IdentityShroud/IdentityShroud.Core/Services/DataEncryptionService.cs

using IdentityShroud.Core.Contracts;
using IdentityShroud.Core.Model;
using IdentityShroud.Core.Security;

namespace IdentityShroud.Core.Services;

public class DataEncryptionService(
    IDekEncryptionService dekCryptor) : IDataEncryptionService
{
    public EncryptedValue Encrypt(RealmDek dek, ReadOnlySpan<byte> plain)
    {
        var key = dekCryptor.Decrypt(dek.KeyData);
        byte[] cipher = Encryption.Encrypt(plain, key);
        return new (dek.Id, cipher);
    }

    public byte[] Decrypt(IReadOnlyList<RealmDek> deks, EncryptedValue input)
    {
        // Note a missing key SHOULD not happen. If it does happen something has seriously gone wrong like
        // - Old key removed before migration completed (should not be possible)
        // - Wrong keyset because of programming error.
        var dek = deks.SingleOrDefault(d => d.Id == input.DekId)
            ?? throw new InvalidOperationException("Required key not found");
        var key = dekCryptor.Decrypt(dek.KeyData);
        return Encryption.Decrypt(input.Value, key);
    }
}