId { get; set; } = string.Empty; |
| | | 36 | | |
| | | 37 | | /// <summary> |
| | | 38 | | /// Gets or sets the managed key version expected for signing. |
| | | 39 | | /// </summary> |
| | 18 | 40 | | public string? KeyVersion { get; set; } |
| | | 41 | | |
| | | 42 | | /// <summary> |
| | | 43 | | /// Gets or sets the provider-neutral signature algorithm descriptor requested from the managed-key client. |
| | | 44 | | /// </summary> |
| | 52 | 45 | | public string SignatureAlgorithm { get; set; } = DefaultSignatureAlgorithm; |
| | | 46 | | |
| | | 47 | | /// <summary> |
| | | 48 | | /// Gets or sets the hash algorithm expected on incoming signing requests. |
| | | 49 | | /// </summary> |
| | 46 | 50 | | public string HashAlgorithm { get; set; } = DefaultHashAlgorithm; |
| | | 51 | | |
| | | 52 | | /// <summary> |
| | | 53 | | /// Gets or sets a value indicating whether signing requests must specify or resolve a key version. |
| | | 54 | | /// </summary> |
| | 24 | 55 | | public bool RequireKeyVersion { get; set; } = true; |
| | | 56 | | |
| | | 57 | | /// <summary> |
| | | 58 | | /// Gets or sets a value indicating whether signing failures should return unsigned metadata instead of throwing. |
| | | 59 | | /// </summary> |
| | 18 | 60 | | public bool ReturnUnsignedOnFailure { get; set; } = true; |
| | | 61 | | |
| | | 62 | | /// <summary> |
| | | 63 | | /// Gets or sets the maximum number of retry attempts after the initial managed-key signing call. |
| | | 64 | | /// </summary> |
| | 40 | 65 | | public int MaxRetryAttempts { get; set; } = 2; |
| | | 66 | | |
| | | 67 | | /// <summary> |
| | | 68 | | /// Gets or sets the delay between retry attempts. |
| | | 69 | | /// </summary> |
| | 42 | 70 | | public TimeSpan RetryDelay { get; set; } = TimeSpan.FromMilliseconds(200); |
| | | 71 | | |
| | | 72 | | /// <summary> |
| | | 73 | | /// Creates managed-key signing options. |
| | | 74 | | /// </summary> |
| | | 75 | | public static ManagedKeySigningOptions Create( |
| | | 76 | | string keyId, |
| | | 77 | | string? keyVersion = null, |
| | | 78 | | string? providerName = null, |
| | | 79 | | string? signatureAlgorithm = null, |
| | | 80 | | string? hashAlgorithm = null, |
| | | 81 | | bool requireKeyVersion = true, |
| | | 82 | | bool returnUnsignedOnFailure = true, |
| | | 83 | | int maxRetryAttempts = 2, |
| | | 84 | | TimeSpan? retryDelay = null) |
| | | 85 | | { |
| | 8 | 86 | | var options = new ManagedKeySigningOptions |
| | 8 | 87 | | { |
| | 8 | 88 | | KeyId = keyId, |
| | 8 | 89 | | KeyVersion = NormalizeOptional(keyVersion), |
| | 8 | 90 | | ProviderName = NormalizeRequired(providerName, DefaultProviderName), |
| | 8 | 91 | | SignatureAlgorithm = NormalizeRequired(signatureAlgorithm, DefaultSignatureAlgorithm), |
| | 8 | 92 | | HashAlgorithm = NormalizeRequired(hashAlgorithm, DefaultHashAlgorithm), |
| | 8 | 93 | | RequireKeyVersion = requireKeyVersion, |
| | 8 | 94 | | ReturnUnsignedOnFailure = returnUnsignedOnFailure, |
| | 8 | 95 | | MaxRetryAttempts = maxRetryAttempts, |
| | 8 | 96 | | RetryDelay = retryDelay ?? TimeSpan.FromMilliseconds(200) |
| | 8 | 97 | | }; |
| | | 98 | | |
| | 8 | 99 | | options.Validate(); |
| | 8 | 100 | | return options; |
| | | 101 | | } |
| | | 102 | | |
| | | 103 | | /// <summary> |
| | | 104 | | /// Validates the managed-key signing options. |
| | | 105 | | /// </summary> |
| | | 106 | | public void Validate() |
| | | 107 | | { |
| | 20 | 108 | | if (string.IsNullOrWhiteSpace(ProviderName)) |
| | | 109 | | { |
| | 0 | 110 | | throw new InvalidOperationException("Managed-key signing provider name is required."); |
| | | 111 | | } |
| | | 112 | | |
| | 20 | 113 | | if (string.IsNullOrWhiteSpace(KeyId)) |
| | | 114 | | { |
| | 0 | 115 | | throw new InvalidOperationException("Managed-key signing key ID is required."); |
| | | 116 | | } |
| | | 117 | | |
| | 20 | 118 | | if (string.IsNullOrWhiteSpace(SignatureAlgorithm)) |
| | | 119 | | { |
| | 0 | 120 | | throw new InvalidOperationException("Managed-key signing signature algorithm is required."); |
| | | 121 | | } |
| | | 122 | | |
| | 20 | 123 | | if (string.IsNullOrWhiteSpace(HashAlgorithm)) |
| | | 124 | | { |
| | 0 | 125 | | throw new InvalidOperationException("Managed-key signing hash algorithm is required."); |
| | | 126 | | } |
| | | 127 | | |
| | 20 | 128 | | if (MaxRetryAttempts < 0) |
| | | 129 | | { |
| | 0 | 130 | | throw new InvalidOperationException("Managed-key signing retry attempts must be greater than or equal to zer |
| | | 131 | | } |
| | | 132 | | |
| | 20 | 133 | | if (RetryDelay < TimeSpan.Zero) |
| | | 134 | | { |
| | 0 | 135 | | throw new InvalidOperationException("Managed-key signing retry delay must be greater than or equal to zero." |
| | | 136 | | } |
| | 20 | 137 | | } |
| | | 138 | | |
| | | 139 | | private static string NormalizeRequired(string? value, string fallback) |
| | | 140 | | { |
| | 24 | 141 | | return string.IsNullOrWhiteSpace(value) ? fallback : value.Trim(); |
| | | 142 | | } |
| | | 143 | | |
| | | 144 | | private static string? NormalizeOptional(string? value) |
| | | 145 | | { |
| | 8 | 146 | | return string.IsNullOrWhiteSpace(value) ? null : value.Trim(); |
| | | 147 | | } |
| | | 148 | | } |