Class BusEnvelopeIntegrityOptions

Namespace

Stratara.Abstractions.Messaging

Assembly

Stratara.Abstractions.dll

Configuration for opt-in HMAC integrity protection on bus envelopes. Mitigates tenant / actor spoofing and payload tampering on a compromised message bus by signing every outbound CommandEnvelope and EventBundle, and verifying it on the consumer side.

[ExcludeFromCodeCoverage]
public sealed class BusEnvelopeIntegrityOptions

Inheritance

object

BusEnvelopeIntegrityOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Bind from configuration via section SectionName ("BusEnvelopeIntegrity") or configure programmatically through services.AddBusEnvelopeIntegrity(o => ...). Mode defaults to Off: no signing, no verification — the framework behaves exactly as it did before this option was introduced unless the host opts in.

Signature scope (threat model). The HMAC covers the canonical projection produced by BusEnvelopeCanonical, which covers every field of the message except the signature itself: for CommandEnvelope the envelope id, the command type name, the session context, the heavy-lane flag and a SHA-256 digest of CommandJson; for EventBundle the session context and a SHA-256 digest over every field of every event in Events[]. Every field is length-prefixed, so content cannot be shifted across a field boundary without changing the projection. The signature therefore prevents tenant / actor spoofing, command-type substitution and payload tampering alike: a signature captured from one message does not verify when presented with a different body.

Fields marked [EncryptData] are additionally AES-GCM-encrypted with a tenant-bound AAD and refuse to decrypt after any tamper. That protection is independent of this option and still applies when Mode is Off.

The projection changed in 3.4.0 — before that release it covered identity only. Signatures produced by a pre-3.4.0 publisher do not verify against a 3.4.0 consumer; move a fleet across through Permissive.

Fields

SectionName

Configuration section name ("BusEnvelopeIntegrity") used to bind these options.

public const string SectionName = "BusEnvelopeIntegrity"

Field Value

string

Properties

Mode

Enforcement mode. Defaults to Off. Must match across the publisher and consumer fleets; switching from Off to Strict in a single step rejects in-flight envelopes — use Permissive as a rolling step.

public BusEnvelopeIntegrityMode Mode { get; set; }

Property Value

BusEnvelopeIntegrityMode

SharedKey

HMAC shared secret used to compute and verify envelope signatures. Must be at least 32 bytes (256 bit) and identical across every host that participates in the bus.

public byte[]? SharedKey { get; set; }

Property Value

byte[]