Class AzkvMasterKey

Namespace

Nops.Core.Keys

Assembly

Nops.Core.Azkv.dll

Master key provider for Azure Key Vault keys used by SOPS. Uses Azure.Security.KeyVault.Keys to unwrap the encrypted data key share.

public class AzkvMasterKey : IMasterKeyProvider

Inheritance

object

AzkvMasterKey

Implements

IMasterKeyProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

AzkvMasterKey(string, string, string, string?, KeyClient?, TokenCredential?)

Creates a new Azure Key Vault master key provider.

public AzkvMasterKey(string vaultUrl, string keyName, string encryptedShare = "", string? keyVersion = null, KeyClient? client = null, TokenCredential? credential = null)

Parameters

vaultUrl string

keyName string

encryptedShare string

keyVersion string

client KeyClient

credential TokenCredential

Properties

Client

The KeyClient used for decryption. If null, uses DefaultAzureCredential.

public KeyClient? Client { get; }

Property Value

KeyClient

Credential

Optional token credential used to build the unwrap client. If null, uses DefaultAzureCredential.

public TokenCredential? Credential { get; }

Property Value

TokenCredential

EncryptedShare

Informational only: decryption uses the encrypted share read from the SOPS file metadata, so this can be left empty.

public string EncryptedShare { get; }

Property Value

string

KeyName

The name of the key in the vault.

public string KeyName { get; }

Property Value

string

KeyType

The key type identifier ("azure_kv").

public string KeyType { get; }

Property Value

string

KeyVersion

Optional specific version of the key. If null, uses the latest version.

public string? KeyVersion { get; }

Property Value

string

VaultUrl

The URL of the Key Vault (e.g., https://my-vault.vault.azure.net).

public string VaultUrl { get; }

Property Value

string

Methods

DecryptShareAsync(string, CancellationToken)

Decrypt the encrypted data key share using Azure Key Vault. Returns null if this key cannot decrypt (key not found, access denied, etc.).

public Task<byte[]?> DecryptShareAsync(string enc, CancellationToken ct = default)

Parameters

enc string

ct CancellationToken

Returns

Task<byte[]>