feat(secrets): abstractions value types, enums, exceptions

2026-07-15 16:28:11 -04:00
parent 824facab39
commit d78b533045
8 changed files with 238 additions and 9 deletions
@@ -0,0 +1,39 @@
+namespace ZB.MOM.WW.Secrets.Abstractions;
+
+/// <summary>
+/// The safe, UI-facing projection of a secret. Deliberately carries <b>no</b>
+/// <see cref="byte"/> array members, so neither ciphertext nor plaintext can leak into
+/// rendered markup or logs via this type — it is safe to bind directly in management UIs.
+/// </summary>
+public record SecretMetadata
+{
+    /// <summary>The normalized secret name.</summary>
+    public required SecretName Name { get; init; }
+
+    /// <summary>Optional human-readable description.</summary>
+    public string? Description { get; init; }
+
+    /// <summary>How the decrypted plaintext should be interpreted.</summary>
+    public required SecretContentType ContentType { get; init; }
+
+    /// <summary>Identifier of the key-encryption key (KEK) that wrapped the DEK.</summary>
+    public required string KekId { get; init; }
+
+    /// <summary>Monotonic revision number.</summary>
+    public required long Revision { get; init; }
+
+    /// <summary>Whether the secret is soft-deleted (tombstoned).</summary>
+    public bool IsDeleted { get; init; }
+
+    /// <summary>When the secret was first created (UTC).</summary>
+    public required DateTimeOffset CreatedUtc { get; init; }
+
+    /// <summary>When the secret was last updated (UTC).</summary>
+    public required DateTimeOffset UpdatedUtc { get; init; }
+
+    /// <summary>Principal that created the secret, if known.</summary>
+    public string? CreatedBy { get; init; }
+
+    /// <summary>Principal that last updated the secret, if known.</summary>
+    public string? UpdatedBy { get; init; }
+}