feat(secrets): pluggable master-key providers (env/file/dpapi) + factory

2026-07-15 16:43:10 -04:00
parent 01911508b9
commit 1c13b4af99
10 changed files with 568 additions and 0 deletions
@@ -25,6 +25,22 @@ public class AesGcmEnvelopeCipherTests
        Assert.Equal("hunter2", decrypted);
    }

+    [Fact]
+    public void TwoEncryptsProduceDifferentNonces()
+    {
+        var provider = new FakeMasterKeyProvider("k1");
+        var cipher = new AesGcmEnvelopeCipher(provider);
+        var name = new SecretName("sql/foo");
+
+        // Same plaintext + name encrypted twice must yield a fresh nonce (and therefore a distinct
+        // ciphertext) each time — the AES-GCM (key, nonce) uniqueness invariant.
+        StoredSecret first = cipher.Encrypt(name, "hunter2", SecretContentType.Text);
+        StoredSecret second = cipher.Encrypt(name, "hunter2", SecretContentType.Text);
+
+        Assert.False(first.Nonce.AsSpan().SequenceEqual(second.Nonce));
+        Assert.False(first.Ciphertext.AsSpan().SequenceEqual(second.Ciphertext));
+    }
+
    [Fact]
    public void TamperedCiphertextThrows()
    {