Class VaultTransitMasterKey

Namespace

Nops.Core.Keys

Assembly

Nops.Core.Vault.dll

Master key provider for HashiCorp Vault Transit secrets engine. Uses the Vault HTTP API to decrypt the encrypted data key share.

public class VaultTransitMasterKey : IMasterKeyProvider

Inheritance

object

VaultTransitMasterKey

Implements

IMasterKeyProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

VaultTransitMasterKey(string, string, string, string, string?, HttpClient?)

Creates a new Vault Transit master key provider.

public VaultTransitMasterKey(string address, string mountPath, string keyName, string encryptedShare = "", string? token = null, HttpClient? httpClient = null)

Parameters

address string

mountPath string

keyName string

encryptedShare string

token string

httpClient HttpClient

Properties

Address

The Vault server address (e.g., https://vault.example.com:8200).

public string Address { get; }

Property Value

string

EncryptedShare

Informational only: decryption uses the encrypted share read from the SOPS file metadata, so this can be left empty.

public string EncryptedShare { get; }

Property Value

string

HttpClient

Custom HttpClient for making requests. If null, uses a default client.

public HttpClient? HttpClient { get; }

Property Value

HttpClient

KeyName

The name of the transit key.

public string KeyName { get; }

Property Value

string

KeyType

The key type identifier ("hc_vault"), as written by sops.

public string KeyType { get; }

Property Value

string

MountPath

The transit secrets engine mount path (e.g., transit).

public string MountPath { get; }

Property Value

string

Token

The Vault token for authentication.

public string? Token { get; }

Property Value

string

Methods

DecryptShareAsync(string, CancellationToken)

Decrypt the encrypted data key share using Vault Transit secrets engine. Returns null if decryption fails (key not found, access denied, etc.).

public Task<byte[]?> DecryptShareAsync(string enc, CancellationToken ct = default)

Parameters

enc string

ct CancellationToken

Returns

Task<byte[]>