feat(secrets): default resolver with TTL cache + audit (never logs plaintext)

2026-07-15 16:55:24 -04:00
parent 10455ec53b
commit 79ebd14baa
7 changed files with 435 additions and 0 deletions
@@ -0,0 +1,24 @@
+using System.Collections.Concurrent;
+using ZB.MOM.WW.Audit;
+
+namespace ZB.MOM.WW.Secrets.Tests.Fakes;
+
+/// <summary>
+/// An <see cref="IAuditWriter"/> test double that collects every <see cref="AuditEvent"/> written,
+/// so a test can assert on the audit trail (outcome, target, and — critically — that no plaintext
+/// ever appears in any field).
+/// </summary>
+public sealed class CapturingAuditWriter : IAuditWriter
+{
+    private readonly ConcurrentQueue<AuditEvent> _events = new();
+
+    /// <summary>The events captured so far, in write order.</summary>
+    public IReadOnlyList<AuditEvent> Events => _events.ToArray();
+
+    /// <inheritdoc />
+    public Task WriteAsync(AuditEvent evt, CancellationToken ct = default)
+    {
+        _events.Enqueue(evt);
+        return Task.CompletedTask;
+    }
+}