Class DummyKeyStore
Development-only IKeyStore that returns a single deterministic key derived from a
fixed pass-phrase. Used as the fallback when no production key store (e.g.
AddStrataraFileKeyStore) has been registered.
public sealed class DummyKeyStore : IKeyStore- Inheritance
-
DummyKeyStore
- Implements
- Inherited Members
- Extension Methods
Remarks
Never use in production, staging, QA, or any environment that handles real or
production-derived data. The constructor enforces a whitelist guard — it throws
InvalidOperationException in any environment whose name is not exactly
Development, so a host can never silently encrypt with the world-known test pass-phrase
baked into the shipping NuGet.
Register a real IKeyStore (the file-backed envelope store, an HSM, Key Vault, KMS,
etc.) before calling the security composition so the TryAdd default never resolves.
Constructors
DummyKeyStore(IHostEnvironment)
Creates a DummyKeyStore with the default test key-phrase.
public DummyKeyStore(IHostEnvironment environment)Parameters
environmentIHostEnvironmentThe host environment — used to enforce the Development-only whitelist guard.
Exceptions
- InvalidOperationException
Thrown when the host environment is anything other than
Development.
DummyKeyStore(IHostEnvironment, string)
Creates a DummyKeyStore with a custom key-phrase (test scenarios).
public DummyKeyStore(IHostEnvironment environment, string keyPhrase)Parameters
environmentIHostEnvironmentThe host environment — used to enforce the Development-only whitelist guard.
keyPhrasestringPass-phrase to derive the deterministic key from.
Exceptions
- InvalidOperationException
Thrown when the host environment is anything other than
Development.
Methods
EraseScopeAsync(KeyScope, CancellationToken)
Not supported. The development store derives its key from a fixed pass-phrase and holds no key material it could destroy, so an erasure here would shred nothing.
public ValueTask EraseScopeAsync(KeyScope scope, CancellationToken cancellationToken = default)Parameters
scopeKeyScopeThe scope to erase.
cancellationTokenCancellationTokenA token to cancel the operation.
Returns
Exceptions
- NotSupportedException
Always.
GetDataEncryptionKeyAsync(string, CancellationToken)
Return the raw key bytes for the id, or null if revoked / erased / unknown.
public ValueTask<byte[]?> GetDataEncryptionKeyAsync(string keyId, CancellationToken cancellationToken = default)Parameters
keyIdstringThe key id previously obtained from GetOrCreateCurrentKeyAsync(KeyScope, CancellationToken).
cancellationTokenCancellationTokenPropagated to the underlying store.
Returns
GetOrCreateCurrentKeyAsync(KeyScope, CancellationToken)
Return the current (highest non-revoked version) key for the scope, creating a first version if none exists yet.
public ValueTask<KeyMaterial> GetOrCreateCurrentKeyAsync(KeyScope scope, CancellationToken cancellationToken = default)Parameters
scopeKeyScopeThe key scope to resolve.
cancellationTokenCancellationTokenPropagated to the underlying store.
Returns
- ValueTask<KeyMaterial>
The resolved KeyMaterial (key id + raw bytes).
RevokeAsync(string, CancellationToken)
Not supported. The development store derives its key from a fixed pass-phrase and holds no key material it could destroy, so a revocation here would shred nothing.
public ValueTask RevokeAsync(string keyId, CancellationToken cancellationToken = default)Parameters
keyIdstringThe key to revoke.
cancellationTokenCancellationTokenA token to cancel the operation.
Returns
Exceptions
- NotSupportedException
Always.
RotateAsync(KeyScope, CancellationToken)
Create a new key version for the scope and make it the current one. Older versions remain resolvable via GetDataEncryptionKeyAsync(string, CancellationToken) so existing ciphertext stays readable.
public ValueTask<string> RotateAsync(KeyScope scope, CancellationToken cancellationToken = default)Parameters
scopeKeyScopeThe key scope to rotate.
cancellationTokenCancellationTokenPropagated to the underlying store.